Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
/plugin marketplace add hackIDLE/fedramp-docs-mcpnpx agentmods add plugins/hackidle/fedramp-docs-mcp/plugingit clone --depth 1 https://github.com/hackIDLE/fedramp-docs-mcpGrade A, and why
fedramp-docs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"name": "fedramp-docs",
"description": "FedRAMP compliance toolkit - search docs, analyze controls, track changes",
"version": "1.0.0",
"author": {
"name": "Ethan Troy"
},
"repository": "https://github.com/hackIDLE/fedramp-docs-mcp",
"license": "MIT",
"keywords": ["fedramp", "compliance", "nist", "security", "frmr", "cloud"]
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 12 lines scan A e73dff0617aa
fedramp-docs is a plugin published in the GitHub repository hackIDLE/fedramp-docs-mcp (18 stars, last pushed 4mo ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other plugins, from other repositories
compliance-trestle-suite
Plugin marketplace listing 2 plugins: compliance-trestle, oscal-document-workbench.
compliance-trestle
Manage OSCAL compliance packages using Compliance Trestle - a CNCF sandbox project for machine-readable compliance documentation (NIST OSCAL standard).
oscal-document-workbench
Convert legacy SSP/PDF/DOCX source material into traceable, validated OSCAL workspaces using Compliance Trestle and OSCAL CLI.
grc-skills
Claude Code skills for Governance, Risk & Compliance — ISO 27001, SOC 2, FedRAMP, GDPR, HIPAA, NIST CSF, PCI DSS, TSA Cybersecurity, ISO 42001 AI Management System, ISO 27701 Privacy Information Management, DORA Digital Operational Resilience, DPDPA India Digital Personal Data Protection, CMMC 2.0 Cybersecurity…
cis-controls
CIS Controls v8 (CIS Top 18) advisor — Implementation Group scoping (IG1/IG2/IG3), gap assessments across all 153 safeguards, asset/software inventory, data protection, secure configuration, MFA and access control, vulnerability management, audit log management, malware defenses, incident response, penetration testing.
eu-ai-act
EU AI Act (Regulation (EU) 2024/1689) compliance advisor — risk classification across all four tiers, all 9 prohibited practices (Art. 5), Annex III high-risk use cases, provider and deployer obligations (Arts. 9–17, 26), GPAI model obligations and systemic risk (Arts. 51–55, enforcement Aug 2, 2026), conformity…