myctrl.tools

What It Does

#

A searchable reference for security controls across 105+ compliance frameworks. Instead of digging through PDF after PDF to find the right control language, you look it up on myctrl.tools and get the control text, implementation guidance, and mappings to other frameworks instantly.

By the Numbers

#

Average control research time: under 10 seconds vs. 15+ minutes of manual PDF searching.

Framework Coverage

#

U.S. Federal - NIST SP 800-53, FedRAMP, FISMA, CMMC, CJIS, IRS 1075, DISA STIGs, DoD SRGs, StateRAMP, and more across 36 federal frameworks.

AI & Machine Learning - NIST AI RMF, EU AI Act, ISO 42001, OWASP LLM Top 10, and emerging AI governance frameworks. 8 frameworks covering the intersection of security and AI.

Privacy - GDPR, CCPA/CPRA, HIPAA, FERPA, COPPA, and 12 more privacy-focused frameworks.

International - ISO 27001/27002, SOC 2, PCI-DSS, IRAP, ISMAP, ENS, BSI IT-Grundschutz, and standards from across the globe.

Industry-Specific - Healthcare (HIPAA, HITRUST), financial (PCI-DSS, GLBA, SOX), critical infrastructure (NERC CIP), and more.

Interactive Tools

#

Knowledge Graph - Explore 120+ frameworks as an interconnected constellation. Click a framework node to see its crosswalk relationships with other standards. Useful for understanding how frameworks relate to each other.

Framework Comparison - Side-by-side control analysis between any two frameworks. Find equivalent controls instantly instead of manually mapping them in a spreadsheet.

Crosswalk Explorer - Navigate mappings between frameworks interactively. See how CSF maps to NIST 800-53 maps to PCI-DSS with direct visualization.

Generative UI

#

The AI assistant doesn’t generate compliance content. The controls, frameworks, and crosswalk mappings are already indexed. What the LLM generates is a compact ViewSchema JSON: a set of composition decisions about which components to render, which data to reference, and how to lay them out.

json-render sits in the middle. The LLM outputs a ViewSchema, json-render resolves references against the pre-built data index, and the renderer turns it into interactive UI. The LLM is the orchestrator, not the content source.

Why this matters in practice: token cost scales with layout complexity, not data volume. A typical view schema runs about 50 tokens. Generating that same content from scratch (control text, implementation guidance, crosswalk mappings) would run closer to 2,000. The data is already there, so the LLM just points at it.

Zod v4 validates every AI-generated schema before it reaches the renderer. Malformed responses get caught, not rendered. No hallucinated control IDs, no invented mappings.

33 component types cover controls, assessments, progress tracking, remediation queues, evidence collection, and FedRAMP 20x KSI views. Views persist locally via Dexie, so you revisit them without re-prompting. Five AI providers are supported: Claude, GPT-4, Grok, Ollama (runs locally), and Transformers.js (runs in the browser).

Implementation Guidance

#

Controls aren’t useful if you don’t know how to implement them. Each control includes technology-specific guidance for 30+ platforms:

• Cloud - AWS, Azure, GCP, Oracle Cloud
• Identity - Okta, Azure AD, Google Workspace
• Infrastructure - Kubernetes, Docker, Linux, Windows Server
• Security Tools - CrowdStrike, Sumo Logic, Splunk
• And more - with 500+ CLI verification commands you can actually run

Why

#

I wanted a compliance security control resource with a fast search function. That was the whole prompt. csf.tools existed but it was slow, the navigation was clunky, and it didn’t have crosswalks between frameworks in a way that was actually useful for someone doing assessment work.

So I scraped it and built something faster. Then I kept going. Added more frameworks. Then more. Then the OWASP lists, AI governance frameworks, DISA STIGs, international standards. Then implementation guidance with real CLI commands you can run. Then a knowledge graph so you can see how all 105+ frameworks connect. Then an AI assistant that runs locally via Ollama so your compliance queries never leave your machine.

The name says it: my control tools are now your control tools. Everything I was building for my own assessment work, packaged into a site anyone can use. The data primitives underneath it (the NIST CMVP API, the SCF API) feed directly into this.

The real shift came when I found json-render. The compliance data was already indexed. The LLM shouldn’t be generating control text or crosswalk mappings, it should be composing views: deciding which components to render, which data to reference, how to lay it out. That insight split the architecture into a content layer (static, pre-built) and a composition layer (AI-generated ViewSchemas). Token cost dropped from ~2,000 per response to ~50, because the LLM is the orchestrator, not the content source.

