Nobody will fine you for skipping NIST AI RMF, which is exactly why it tends to sit unread. Making the four functions callable turns it into something a team can actually run against a system in an afternoon, and the risk register it produces is the artefact that survives the meeting. Pair it with the EU AI Act servers in the same fleet if you need the assessment to satisfy an obligation rather than a policy.
An MCP server built around the NIST AI Risk Management Framework. It takes a system you describe, maps its impacts, assesses its risk profile against the framework's functions, and proposes the controls that follow — turning a document you would otherwise read into an assessment you can run.
- A risk profile assessed against the framework rather than against a checklist you wrote — `assess_risk_profile`
- The impacts of an AI system mapped, which is the MAP function's whole job and the step teams usually skip — `map_ai_impact`
- Risk controls generated from that assessment, so the output is something to implement rather than a score — `generate_risk_controls`
- A risk register and a trustworthy-AI assessment structured the way the framework expects, across its MAP, MEASURE, MANAGE and GOVERN functions
No key on the free tier, which allows 10 calls a day. Launch with `uvx nist-rmf-ai-mcp` over stdio, or `pip install nist_rmf_ai_mcp` and run the command; the package is `nist-rmf-ai-mcp` (1.0.15 in pyproject and server.json). A Smithery installer is available for Claude Desktop. NIST's framework is voluntary, so this produces internal assurance rather than a filing anyone requires.
One command — uvx nist-rmf-ai-mcp