The CMMC MCP Server
Give your AI assistant the actual numbers. All 110 NIST SP 800-171 Rev 2 requirements, the official DoD Assessment Methodology point weights, and an exact SPRS score calculator — served over the Model Context Protocol, free, no login.
Connect it
The server speaks streamable HTTP at https://www.mactechsolutionsllc.com/api/mcp
Claude Code
claude mcp add --transport http mactech-cmmc https://www.mactechsolutionsllc.com/api/mcpClaude (web and desktop)
Settings → Connectors → Add custom connector → paste the server URL above.
Any MCP client (JSON config)
{
"mcpServers": {
"mactech-cmmc": {
"url": "https://www.mactechsolutionsllc.com/api/mcp"
}
}
}What it can do
get_assessment_objectives
The official NIST 800-171A assessment objectives for any control — the exact “Determine if…” statements a C3PAO scores, plus what assessors examine, who they interview, and what they test.
“How will an assessor test 3.5.3? What evidence should I have ready?”
crosswalk_control
Map any control across frameworks: NIST 800-171 ↔ NIST 800-53 (FedRAMP Moderate) ↔ CSF 2.0 ↔ SOC 2 Trust Services Criteria.
“We already have SOC 2 — which CMMC controls does CC6 cover?”
determine_cmmc_level
FCI vs CUI → which CMMC level applies, what assessment it requires, and which DFARS clauses trigger it.
“We only handle FCI — do we need CMMC at all?”
generate_poam_entries
Turn assessment gaps into structured POA&M entries — priorities from SPRS weights, 90/180-day target dates, and the governance rules a POA&M must satisfy to survive an assessment.
“We failed 3.11.2 and 3.14.1 — draft the remediation plan.”
lookup_control
One requirement by number — full text, control family, and its exact SPRS point weight, including the sliding-scale rules for 3.5.3 (MFA) and 3.13.11 (FIPS-validated cryptography).
“What does 3.13.11 actually require, and what is it worth?”
list_controls
Enumerate the 110-control catalog, filtered by family or by weight — for example, every 5-point requirement.
“List all the 5-point controls in Access Control.”
calculate_sprs_score
Exact SPRS arithmetic: 110 minus each unimplemented control's Annex A weight, floored at −203, with the 88-point conditional-certification threshold and the no-SSP gate applied.
“We have no MFA for general users and no vulnerability scanning — what is our SPRS score?”
Why this exists
Language models routinely misremember individual DoD Assessment Methodology weights — and a single wrong 5-point control moves an SPRS score materially. This server carries the exact Annex A values, so your assistant computes the number instead of recalling it. It is the same dataset behind our free instant CMMC readiness check.
Frequently asked questions
What is the MacTech CMMC MCP server?
A free, public Model Context Protocol (MCP) server that gives AI assistants like Claude authoritative NIST SP 800-171 Rev 2 data: the full requirement text of all 110 controls, each control's official DoD Assessment Methodology point weight, and an exact SPRS score calculator with the sliding-scale rules for MFA (3.5.3) and FIPS cryptography (3.13.11). Once connected, your assistant answers CMMC questions from the source data instead of from memory.
What tools does the server expose?
Eight: lookup_control and list_controls (the 110-requirement catalog with SPRS weights), calculate_sprs_score (exact DoD-methodology arithmetic), get_assessment_objectives (the official 800-171A “Determine if…” objectives and assessor methods for every control), crosswalk_control (800-171 ↔ 800-53/FedRAMP ↔ CSF 2.0 ↔ SOC 2), determine_cmmc_level (FCI vs CUI → Level 1/2/3), list_level1_practices (the 17 FAR 52.204-21 practices), and generate_poam_entries (structured remediation plans with governance rules).
Does it require authentication or cost anything?
No. It is free, unauthenticated, and stateless — it serves reference data and computes scores. Nothing you send is stored: we keep daily aggregate counts only (how many connections, which tools were called, client application names). No request or response payloads, no raw IP addresses, and no user agents are ever recorded.
Why use this instead of asking the AI directly?
Language models frequently misremember individual control weights, and one wrong 5-point control changes an SPRS score materially. The server carries the exact Annex A values from the DoD Assessment Methodology, so weights and score arithmetic are computed, not recalled.
Also from MacTech: the Federal Market MCP server — live SAM.gov opportunities and USASpending award data — and the STIG server — 1,406 DISA hardening rules with real check and fix text. MacTech Solutions is an SDVOSB that builds CUI enclaves and takes defense contractors from first SSP to C3PAO-ready. See the CMMC offerings or talk to the compliance team.