FedRAMP 20x Requirements — Claude Code MCP server: setup guide
Connects Claude Code to 321 FedRAMP 20x controls and analyzes codebase compliance using tree-sitter AST patterns with an Azure focus.
claude mcp add fedramp20xmcp -- uvx fedramp-20x-mcpWhat FedRAMP 20x Requirements does
The server pulls data directly from official FedRAMP 20x repositories. It covers 199 FedRAMP Requirements (FRR), 72 Key Security Indicators (KSI), and 50 formal definitions. Implementation advice prioritizes Microsoft Azure environments, highlighting services like Microsoft Entra ID, Key Vault, AKS, and Bicep templates.
Static verification runs through the GenericPatternAnalyzer engine using tree-sitter. It parses 14 languages, including Python, C#, TypeScript, Terraform, and Dockerfile files against 381 YAML detection patterns. The application_profile parameter reduces noise by adapting rules to targets like CLI tools or batch jobs.
Running this tool requires Python 3.10 or higher. FedRAMP 20x requires machine-readable output formats, so NIST OSCAL is supported as an option rather than a rigid requirement.
What it helps with
- query FedRAMP 20x requirements across specific control families
- scan application code and Bicep scripts against KSI indicators
- tailor compliance checks to app architectures with
application_profile - retrieve Azure evidence collection patterns for active security controls
Example prompts for the agent
- Show FedRAMP 20x requirements for the VDR family with Azure remediation examples
- Run a compliance scan on our Bicep template using the iac-only application profile
- Explain the machine-readable authorization data sharing requirement under FedRAMP 20x
How to install FedRAMP 20x Requirements
Platform CLI
claude mcp add fedramp20xmcp -- uvx fedramp-20x-mcpuvx runs the command named after the package; if the README names another one, use uvx --from fedramp-20x-mcp <command>
Platform CLI
codex mcp add fedramp-20x-requirements -- uvx fedramp-20x-mcpuvx runs the command named after the package; if the README names another one, use uvx --from fedramp-20x-mcp <command>
Config file
{
"mcpServers": {
"fedramp-20x-requirements": {
"command": "uvx",
"args": [
"fedramp-20x-mcp"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from fedramp-20x-mcp <command>
Config file
{
"servers": {
"fedramp-20x-requirements": {
"type": "stdio",
"command": "uvx",
"args": [
"fedramp-20x-mcp"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from fedramp-20x-mcp <command>
Platform CLI
gemini mcp add fedramp-20x-requirements uvx fedramp-20x-mcpuvx runs the command named after the package; if the README names another one, use uvx --from fedramp-20x-mcp <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about FedRAMP 20x Requirements
How do I install FedRAMP 20x Requirements in Claude Code?
Run claude mcp add fedramp-20x-requirements -- uvx fedramp-20x-mcp in your terminal. You must have Python 3.10 or higher installed.
Does FedRAMP 20x compliance strictly enforce the OSCAL schema?
No, the 20x baseline requires machine-readable files such as JSON or XML. OSCAL is an acceptable path, but the specification does not mandate it.
Which languages does the pattern analyzer support?
The AST engine inspects 14 formats using tree-sitter, including Python, C#, Java, TypeScript, Bicep, Terraform, and CI configuration files.
