MacTech Solutions MCP server

• Registry namecom.mactechsolutionsllc.www/cmmcverified in the MCP registry

The registry name sits under mactechsolutionsllc.com. The registry only lets a publisher use that namespace after proving control of the domain through DNS or HTTP.

• Stateanswerschecked 2026-10-19
• Tools13
• Server calls itselfmactech-cmmc
• Server version1.2.0
• Protocol version2025-06-18

On 2026-10-19 the server answered initialize and tools/list without a sign-in. First answer in 43 ms.

• Its tools do none of the product's use cases we checked: consolidate CUI into one assessable enclave; map NIST 800-171 controls to supporting evidence; monitor subcontractor cyber posture against flow-down clauses.

Said by rules from the measurements above. The likely first call is a model's pick from the tool list; read its description before relying on it.

• INITE MCP score72 of 100answers 100 · does the job 0 · definitions 100 · context 96 · connects 100
• What an agent can do with it0 of 3 use cases
• Answered100% of days10 of 10 daily checks
• Median first answer99 ms
• Space in an agent's context≈ 3,516 tokensthe definitions of all its tools (13), which an agent carries on every turn
• Tool definitionsA · 100 of 100
• Typed results1 of 13 toolsdeclared outputSchema: results come typed, read once

• Every tool passes all six checks.

A program checks the server once a day: initialize and tools/list, no model. Tokens are the definitions' length at about four characters a token. The grade averages six checks of every tool's name, description, schema and annotations; it says how well the tools are described, not whether they work. The score weighs what was measured and nothing else: answering (25%), doing the product's job (25%), definitions (20%), context (10%), use (10%) and how readily a client connects (10%). A part that was not measured is left out, and a hidden instruction caps the score at 40. The state of vendors' MCP servers: method and numbers →

• lookup_control

  Get one NIST SP 800-171 Rev 2 security requirement by number (e.g. "3.5.3"): the full requirement text, its control family, and its exact DoD Assessment Methodology (SPRS) point weight, including the sliding-scale rules for 3.5.3 (MFA)…

• list_controls

  List NIST SP 800-171 Rev 2 requirements with their DoD Assessment Methodology (SPRS) weights, optionally filtered by control family name or by point weight (5, 3, or 1). Call this to enumerate the 110 CMMC Level 2 controls, to find all…

• calculate_sprs_score

  Compute an exact SPRS score per the DoD Assessment Methodology: start at 110 and subtract each unimplemented requirement's Annex A weight (floor −203). Pass the control numbers that are NOT implemented; optionally pass 3.5.3 and/or…

• get_assessment_objectives

  Get the official NIST SP 800-171A assessment objectives for one NIST SP 800-171 Rev 2 requirement - the exact "Determine if..." objectives a CMMC Level 2 assessor scores, plus the potential assessment methods (what an assessor examines…

• crosswalk_control

  Map a security control across frameworks: NIST SP 800-171 Rev 2 ↔ NIST SP 800-53 (FedRAMP Moderate) ↔ NIST CSF 2.0 ↔ SOC 2 Trust Services Criteria. Accepts an 800-171 number ("3.5.3"), an 800-53 id ("AC-2"), a CSF category ("PR.AA" style…

• determine_cmmc_level

  Determine which CMMC level (1, 2, or 3) applies to a defense contractor based on the data they handle and the clauses in their contracts, and - separately - which assessment type may actually be designated today. Those are not the same…

• list_level1_practices

  List all 17 CMMC Level 1 basic safeguarding practices with their FAR 52.204-21 clause citations - the complete requirement set for contractors handling Federal Contract Information (FCI) only. Call this when the user asks what CMMC Level…

• generate_poam_entries

  Turn a list of unimplemented NIST SP 800-171 controls into structured Plan of Action & Milestones (POA&M) entries, and - the part that decides whether the plan is usable - sort them by eligibility under 32 CFR 170.21. Most gaps CANNOT go…

• check_contract_type_eligibility

  Determine whether a contractor can legally be awarded a given contract type, based on the business systems that type requires. A cost-reimbursement contract may be awarded only if the accounting system is adequate for determining costs…

• lookup_clause

  Explain what a FAR or DFARS cybersecurity clause obliges a contractor to do: what triggers it, the concrete duties, the reporting deadlines, what it flows down to subcontractors, and which other clauses come with it. Covers 52.204-21…

• scope_assessment

  Work out which assets fall inside a CMMC assessment boundary, and what each category obliges. Returns the DoD asset categories (CUI Asset, Security Protection Asset, Contractor Risk Managed Asset, Specialized Asset, Out-of-Scope) with how…

• lookup_rev3_requirement

  Get one NIST SP 800-171 REVISION 3 requirement by its zero-padded number (e.g. "03.01.01"): the requirement statement, its organization-defined parameters, the 800-171A Rev 3 assessment objectives, and whether it was withdrawn. Rev 3 has…

• crosswalk_revisions

  Explain how NIST SP 800-171 Rev 2 and Rev 3 differ, and what happened to a specific requirement between them. Call this when someone is implementing Rev 3 early, holds a Rev 3 citation and needs the Rev 2 obligation, or asks which…

• com.mactechsolutionsllc.www/federal-marketanswers, 7 toolsverified in the MCP registry
• com.mactechsolutionsllc.www/stiganswers, 4 toolsverified in the MCP registry