assess_risk_profileLABSCO SUMMARY
Voluntary framework, so the output is for you.
Nobody will fine you for skipping NIST AI RMF, which is exactly why it tends to sit unread. Making the four functions callable turns it into something a team can actually run against a system in an afternoon, and the risk register it produces is the artefact that survives the meeting. Pair it with the EU AI Act servers in the same fleet if you need the assessment to satisfy an obligation rather than a policy.
What it is
An MCP server built around the NIST AI Risk Management Framework. It takes a system you describe, maps its impacts, assesses its risk profile against the framework's functions, and proposes the controls that follow — turning a document you would otherwise read into an assessment you can run.
What you get
- A risk profile assessed against the framework rather than against a checklist you wrote —
assess_risk_profile - The impacts of an AI system mapped, which is the MAP function's whole job and the step teams usually skip —
map_ai_impact - Risk controls generated from that assessment, so the output is something to implement rather than a score —
generate_risk_controls - A risk register and a trustworthy-AI assessment structured the way the framework expects, across its MAP, MEASURE, MANAGE and GOVERN functions
Requirements
No key on the free tier, which allows 10 calls a day. Install with pip install nist_rmf_ai_mcp; your client then starts it with the nist_rmf_ai_mcp command, over stdio. NIST's framework is voluntary, so this produces internal assurance rather than a filing anyone requires.
Setup effort
One command — pip install nist_rmf_ai_mcp
USE CASES
01
Assessing a system nobody has formally reviewed
Run the risk profile against the framework's functions and get a structured result instead of a discussion.
02
Working out who the system affects
Map the AI impacts before measuring anything, which is the step that determines whether the rest of the assessment is aimed at the right risks.
03
Turning findings into work
Generate controls from the assessment so the output is a list of things to implement rather than a rating.
04
Starting a risk register from nothing
Use the framework's structure to produce the first version, then maintain it rather than inventing a format.
6 tools
Listed in project docs. Your client may show a different list.
map_ai_impactgenerate_risk_controlscrosswalk_to_eu_ai_actcreate_risk_reportcheck_trustworthy_characteristicsBEFORE YOU INSTALL
What to know first
Tools you get
6 tools named in the project's documentation.
Requires
Python 3.10 or later
INSTALLATION
Connect your client
Add the block to your client, or run the command directly.
Server setup
Configuration file
JSON
{
"mcpServers": {
"nist-rmf-ai-mcp": {
"command": "nist_rmf_ai_mcp"
}
}
}pip
TERMINAL
pip install nist_rmf_ai_mcp