cpcsc-mcp enters soft launch
Our MCP server for CPCSC Level 1 readiness now covers 46 ITSP.10.171 controls, drafts the Level 1 self-assessment, and is open to collaborators.
CPCSC Level 1 is now a condition of award on select Department of National Defence contracts. To help suppliers prepare, we built cpcsc-mcp, a Model Context Protocol server that assesses an Azure environment against the ITSP.10.171 controls behind the Level 1 self-assessment.
What it does
Connect it to Claude Desktop, Claude Code or any other MCP client and ask:
Generate a CPCSC Level 1 gap report for my Azure subscription.
Within minutes the server evaluates the environment through read-only Azure queries and returns a structured gap report with a prioritized remediation sequence. It also drafts the 13-requirement Level 1 package: a suggested MET / NOT MET for each requirement, the official assessment objectives, the organization-defined parameters you need to fill in, the specific non-compliant resources, and remediation notes.
Where the build stands
- Ten tools. They cover scanning, per-control drill-down, compliance summaries, Microsoft Secure Score, gap reports and the Level 1 generator.
- 46 controls across 11 families. These are the 13 Level 1 controls plus groundwork for Level 2. 33 are automated or hybrid, and the rest carry a structured manual-review checklist.
- A security gate on every change. Bandit, pip-audit, gitleaks and Trivy run on every change, and deploys use GitHub OIDC with no stored credential.
On a development subscription, a read-only scan returned 15 compliant, 9 non-compliant, 13 manual-review and 9 not-assessed controls. Most of the non-compliant findings came from security tooling that hadn’t been turned on.
It informs the attestation; it doesn’t replace it
Level 1 is an attestation that a responsible official reviews, backs with evidence and submits. cpcsc-mcp gets you to that evidence faster. It checks that a control is configured, not whether it’s effective end to end, and controls like physical protection always need human evidence.
Licence
cpcsc-mcp is source-shared under the Business Source License 1.1. You can run it free for your own assessments. Offering it as a paid or hosted service to third parties needs a commercial licence. Each version converts to Apache 2.0 at its change date.
Collaborators wanted
The repository is private for now. We’re looking for people to help with:
- More Azure checks. Go deeper than “is it configured” towards “does it meet the control’s intent”.
- Real-world testing. Run it across different tenants and tell us where findings are wrong, noisy or missing evidence.
- Practitioner review. CPCSC and CMMC assessors checking the drafted self-assessment against a real human review.
- Control mapping. Validate the ITSP.10.171 Rev 3 crosswalk and build out the 98 Level 2 controls.
Email info@exploitsbay.com with your GitHub handle and use case. More detail is on the Tools page.