Scf MCP server
MCP server for the SCF Controls Platform — 187 tools for controls, evidence, risk, and TPRM.
B78/100grade B
Adoption
Growing
2 stars1.6k downloads/wk
Reviews
Write oneNobody has reviewed Scf yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Scf tools
No tool declarations could be read from the package source. They show once the server is installed.
Public scan report
scanner v0.1.5 · 2026-09-19 · same rubric, same numbers if you re-run it
no findings
- Code scan35 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitystatic API keys via environment variables6/15
- Maintenancelast push 2 days ago15/15
- Maintainer identitynamespace and repository owner differ; GitHub account older than a year5/10
Overall 78/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON
Install directly
Runs npx -y mcp-server-scf on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add mcp-server-scf -- npx -y mcp-server-scf
Scf: common questions
- Is Scf MCP server safe?
- Mostly: it is graded B (78/100). Read the Scf safety report
- How do I install Scf?
- It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
- Does Scf need an API key?
- Yes. The registry entry asks for
SCF_API_KEY. - Is Scf maintained?
- The last commit was 2 days ago (2026-09-18). The latest release is v3.4.2.