Journey

#

1. Assessment-Native Generative UI

   Apr 2026

   Added assessment-focused view components: remediation queues, evidence queues, gap assessments. Added Grok as an AI provider alongside Claude, GPT-4, Ollama, and Transformers.js. The generative UI layer now covers the full assessment lifecycle, not just control lookup.
2. AI Infrastructure: Three-Phase Build

   Mar 18, 2026

   Three-day sprint to wire up the full AI view pipeline. Phase 1: Zod v4 schemas and component catalog (33 types). Phase 2: Ollama and Transformers.js integration for local/browser AI. Phase 3: json-render integration with StructuredViewRenderer as the entry point. ViewSchema goes in, validated UI comes out.
3. json-render + REST API

   Mar 17, 2026

   Shipped the authenticated REST API and introduced @json-render/core and @json-render/react as the rendering layer for AI-composed views. This was the architectural decision that separated content generation from layout generation.
4. GRC Agent + Local AI

   Mar 2026

   Integrated local LLM support via Ollama and browser-based AI runtimes. Renamed the AI feature from “copilot” because there are already a million copilot services. Added llms.txt for AI crawler discoverability. Rebuilt the about page, fixed a production 500 error on the whiteboard page, and rebranded “Guidance” to “Tools” to match what the site actually is.
5. AI View Builder with BYOK

   Late Jan 2026

   First version of the AI view builder. Bring your own API key (Claude, GPT-4) to generate structured control views. No server-side AI costs, no data leaving the browser beyond the API call.
6. Quality Review: 144 Linear Issues

   Late Jan 2026

   Created 144 Linear issues for a comprehensive quality review of every framework page, technology guidance page, and crosswalk. This was the shift from “ship it fast” to “make sure every link works and every control is mapped correctly.”
7. Full-Page Search + Implementation Guidance

   Jan 31 - Feb 7, 2026

   The biggest sprint: 427 prompts to a coding agent over 8 days. Built dual search modes (Command-K for full search, backslash for quick search), added technology-specific implementation guidance with 500+ verification commands, and ran a full color scheme readability audit across all themes.
8. Framework Expansion

   Jan 12-16, 2026

   Second sprint. Added the interactive knowledge graph, framework comparison tool, and crosswalk explorer. Set up bidirectional linking between frameworks so NIST SP 800-53 controls cross-reference their FedRAMP and DoD SRG equivalents. Added framework starring so users can bookmark their working set.
9. The First Sprint

   Jan 2-9, 2026

   346 prompts in the first week. Built the core site from a scrape of NIST data. Hit every early-project bug: AWS icons were wrong, the OWASP navigation links all pointed to the wrong pages, “Categoryies” was misspelled, FedRAMP parameters landed in the wrong controls, and the framework switcher flickered on every click. Switched from OSCAL JSON to plain JSON early on because the OSCAL format caused more problems than it solved.
10. The Idea

    Jan 2, 2026

    “I want to create a compliance security control resource that has super fast search function. Basically I want to scrape csf.tools and migrate it to a faster, more modern website.” Talked to Gemini first, then started building with Claude.

What I Got Wrong

#

Started with OSCAL JSON. Day one, I pulled NIST 800-53 data in OSCAL format because that’s the “right” format for machine-readable compliance. It wasn’t. OSCAL is built for interchange between systems, not for rendering in a web UI. The parameter syntax, nested structures, and metadata overhead meant I was spending more time stripping OSCAL artifacts than building features. Switched to plain JSON on day two.

FedRAMP parameters in the wrong controls. When auto-mapping FedRAMP-defined parameter values into NIST 800-53 controls, the placement logic broke and parameters ended up attached to the wrong controls. In a compliance tool, that kind of error is not cosmetic. It affects what a user concludes about their compliance posture.

Search ranking was bad for months. “When I’m searching for fedramp:ac2, why doesn’t AC-2 come up first?” I kept improving search across multiple sprints and it kept not being good enough. Search in a domain with 20,000+ controls, alphanumeric IDs, and framework-specific naming conventions is a harder problem than I expected.

Shipped themes without testing contrast. Multiple color schemes, light and dark modes, and I didn’t test every combination. Some controls were unreadable on light mode themes like Zink Light. Had to go back and do a comprehensive readability audit after users ran into it.

Called the AI feature “copilot.” There are a million copilot services. Had to rebrand to “GRC Agent” after launch because the name communicated nothing about what it actually did.

What’s Next

#

Self-hosting. The goal is a Docker deployment so compliance teams can run myctrl.tools inside their own authorization boundary. Same codebase targets both Vercel (public demo) and Docker (private) via feature flags. HedgeDoc gets bundled for collaborative SSP drafting and assessment documentation, with a PostgreSQL sync layer for multi-user access.

selfgap.app. Companion product where myctrl.tools is the “browse and learn” layer and selfgap.app is the “assess and act” layer. Gap assessment engine, SSP section generation with BYOK AI, SPRS scoring for NIST 800-171, and prioritized remediation roadmaps. Positioned against platforms charging $60K/year as free, open-source, and self-hostable.

Agent API. Authenticated REST API with rate limiting so AI agents and developer scripts can query controls, crosswalks, and guidance programmatically without scraping the site. Six core endpoints, OpenAPI spec generation, and an MCP server wrapper planned for later.

Stack

#

• Framework: Astro
• Hosting: Vercel
• Offline: Service workers for offline access
• AI Rendering: json-render (@json-render/core, @json-render/react)
• Validation: Zod v4 for schema validation of AI-generated views
• AI Providers: Claude, GPT-4, Grok, Ollama (local), Transformers.js (browser)
• Client Storage: Dexie for saved views, projects, and local persistence
• Data: Sourced from NIST, PCI SSC, DISA, CIS, ISO, and other standards bodies
• License: Content under CC BY 4.0

Related

#

• Okta Inspector - Automated compliance auditing that maps to many of the same frameworks
• Open Source Security Compliance AI & ML - Datasets and models trained on NIST publications
• FedRAMP Docs MCP Server - MCP server for querying FedRAMP documentation programmatically