Tools
MCP server for Claude Code, Claude Desktop or any MCP-compatible agent. Database bundled, no extra setup.
claude mcp add gasp-aicf -- npx -y gasp-aicf-mcp{
"mcpServers": {
"gasp-aicf": {
"command": "npx",
"args": ["-y", "gasp-aicf-mcp"]
}
}
}Restart your client after adding the config. On first run, npx downloads and caches the package; subsequent starts are instant.
The server runs as a local process over stdio, with no open ports or authentication required. Your AI client spawns it via npx and calls its tools like any function. The control database is bundled in the package.
10 read-only tools: a scoping interview that works out what applies, classification, control and profile lookup, questionnaire scoping, evidence checklists and the references registry.
4 readable resources: domain taxonomy, framework index, control index and the full mapping matrix, returned as structured JSON.
Published on npm with the database bundled. One config block and a client restart. Pair with other MCP servers at the config level.
Advanced
Restart Claude Code (or run /mcp to reload), then ask:
List the AI governance controls at Tier 2.To use a modified or newer version of the database, set DB_PATH:
{
"mcpServers": {
"gasp-aicf": {
"command": "npx",
"args": ["-y", "gasp-aicf-mcp"],
"env": { "DB_PATH": "/absolute/path/to/gasp.db" }
}
}
}Pipe JSON-RPC directly to verify the server works:
echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | npx gasp-aicf-mcpTools
assess_scope (answers{}) The scoping interview. Pass the answers so far, keyed by question id with option ids as values, and get the next question, the profiles, tier and frameworks the answers support and every control as in scope, to confirm, satisfied by the provider or eliminated with its reason. Deterministic: the same answers give the same result. Start with an empty object.
classify_tool (category, data_types[]?, is_ai_tool, access_mode?, user_scope?, roles[]?, ai_risk_class?, deployment_model?, jurisdictions[]?, downstream_modification?) Maps a tool's category, data types, access mode, exposure, roles and AI risk class to the relevant AICF control domains and returns a recommended risk tier, the matching profiles, the applicable frameworks and any role warnings. Use this first when assessing any new tool.
list_controls (domain_id?, tier_id?, is_ai_specific?, search?) List canonical controls with optional filters. Returns ID, name, domain, minimum tier and mapping count for each match.
get_control (id) Full detail for one control: description, rationale, all assessment questions, evidence requirements and framework mappings with strength.
get_questionnaire (domains[], tier_id, profile?) Return all assessment questions scoped to a set of activated domains at a given risk tier. With a profile, controls the profile excludes are dropped and controls satisfied by the provider are listed in their own section.
get_evidence_checklist (domains[], tier_id, profile?) Return all evidence requirements for the activated domains and tier. Each item includes evidence type, test class, example artifact and test method. Takes the same profile argument as get_questionnaire.
get_framework_references (framework?, classification?) The external documents each source framework cites, classified by how they bind, with dated watch items for instruments not yet landed.
list_profiles () Every profile with its status, version, roles, deployment models, risk classes, jurisdictions and the size of its applicability statement.
get_profile (id) One profile with its applicability statement grouped by applicability then domain: which controls are required, recommended, conditional or not applicable, and why.
get_applicability (control_id) Every profile's applicability row for one control. Use it to see how a control's duty shifts between the provider and deployer seats.
Resources
Resources are read-only structured data that the AI client can load as context. Each returns the full dataset as JSON.
gasp://domains All 11 control domains with IDs, names and descriptions. Load this to understand the taxonomy before querying controls.
gasp://frameworks All 18 loaded frameworks with version numbers, 12 source frameworks, 2 crosswalks and 4 profile overlays. Useful for understanding which standards are covered.
gasp://controls Condensed index of all 201 canonical controls: ID, name, domain and minimum tier. Faster than list_controls when you just need the index.
gasp://mapping-matrix Full mapping matrix: every canonical control cross-referenced with every framework, including mapping strength. Use this for compliance gap analysis across frameworks.
Example prompts
Once the server is connected, ask your AI assistant questions in plain language. The client will call the appropriate tools automatically.
"Run the AICF scoping interview for us. We build a customer-support chatbot on a hosted model and sell it to EU and US companies."
"We're adopting Notion as a company knowledge base. It will store some PII (employee directories) and business-confidential documents. Classify it against AICF and tell me what controls apply."
"We're evaluating an AI-powered analytics tool that processes financial data. What questionnaire questions and evidence would AICF require for a Tier 3 assessment?"
"Classify our new AI analytics vendor, then list the Tier 2 questionnaire questions and evidence we'd need to gather for each active domain."
"List all AICF controls that map to NIST AI RMF. For each one, tell me whether the mapping is full or partial and what the gap is."
"We deploy a vendor's AI system rather than build our own. Get the enterprise-ai-deployer profile and tell me which AI governance controls we own and which we evidence through the provider."
Pairing with other MCP servers
The AICF MCP server is intentionally standalone. To build richer workflows, add other MCP servers to your client config alongside it.
GASP Standard measures what SaaS AI reports; AICF is how an organisation governs it. The two meet in the SaaS AI Provider profile. Install both for end-to-end AI governance.
Visit gaspwiki.comClassify new dependencies or AI features introduced in a PR and list the controls they trigger.
Open assessment tickets from a tool's active domains and required evidence.
Answer "what controls apply to tool X?" in-channel from the control library.