Fedramp MCP Server

Fedramp MCP server is a locally run integration for AI assistants that speak the Model Context Protocol. Query FedRAMP 20x KSIs, NIST controls, and compliance docs via 20 MCP tools.

What you get

Custom Model Context Protocol (MCP) server that makes the FedRAMP/docs repository queryable with FRMR-aware tooling. The server scans FRMR JSON datasets and supporting markdown guidance, exposes structured tools for analysis, and can optionally clone and cache the upstream repository for you.

• Auto-detects all 12 FRMR JSON document types and builds typed metadata
• Extracts KSI entries, flattened control mappings, and Significant Change references
• Fast markdown search via an inverted index backed by Lunr with snippets and line numbers
• Indexes 62+ markdown files from tools/site/content/ (Zensical static site content)
• Structured diffing between FRMR versions, including per-item change detection
• Health check, version listing, and curated Significant Change guidance aggregator

What the assistant can call

Once Fedramp is connected, these are the calls the assistant has available:

• search_tools — Required for discovering other tools
• search_markdown — Most common entry point for documentation queries
• list_frmr_documents — Starting point for FRMR data exploration
• health_check — Diagnostics and status verification
• get_requirement_by_id — Universal ID lookup across all document types
• Analysis — The Analysis tool exposed by this server
• System — The System tool exposed by this server
• OpenCode — OpenCode is a powerful AI coding agent built for the terminal with native MCP support
• Goose — Goose is Block's open-source AI agent. You can add the FedRAMP Docs MCP server using any of these methods:
• Kiro — Kiro is AWS's spec-driven IDE with native MCP support

Setting it up

The server ships on npm as fedramp-docs-mcp, so your MCP client can launch it on demand — there is no separate build step. Add the server block to your client's configuration, restart it, and the tools register themselves.

Configuration and credentials

You will need 3 environment variables: FEDRAMP_DOCS_AUTO_UPDATE, FEDRAMP_DOCS_UPDATE_CHECK_HOURS, FEDRAMP_DOCS_PATH. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.

• Node.js 18 or higher - npm 8 or higher

Choosing this one

Plenty of cloud and infrastructure servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Fedramp's toolset — search_tools, search_markdown, list_frmr_documents and 7 more — is a fair guide to whether it matches your workflow. It is maintained by ethanolivertroy; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.

Before you rely on it

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• With 10 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Fedramp.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the fedramp mcp server does with a few real requests.