CSF Tools has always been a human-readable map of security frameworks and controls. It now exposes that same library over the Model Context Protocol (MCP), so an AI agent can look up a control, follow its mappings, and answer questions without scraping pages.
Example questions that should work once you are connected:
- What does NIST SP 800-53 Rev. 5 AC-2 require, and which CSF 2.0 subcategories does it support?
- Crosswalk CIS Controls 8.1 to NIST 800-53 and the Privacy Framework.
- Which STRIDE-LM threats does NIST 800-53 Control CP-7 address?
- Show the High baseline enhancements for SC-7.
What you need
- Create an account at CSF Tools. Check email for the confirmation.
- Next, go to “API Access” under the profile menu and create an application password.
You will see a one-time display of the password. - Point your MCP client at: https://csf.tools/wp-json/csftools/v1/mcp
Authenticate with HTTP Basic Auth:
- Username: your CSF Tools username
- Password: the application password
If the client only accepts a header, send:
Authorization: Basic <base64 of username:application-password>Claude Desktop example:
{
"mcpServers": {
"csf-tools": {
"url": "https://csf.tools/wp-json/csftools/v1/mcp",
"headers": {
"Authorization": "Basic REPLACE_ME"
}
}
}
}Access is read-only. Create one application password per client and revoke it from your profile if you stop using that client. Never put your login password in an agent config.