csf.tools valid

CSF Tools

The Cybersecurity Framework for Humans

For agents: CSF Tools: a browsable cybersecurity framework site with control sets such as Cloud Controls Matrix v3/v4 and Critical Security Controls v7.1.

cybersecurity frameworknist csfcloud controls matrixcritical security controlssecurity controls

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-21T04:19:20.101Z. Cached copy · Source on csf.tools

# CSF Tools

> The Cybersecurity Framework for Humans

## Sitemap

- [XML Sitemap](https://csf.tools/wp-sitemap.xml): all public, indexable URLs for this site.

## Querying reference content

This site publishes thousands of individual control/framework reference items,
far too many to usefully list here. Query them via the MCP endpoint instead.

- MCP endpoint: https://csf.tools/wp-json/csftools/v1/mcp
- Transport: POST JSON-RPC 2.0 only. GET returns 405; no SSE or event stream.
- Protocol: 2025-06-18. After initialize, send header MCP-Protocol-Version: 2025-06-18.
- Auth: HTTP Basic with a WordPress username and application password
  (not the login password). A 401 means create an application password
  in the WordPress profile.
- Do not send batch JSON-RPC; one message per request.
- Discover tools with tools/list; do not scrape /reference/ URLs.
- Rate limited per user per minute (60 for standard accounts). A 429 response
  carries Retry-After; pace calls instead of retrying immediately.

Tools: search, get_reference, get_children, get_cross_references,
get_related_controls, get_taxonomy_terms, get_taxonomy_members,
list_publication_taxonomies, list_filter_taxonomies.

Workflow:

1. list_publication_taxonomies, then get_taxonomy_terms to list publications.
   The "Control Sets" and "Frameworks" sections below carry the same slugs.
2. search, scoped with taxonomies (e.g. {"controlset":["nist800-53r5"]}), so
   hits are not mixed across revisions.
3. get_reference with the uri from a hit. Prefer uri over post_id or csf_id.
4. get_children to walk one hierarchy level; get_cross_references to map across
   catalogs in either direction; get_related_controls for control-to-control.

Notes:

- Control IDs are versioned. AC-2 exists in several revisions, so an unscoped
  lookup returns error_code "ambiguous_reference" plus retry_options[].arguments;
  retry with one of those, or add controlset.
- search is full text. Resolve an exact ID with get_reference, not search.
- Errors carry error_code; a call that matched nothing may carry hint.
- Paginated tools: top max 100, skip max 5000. Mapping tools paginate
  references, not whole catalogs.

## Control Sets

- [Cloud Controls Matrix v3.0.1 (ccm-v3-0-1)](https://csf.tools/controlset/ccm-v3-0-1/): The Cloud Controls Matrix is a set of controls designed to be used by both cloud service consumers as well as providers. The CCM includes both technical and administrative controls that can be used to
- [Cloud Controls Matrix v4.0 (ccm-v4-0)](https://csf.tools/controlset/ccm-v4-0/): The Cloud Controls Matrix is a set of controls designed to be used by both cloud service consumers as well as providers. The CCM includes both technical and administrative controls that can be used to
- [Critical Security Controls Version 7.1 (csc-v7-1)](https://csf.tools/controlset/csc-v7-1/): The Critical Security Controls published by the Center for Internet Security are designed to be fundamental controls for all organizations
…

Related sites

Other listed sites in Cybersecurity. See the whole category →

Machine-readable: GET /v1/resolve?q=csf.tools · GET /v1/domain/csf.tools · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for csf.tools:
1. POST https://agentwebmap.com/v1/sites/csf.tools/claims and keep claim_id and claim_secret private.
2. Publish the proof: add the line "AgentWebMap ownership: <token>" (token from step 1) to https://csf.tools/llms.txt, or use the DNS, meta-tag or well-known method the response describes.
3. POST https://agentwebmap.com/v1/sites/csf.tools/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/csf.tools).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.