KeelenScans — Controls
Evidence for your security controls, straight from the repo.
Keelen's Controls scan is a security-control gap review that reads your repository — plus the stack facts you declare, like cloud and identity provider — for evidence against three frameworks: Cyber Essentials (NCSC requirements v3.3), CMMC Level 1 (the fifteen FAR 52.204-21 safeguards), and CMMC Level 2 (NIST SP 800-171 Rev. 2). For every control it reports what evidence exists, how strong it is, and — just as deliberately — what a repository scan cannot see.
It does not decide certification eligibility or a maturity level. It shortens the distance between “we should look at Cyber Essentials” and a concrete per-control evidence inventory your team can act on, with code-fixable gaps routed straight into the autonomous loop.
- Three frameworks in one pass: Cyber Essentials v3.3, CMMC Level 1 (fifteen safeguards), CMMC Level 2 (NIST SP 800-171 Rev. 2 — all 110 requirements tracked).
- Every control carries its source reference, an evidence class — from repo-observable to organisational — and a confidence level.
- Honest boundaries: each entry states what remains outside a repository's visibility, so you know exactly what still needs a human.
- Code-fixable gaps go to the loop as Requests and come back as tested pull requests.
- Re-run each remediation cycle: evidence updates, dismissals stick, and reports stay comparable run to run.
Three frameworks, one evidence pass
Cyber Essentials entries track the NCSC v3.3 requirements. CMMC Level 1 entries track the fifteen safeguards of FAR 52.204-21. CMMC Level 2 entries retain all 110 NIST SP 800-171 Rev. 2 references — the repo-observable subset maps to evidence channels the product collects, and the rest carry no automated check and say so plainly. Every entry names its source document and version, because a version printed beside your evidence has to be the publisher's own.
Evidence, not verdicts
Each control is classed by where its evidence can come from: repo-observable, infrastructure-observable if you have declared the stack, a policy document, or organisational context no scanner can reach. The report never converts that into a pass mark or a readiness percentage — it is an inventory of evidence and gaps, with a confidence level per observation.
From gap to merged fix
Many control gaps are code or configuration: missing branch protection, no dependency-update policy, secrets handled loosely, logging that forgets. Send those to the loop and they come back as pull requests — planned, implemented in an isolated VM, and verified through Keelen's test and review gates. The organisational gaps stay clearly labelled as yours.
Run it on your cadence
There is a Run button on the project tab, and there is an MCP tool — run_control_gap_review — so any agent or scheduler you already use can trigger a scan monthly during a remediation push, or before each assessment cycle. Re-running is the intended workflow, not a spam generator: findings carry stable fingerprints, so a re-run reconciles against the last one — fixed findings resolve, new ones surface, dismissed ones stay dismissed.
Trigger it from any agent
claude mcp add --transport http keelen https://keelen.ai/mcp
Then the run_control_gap_review MCP tool starts a run — from Claude Code, Cursor, a cron job, or anything else that speaks MCP.
What it is not
This automated engineering review records observations from the sources it names. It cannot determine an organisation's standing under a security framework. A missing observation does not establish anything about a control.
Included on every paid plan
From $29 / month on Indie
FAQ
Can I get Cyber Essentials certified with this?
No tool certifies you — certification comes from a licensed certification body. What the Controls scan does is produce the per-control evidence inventory against the NCSC v3.3 requirements, show where the gaps are, and route the code-fixable ones into Keelen's autonomous loop so they come back as merged fixes before you apply.
What is the difference between CMMC Level 1 and Level 2 here?
Level 1 covers the fifteen FAR 52.204-21 safeguards, and every one is reviewed. Level 2 tracks all 110 NIST SP 800-171 Rev. 2 requirements: the repo-observable subset maps to evidence the product collects, and the rest explicitly carry no automated check — the report says which is which. CMMC Level 2 review is an Enterprise-plan feature.
Does it connect to my cloud account?
No. You declare stack facts — cloud provider, identity provider, data location — in a short profile, and the scan reads your repository. Evidence that would require live infrastructure access is explicitly classed as such, so the report never overstates what was actually observed.
Is this a SOC 2 tool?
Not today. The frameworks covered are Cyber Essentials v3.3, CMMC Level 1, and CMMC Level 2 (NIST SP 800-171 Rev. 2). If you need a per-control evidence inventory for one of those three, this is built for it.
Which plans include the Controls scan?
Included on every paid plan, from Indie at $29/month. CMMC Level 2 controls are an Enterprise feature.