Policy-MCP

# Policy MCP - SCF Policy Analyzer A lightweight Model Context Protocol (MCP) server for mapping policy text and evidence to official Secure Controls Framework (SCF) 2025.4 controls. ## Project Status - **Phase 1: Relational Database Generation** ✅ **COMPLETE** (March 31, 2026) - SQLite database built with 1,451 controls, 40 risks, 42 threats, and 73,000+ relationships - Configuration-driven ETL pipeline fully implemented - All code linting issues resolved - **Phase 2: Core SQL Tool Implementation** 🔄 **READY TO START** - MCP server rewrite to use SQLite instead of pandas - Implementation of `get_control()`, `search_framework()`, and `get_associated_risks()` tools - **Phase 3: Branch Point** 🔄 **PENDING** - Multi-tool chain validation with <100ms latency requirement For detailed progress tracking, see [PROJECT_CHECKLIST.md](Documentation/PROJECT_CHECKLIST.md). ## Overview This project provides an MCP server (`scf_mcp.py`) that: - Loads the SCF 2025.4 catalog from `secure-controls-framework-scf-2025-4.xlsx` - Exposes a policy-analysis prompt (`analyze_scf_policy`) - Exposes a control lookup tool (`search_scf_controls`) - Exposes a CSV export tool (`save_scf_mapping_to_csv`) The workflow is designed to reduce hallucinated mappings by requiring direct lookup against authoritative SCF content. ## Current Capabilities - Authoritative SCF catalog loading at server startup - Keyword and concept search across control domain, name, and description - Structured mapping output contract: - `scf_id` - `scf_domain` - `control_name` - `evidence_excerpt` - Export of mapped controls to CSV in project-local paths - Path anchoring based on the script directory to avoid current-working-directory issues ## Project Structure ``` Policy MCP/ scf_mcp.py requirements.txt secure-controls-framework-scf-2025-4.xlsx vpn_mfa_mapping.csv debugging/ Documentation/ README.md QUICK_SETUP.md ``` ## Basic Workflow Example Example policy text: ```text All corporate users, including third-party contractors, must authenticate using phishing-resistant Multi-Factor Authentication (MFA) prior to establishing a Virtual Private Network (VPN) connection to the production environment. VPN session timeouts are enforced after 15 minutes of inactivity. ``` Example workflow: 1. Start the MCP server. 2. Use `search_scf_controls` for key concepts such as: - `multi-factor authentication` - `virtual private network` - `session termination` 3. Build a JSON array of validated mappings. 4. Save with `save_scf_mapping_to_csv` (for example, `vpn_mfa_mapping.csv`). Example mapping object: ```json { "scf_id": "IAC-06", "scf_domain": "Identification & Authentication", "control_name": "Multi-Factor Authentication (MFA)", "evidence_excerpt": "must authenticate using phishing-resistant Multi-Factor Authentication (MFA)" } ``` ## Implementation Notes - The server loads data from sheet `SCF 2025.4` using `pandas` and `openpyxl`. - Output files are written relative to the script directory to keep artifacts in the project. - If the catalog is unavailable at startup, search returns an explicit error message. ## Future Enhancements Plan ### Near Term - Add richer search scoring (exact match + semantic weighting) - Add configurable minimum confidence and deduplication - Add stronger validation for expected output schema before CSV export ### Mid Term - Add batch policy ingestion (multiple snippets/documents) - Add optional JSONL and Markdown report exports - Add reusable workflow templates for common control families (IAM, NET, CRY) ### Long Term - Add semantic search and synonym expansion for SCF concepts - Add traceability fields (`source_document`, `line_reference`, `review_status`) - Add automated test coverage for loader, search, and exporter functions ## Quick Start See [Documentation/QUICK_SETUP.md](Documentation/QUICK_SETUP.md) for a concise setup and run guide.