Security & GRC MCP Server

A standalone MCP server for AI-assisted security scanning and compliance gap analysis. Scans code and text for credentials, PII, and OWASP vulnerabilities, and runs compliance gap analysis across NCA ECC/DCC/CCC/CSCC, ISO 27001, NIST CSF, and SOC 2 — entirely local, no data leaves your machine.

---

Tools

Security Scanning

Tool	Parameters	Description
scan_code	code, language?	OWASP Top 10 vulnerability scan on source code
scan_secrets	text	Detects 30+ credential patterns (API keys, tokens, private keys)
scan_pii	text	Detects PII: emails, phones, credit cards, national IDs, IBANs
scan_vulnerabilities	code, language?	Alias for scan_code
health	—	Server status and version

GRC Compliance

Tool	Parameters	Description
list_frameworks	—	Lists all supported frameworks with control counts
control_lookup	framework, control_id?, domain?	Look up specific controls or browse by domain
check_nca_ecc	control_id, evidence?	Check a single NCA ECC control against evidence text
gap_analysis	framework, current_controls?	Full gap analysis across all controls in a framework

Supported frameworks: nca_ecc, nca_dcc, nca_ccc, nca_cscc, iso_27001, nist_csf, soc_2

Example outputs

scan_secrets

{
  "scan_type": "secrets",
  "findings_count": 1,
  "findings": [{"type": "GitHub Token", "severity": "CRITICAL", "count": 1, "redacted_samples": ["ghp_Ab***xyz1"]}],
  "verdict": "CRITICAL EXPOSURE — ROTATE CREDENTIALS IMMEDIATELY"
}

gap_analysis (nca_ecc, with evidence)

{
  "framework": "nca_ecc",
  "compliance_score_pct": 64.3,
  "implemented": 9,
  "partial": 3,
  "not_implemented": 5,
  "gaps_count": 8,
  "domain_summary": {"access_control": {"total": 6, "implemented": 4, ...}}
}

---

Connecting to Claude Desktop

Add this to your claude_desktop_config.json:

{
  "mcpServers": {
    "security-grc": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "-e", "ALLOWED_API_KEYS=pro_your_key_here",
        "-p", "8080:8080",
        "security-grc-mcp"
      ]
    }
  }
}

Or if running locally (without Docker):

{
  "mcpServers": {
    "security-grc": {
      "command": "python",
      "args": ["/path/to/server.py"],
      "env": {
        "ALLOWED_API_KEYS": "pro_your_key_here"
      }
    }
  }
}

All tool calls require your API key as the api_key parameter.

---

Setup

# 1. Clone or copy this directory
cp .env.example .env
# Edit .env and set your ALLOWED_API_KEYS

# 2. Install dependencies
pip install -r requirements.txt

# 3. Run
python server.py

# Or with Docker
docker build -t security-grc-mcp .
docker run --env-file .env -p 8080:8080 security-grc-mcp

---

Pricing

Tier	Key prefix	Calls/day	Price
Free	free_	100	Free
Pro	pro_	Unlimited	$29/month

To get a Pro key or request a free key, contact: abdullahajn@gmail.com

---

Notes

• All scanning is fully local — no code or text is sent to any external service.
• GRC assessments use heuristic keyword matching. Results are a readiness checklist, not an official certification or audit opinion.
• NCA framework catalogs are curated readiness subsets, not official NCA assessment registers.

---

Version 1.0.0 · Contact: abdullahajn@gmail.com