MacTech CMMC / NIST 800-171 is a remote MCP server that gives an AI agent 13 tools, among them calculate_sprs_score, check_contract_type_eligibility, crosswalk_control. It answers at https://www.mactechsolutionsllc.com/api/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 10 of 10 times since 5 September 2026; the last check, on 18 October 2026, succeeded.
NIST 800-171 control lookup and exact SPRS scoring with official DoD assessment weights, for CMMC.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
calculate_sprs_score | Compute an exact SPRS score per the DoD Assessment Methodology: start at 110 and subtract each unimplemented requirement's Annex A weight (floor −203). Pass the control numbers that are NOT implemented; optionally pass 3.5.3 and/or 3.13.11 Inputs: not_implemented, partially_implemented |
check_contract_type_eligibility | Determine whether a contractor can legally be awarded a given contract type, based on the business systems that type requires. A cost-reimbursement contract may be awarded only if the accounting system is adequate for determining costs (FAR Inputs: contract_type, include_sf1408 |
crosswalk_control | Map a security control across frameworks: NIST SP 800-171 Rev 2 ↔ NIST SP 800-53 (FedRAMP Moderate) ↔ NIST CSF 2.0 ↔ SOC 2 Trust Services Criteria. Accepts an 800-171 number ("3.5.3"), an 800-53 id ("AC-2"), a CSF category ("PR.AA" style / Inputs: control |
crosswalk_revisions | Explain how NIST SP 800-171 Rev 2 and Rev 3 differ, and what happened to a specific requirement between them. Call this when someone is implementing Rev 3 early, holds a Rev 3 citation and needs the Rev 2 obligation, or asks which revision Inputs: requirement |
determine_cmmc_level | Determine which CMMC level (1, 2, or 3) applies to a defense contractor based on the data they handle and the clauses in their contracts, and - separately - which assessment type may actually be designated today. Those are not the same ques Inputs: handles_cui, contract_clauses |
generate_poam_entries | Turn a list of unimplemented NIST SP 800-171 controls into structured Plan of Action & Milestones (POA&M) entries - deficiency description, planned remediation, priority derived from the SPRS weight, and target dates per DoD-aligned governa Inputs: gaps |
get_assessment_objectives | Get the official NIST SP 800-171A assessment objectives for one NIST SP 800-171 Rev 2 requirement - the exact "Determine if..." objectives a CMMC Level 2 assessor scores, plus the potential assessment methods (what an assessor examines, who Inputs: control |
list_controls | List NIST SP 800-171 Rev 2 requirements with their DoD Assessment Methodology (SPRS) weights, optionally filtered by control family name or by point weight (5, 3, or 1). Call this to enumerate the 110 CMMC Level 2 controls, to find all 5-po Inputs: family, weight, verbose |
list_level1_practices | List all 17 CMMC Level 1 basic safeguarding practices with their FAR 52.204-21 clause citations - the complete requirement set for contractors handling Federal Contract Information (FCI) only. Call this when the user asks what CMMC Level 1 |
lookup_clause | Explain what a FAR or DFARS cybersecurity clause obliges a contractor to do: what triggers it, the concrete duties, the reporting deadlines, what it flows down to subcontractors, and which other clauses come with it. Covers 52.204-21, 252.2 Inputs: clause |
lookup_control | Get one NIST SP 800-171 Rev 2 security requirement by number (e.g. "3.5.3"): the full requirement text, its control family, and its exact DoD Assessment Methodology (SPRS) point weight, including the sliding-scale rules for 3.5.3 (MFA) and Inputs: control, sections |
lookup_rev3_requirement | Get one NIST SP 800-171 REVISION 3 requirement by its zero-padded number (e.g. "03.01.01"): the requirement statement, its organization-defined parameters, the 800-171A Rev 3 assessment objectives, and whether it was withdrawn. Rev 3 has 97 Inputs: requirement |
scope_assessment | Work out which assets fall inside a CMMC assessment boundary, and what each category obliges. Returns the DoD asset categories (CUI Asset, Security Protection Asset, Contractor Risk Managed Asset, Specialized Asset, Out-of-Scope) with how e Inputs: level, include_cui_categories |
Every block below points at https://www.mactechsolutionsllc.com/api/mcp. Pick your client and copy.
claude mcp add --transport http mactech-cmmc-nist-800-171 https://www.mactechsolutionsllc.com/api/mcp
{
"mcpServers": {
"mactech-cmmc-nist-800-171": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://www.mactechsolutionsllc.com/api/mcp"]
}
}
}{
"mcpServers": {
"mactech-cmmc-nist-800-171": {
"url": "https://www.mactechsolutionsllc.com/api/mcp"
}
}
}{
"servers": {
"mactech-cmmc-nist-800-171": {
"type": "http",
"url": "https://www.mactechsolutionsllc.com/api/mcp"
}
}
}{
"context_servers": {
"mactech-cmmc-nist-800-171": {
"url": "https://www.mactechsolutionsllc.com/api/mcp"
}
}
}{
"mcpServers": {
"mactech-cmmc-nist-800-171": {
"serverUrl": "https://www.mactechsolutionsllc.com/api/mcp"
}
}
}{
"mcpServers": {
"mactech-cmmc-nist-800-171": {
"url": "https://www.mactechsolutionsllc.com/api/mcp"
}
}
}name: MacTech CMMC / NIST 800-171
version: 0.0.1
schema: v1
mcpServers:
- name: MacTech CMMC / NIST 800-171
type: streamable-http
url: https://www.mactechsolutionsllc.com/api/mcp{
"mcpServers": {
"mactech-cmmc-nist-800-171": {
"httpUrl": "https://www.mactechsolutionsllc.com/api/mcp"
}
}
}{
"mcpServers": {
"mactech-cmmc-nist-800-171": {
"type": "http",
"url": "https://www.mactechsolutionsllc.com/api/mcp"
}
}
}{
"mcpServers": {
"mactech-cmmc-nist-800-171": {
"url": "https://www.mactechsolutionsllc.com/api/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fwww.mactechsolutionsllc.com%2Fapi%2Fmcp&type=streamable_http&id=mactech-cmmc-nist-800-171&name=MacTech%20CMMC%20/%20NIST%20800-171
It answered our last check on 18 October 2026 in 378 ms. Over 10 checks since 5 September 2026 it answered 10. Status here comes from Neuronto's own probes, not from the publisher.
Yes. It is published by mactechsolutionsllc.com and served from www.mactechsolutionsllc.com, the vendor's own domain: https://www.mactechsolutionsllc.com/api/mcp.
13, as returned by the server's own tools/list on 31 August 2026: calculate_sprs_score, check_contract_type_eligibility, crosswalk_control, crosswalk_revisions, determine_cmmc_level, generate_poam_entries, get_assessment_objectives, list_controls, and 5 more.
It answered our last check on 18 October 2026 in 378 ms. Over 10 checks since 5 September 2026 it answered 10.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://www.mactechsolutionsllc.com/api/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: com.mactechsolutionsllc.www. Endpoint host: www.mactechsolutionsllc.com. ARD identifier: urn:air:com.mactechsolutionsllc.www:mcp:cmmc.
First indexed 31 August 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.