Categories › Security › Code & dependency scanning
NIST 800-171 controls and 800-171A objectives, crosswalks, exact SPRS scoring, POA&M generation.
Remote server: your requests and data go to www.mactechsolutionsllc.com. Claude Code: claude mcp add --transport http nist-800-171 https://www.mactechsolutionsllc.com/api/mcp · Claude app: Settings → Connectors → Add custom connector.
The tools this server listed when we connected to it, in its own words.
lookup_control — Get one NIST SP 800-171 Rev 2 security requirement by number (e.g. "3.5.3"): the full requirement text, its control family, and its exact Dolist_controls — List NIST SP 800-171 Rev 2 requirements with their DoD Assessment Methodology (SPRS) weights, optionally filtered by control family name or calculate_sprs_score — Compute an exact SPRS score per the DoD Assessment Methodology: start at 110 and subtract each unimplemented requirement's Annex A weight (fget_assessment_objectives — Get the official NIST SP 800-171A assessment objectives for one NIST SP 800-171 Rev 2 requirement - the exact "Determine if..." objectives acrosswalk_control — Map a security control across frameworks: NIST SP 800-171 Rev 2 ↔ NIST SP 800-53 (FedRAMP Moderate) ↔ NIST CSF 2.0 ↔ SOC 2 Trust Services Crdetermine_cmmc_level — Determine which CMMC level (1, 2, or 3) applies to a defense contractor based on the data they handle and the clauses in their contracts, anlist_level1_practices — List all 17 CMMC Level 1 basic safeguarding practices with their FAR 52.204-21 clause citations - the complete requirement set for contractogenerate_poam_entries — Turn a list of unimplemented NIST SP 800-171 controls into structured Plan of Action & Milestones (POA&M) entries, and - the part that decidcheck_contract_type_eligibility — Determine whether a contractor can legally be awarded a given contract type, based on the business systems that type requires. A cost-reimbulookup_clause — Explain what a FAR or DFARS cybersecurity clause obliges a contractor to do: what triggers it, the concrete duties, the reporting deadlines,scope_assessment — Work out which assets fall inside a CMMC assessment boundary, and what each category obliges. Returns the DoD asset categories (CUI Asset, Slookup_rev3_requirement — Get one NIST SP 800-171 REVISION 3 requirement by its zero-padded number (e.g. "03.01.01"): the requirement statement, its organization-deficrosswalk_revisions — Explain how NIST SP 800-171 Rev 2 and Rev 3 differ, and what happened to a specific requirement between them. Call this when someone is implNot tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.