# FedRAMP 20x Requirements

Connects Claude Code to 321 FedRAMP 20x controls and analyzes codebase compliance using tree-sitter AST patterns with an Azure focus.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 6
- Author: KevinRabun
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/KevinRabun/FedRAMP20xMCP
- Updated: 2026-02-21
- HTML: https://affpapa.org/en/nevibecode/mcp/fedramp-20x-requirements

## What it does

The server pulls data directly from official FedRAMP 20x repositories. It covers 199 FedRAMP Requirements (FRR), 72 Key Security Indicators (KSI), and 50 formal definitions. Implementation advice prioritizes Microsoft Azure environments, highlighting services like Microsoft Entra ID, Key Vault, AKS, and Bicep templates.

Static verification runs through the `GenericPatternAnalyzer` engine using `tree-sitter`. It parses 14 languages, including Python, C#, TypeScript, Terraform, and Dockerfile files against 381 YAML detection patterns. The `application_profile` parameter reduces noise by adapting rules to targets like CLI tools or batch jobs.

Running this tool requires Python 3.10 or higher. FedRAMP 20x requires machine-readable output formats, so NIST OSCAL is supported as an option rather than a rigid requirement.

## Requirements
- Needs: Python and uv (commands run via uvx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add fedramp20xmcp -- uvx fedramp-20x-mcp
```
uvx runs the command named after the package; if the README names another one, use uvx --from fedramp-20x-mcp <command>

### Codex

**Platform CLI**
```bash
codex mcp add fedramp-20x-requirements -- uvx fedramp-20x-mcp
```
uvx runs the command named after the package; if the README names another one, use uvx --from fedramp-20x-mcp <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "fedramp-20x-requirements": {
            "command": "uvx",
            "args": [
                "fedramp-20x-mcp"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from fedramp-20x-mcp <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "fedramp-20x-requirements": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "fedramp-20x-mcp"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from fedramp-20x-mcp <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add fedramp-20x-requirements uvx fedramp-20x-mcp
```
uvx runs the command named after the package; if the README names another one, use uvx --from fedramp-20x-mcp <command>

## When to use it
- query FedRAMP 20x requirements across specific control families
- scan application code and Bicep scripts against KSI indicators
- tailor compliance checks to app architectures with `application_profile`
- retrieve Azure evidence collection patterns for active security controls

## Example prompts
- Show FedRAMP 20x requirements for the VDR family with Azure remediation examples
- Run a compliance scan on our Bicep template using the iac-only application profile
- Explain the machine-readable authorization data sharing requirement under FedRAMP 20x

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md