NIST SP 800-53 Rev 5 knowledge-base MCP server (324 controls) with SOC 2 TSC mappings and BM25 search.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"compliance-kb-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# compliance-kb-mcp [](https://opensource.org/licenses/Apache-2.0) [](https://pypi.org/project/compliance-kb-mcp/) [](https://www.npmjs.com/package/@auditpilot/compliance-kb-mcp) `compliance-kb-mcp` is a typed MCP server that exposes the canonical **NIST Special Publication 800-53 Revision 5** control catalog (324 base controls across 20 families) over stdio transport. Each control is annotated with the SOC 2 Trust Services Criteria identifiers it helps satisfy, derived from publicly available crosswalks. This package is part of the AuditPilot SOC 2 readiness reference architecture and is designed to be easy to fork for other control catalogs. ## Why NIST 800-53? - **Public domain.** NIST 800-53 is a U.S. federal government work and is in the public domain (17 U.S.C. 105). The full canonical control text can be redistributed without licensing concerns. - **Machine-readable canonical source.** NIST publishes the catalog in OSCAL JSON, XML, and YAML at [usnistgov/oscal-content](https://github.com/usnistgov/oscal-content). - **Well-mapped to SOC 2.** The AICPA publishes a TSC to 800-53 mapping (registration required); supplementary public crosswalks like the [Open Security Architecture project](https://opensecurityarchitecture.org/frameworks/soc2-tsc) make the relationship transparent. ## Positioning > AuditPilot maps your environment to NIST 800-53 controls and shows which > SOC 2 Trust Services Criteria are satisfied by your 800-53 coverage. The > included `compliance-kb-mcp` ships with NIST 800-53 Rev 5 (public domain) > and curated SOC 2 TSC mappings. For canonical SOC 2 TSC text, refer to > AICPA-CIMA's published 2017 Trust Services Criteria -- that text is > copyright-protected and is not redistributed in this package. ## Features - Strict…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.