security-framework-mcp

Unified NIST + OWASP security framework MCP server

한국어

Search and query 4,700+ security data points through a single MCP interface — NIST (1,196 SP 800-53 controls with 53A assessments and 53B baselines, CSF 2.0, PF 1.0, SP 800-37 RMF, 613 publications, CMVP, NICE, glossary, CSF↔800-53 mappings) and OWASP (Top 10, API/LLM/MCP Top 10, ASVS 5.0, WSTG, MASVS, Proactive Controls, 815+ CWEs, 559 CAPEC attack patterns, 113+ Cheat Sheets, 418+ projects) — with live NVD/CVE + CISA KEV + EPSS, PDF reading, compliance mapping, STRIDE threat modeling, and MCP security assessment.

Quick Start

pip install git+https://github.com/zer0-kr/security-framework-mcp.git

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "security": {
      "command": "security-framework-mcp"
    }
  }
}

Claude CLI (Claude Code):

claude mcp add security -- security-framework-mcp

{ "security": { "command": "security-framework-mcp" } }

First run automatically builds the local database (~15-20 seconds). Auto-refreshes weekly.

Data Sources (22 local + 3 live)

NIST (10)

OWASP (12)

Live APIs

Tools (41)

NIST

OWASP

Vulnerability & CWE

Analysis & Assessment

Prompts (4)

Use Cases

Vulnerability Management

> Triage CVE-2021-44228 and CVE-2023-44487 — show EPSS, CVSS, KEV status

> Show all CISA KEV entries for Microsoft added after 2025-01-01

> Show only KEV vulnerabilities with known ransomware campaign use

> What attack patterns target CWE-502 (deserialization)?

> Map CWE-79 to OWASP Top 10, ASVS requirements, WSTG tests, and remediation guidance

Compliance & Audit

> What NIST SP 800-53 controls and ASVS requirements map to PCI-DSS 8.3?

> Map ASVS V4 to PCI-DSS 4.0, ISO 27001, and NIST 800-53

> Map NIST SP 800-53 AC family to PCI-DSS and ISO 27001

> Show SP 800-53 LOW baseline controls for the IA (Identification and Authentication) family

> Show SP 800-53 AC-1 control with 53A assessment objectives

Threat Modeling & Architecture Review

> Generate a STRIDE threat model: payment API, JWT auth, PostgreSQL, Redis cache

> Assess my stack: React, Node.js, PostgreSQL, REST API, AWS Lambda

> Find CAPEC attack patterns related to SQL injection

> Search all NIST and OWASP sources for "zero trust"

Development Security

> Generate a comprehensive security checklist for a web API project

> Show OWASP Cheat Sheet for Authentication

> Cross-reference CWE-352 (CSRF) to Top 10, ASVS, and WSTG test cases

> Show ASVS V3 (Session Management) level 2 requirements

> Search NVD for critical log4j CVEs

Configuration

Architecture

┌─────────────────────────────────┐
│         MCP Client              │
│  (Claude / Cursor / OpenCode)   │
└──────────────┬──────────────────┘
               │ stdio
┌──────────────▼──────────────────┐
│   security-framework-mcp        │
│  41 tools · 4 prompts · 6 rsrc │
├──────────────┬──────────────────┤
│  SQLite FTS5 │  Live APIs       │
│  (~6.2MB)    │  NVD+KEV+EPSS   │
├──────────────┴──────────────────┤
│  NIST Collectors (10)           │
│  OWASP Collectors (12)          │
└──────────────┬──────────────────┘
               │ httpx (retry)
┌──────────────▼──────────────────┐
│  NIST OSCAL/CSRC · OWASP GitHub │
└─────────────────────────────────┘

Development

git clone https://github.com/zer0-kr/security-framework-mcp.git
cd security-framework-mcp
pip install -e ".[dev]"
python -m pytest tests/test_unit_db.py tests/test_unit_collectors.py -v
python tests/test_comprehensive.py

Contributing

1. Fork → 2. Branch → 3. Test (python -m pytest) → 4. PR

License

MIT

Not affiliated with OWASP Foundation or NIST. Data sourced from public repositories.