Five tools · free · nothing to sign
Tools you can run right now
Two checkers that return a number in the browser, and three MCP servers that give your AI assistant the source data instead of its memory. No account, no email, no trial. What we build under contract is further down the page, clearly marked as such.
Free · no sign-in · ~5 minutes
CMMC readiness check
Answer 24 questions about how your environment actually runs today.
What a result proves: An estimated SPRS score on the real −203 to 110 scale, with the gap broken out across all 14 NIST 800-171 families - the number a prime or contracting officer will ask you for.
Free · no sign-in · ~2 minutes
POA&M eligibility checker
Mark the requirements you have open and see which ones a POA&M is allowed to carry. Runs entirely in your browser - nothing is submitted anywhere.
What a result proves: Whether a qualifying score is a usable one. 32 CFR 170.21 bars every requirement worth more than one point, plus six named exceptions - so a score of 88 can still be un-POA&M-able.
Free · no sign-in · ~5 minutes
MSP / ESP grader
Thirteen questions about what your provider has given you in writing, each with the rule that makes it matter. The grade is on the page; the letter to send them arrives by email.
What a result proves: Whether the provider you are paying can be evidenced inside your CMMC scope (the CRM, FedRAMP, FIPS, the 72-hour clock), or is a gap with a monthly invoice.
Free · by email · generated today
CMMC templates pack
Twelve working files: an SSP skeleton with the objectives under each requirement, a POA&M register with the rules in every row, all 320 assessment objectives, and the scoping, data-flow, FIPS and flow-down inventories.
What a result proves: That your program is built on the requirement text, the weights and the objectives an assessor will use, not on a paraphrase.
Free · no sign-in · sources on the page
CMMC cost estimator
Four answers: level, size, how much of 800-171 is in place, who does the work. The three-year range is on the page; the line items arrive by email.
What a result proves: Which part of the cost is DoD's (their own assessment figures from the final rule, by page number) and which part is yours, in hours at the rule's labor rates, with a deliberately small boundary priced beside it.
Free · no sign-in · in your browser
SPRS score calculator
Mark each of the 110 NIST 800-171 requirements met, partial or open; the score updates as you go and stays on your device.
What a result proves: Your SPRS score by the DoD Assessment Methodology, with the sliding-scale cases handled correctly, and whether what is left could be carried on a POA&M.
Free · 110 pages · no sign-in
NIST 800-171 requirement reference
One page per requirement: the text, its SPRS weight, the 320 assessment objectives, POA&M eligibility and crosswalks to 800-53, CSF 2.0 and SOC 2.
What a result proves: What an assessor will actually determine for a requirement, objective by objective, before you claim it is met.
Free · no account · no API key
CMMC / NIST 800-171 MCP server
Connect 13 tools to your AI assistant: the 110 Rev 2 requirements, the 320 assessment objectives, FAR/DFARS clause duties, and exact SPRS arithmetic.
What a result proves: That the score, the weight and the clause your assistant quotes were retrieved or computed from the published methodology, not recalled - and it can tell you which source it used.
Free · no account · no API key
STIG MCP server
Search 2,029 DISA STIG rules across 15 benchmarks and export a DISA .ckl checklist.
What a result proves: That the check command and the fix text are the ones DISA published for that rule ID and benchmark version - so the config line you paste is real.
Free · USASpending needs no key
Federal Market MCP server
Search live SAM.gov opportunities and registrations, and aggregate USASpending award history.
What a result proves: Who actually holds the work, from the government’s own award records - incumbent, obligation size, and whether a set-aside is your only way in.
What we build under contract
Everything below is a platform, module or template MacTech has delivered on a program - not something you can launch from this page. Twenty of them have an interactive walkthrough you can open without signing in; the rest start with a conversation. Anything still in development is deliberately absent, because a catalog that lists intentions is a catalog you cannot trust.
Security
Cybersecurity, RMF, and CMMC delivery · led by Patrick Caruso
10 entries
Ran one and did not like the number?
That is the useful moment. The Verified Readiness Scan scores all 110 requirements against your actual environment and hands you the remediation order.