Metadata-Version: 2.4
Name: cmmc2-toolkit
Version: 0.2.0
Summary: CMMC 2.0 Level 2 compliance scanner and admin dashboard for web application teams
Author-email: David Moorhead <david.moorhead37@gmail.com>
License-Expression: MIT
Keywords: cmmc,compliance,nist,800-171,security
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Topic :: Security
Classifier: Programming Language :: Python :: 3
Requires-Python: >=3.10
Description-Content-Type: text/markdown
Requires-Dist: flask>=3.0
Requires-Dist: click>=8.0
Requires-Dist: openpyxl>=3.1
Requires-Dist: bcrypt>=4.0
Requires-Dist: flask-login>=0.6
Requires-Dist: flask-wtf>=1.2
Requires-Dist: pyotp>=2.9
Requires-Dist: qrcode[pil]>=7.4
Requires-Dist: flask-limiter>=3.5
Requires-Dist: waitress>=3.0
Provides-Extra: mongo
Requires-Dist: pymongo>=4.0; extra == "mongo"
Provides-Extra: dev
Requires-Dist: pytest>=8.0; extra == "dev"
Requires-Dist: pytest-cov; extra == "dev"

# cmmc2-toolkit

A self-contained Python package that gives any web application team a **CMMC 2.0 Level 2** compliance scanner and admin dashboard — installable via pip, zero infrastructure required.

## Features

- **62 controls** — all CMMC Level 1 (17), Level 2 practices, and optional Level 3 (24) controls
- **Auto-scan** for 5 platforms: Flask, Django, FastAPI, Express/Node.js, Spring Boot
- **Dashboard** — per-project compliance tracker with status, progress, target dates, and audit log
- **POA&M** — Plan of Action & Milestones view for Gap / Partial / Manual controls
- **Excel export** — one-click 3-tab workbook (Dashboard, POA&M, Audit Log)
- **Audit log** — every status change timestamped and attributed to a user
- **REST API** — agent ingest endpoint for CI/CD pipeline integration

## Quickstart

```bash
pip install cmmc2-toolkit

cmmc2 serve                        # launch dashboard at http://localhost:5050
cmmc2 scan --path /path/to/project # run programmatic checks (CLI mode)
cmmc2 export --out poam.xlsx       # export POA&M to Excel
```

On first launch the dashboard creates an admin account automatically (`admin` / `BWIadmin!2026` — change it immediately).

## Supported platforms

| Platform | Auto-detected by | Auto-checks |
|---|---|---|
| Flask | `flask` in requirements / `app.py` | 25 controls |
| Django | `django` in requirements / `manage.py` | 25 controls |
| FastAPI | `fastapi` in requirements / `main.py` | 25 controls |
| Express / Next.js | `express` or `next` in `package.json` | 25 controls |
| Spring Boot / WildFly | `spring-boot` in `pom.xml` / `WEB-INF` | 25 controls |

Unsupported platforms fall back to full manual tracking mode.

## Dashboard

```
cmmc2 serve --port 5050
```

- Create projects by URL or local path
- Run a live scan against a local codebase
- Track status (Pass / Gap / Partial / Manual) per control
- Every status change requires a note — written to the immutable audit log
- Level 3 controls (NIST SP 800-172) are opt-in per project
- Export the full workbook (Dashboard + POA&M + Audit Log tabs) with one click

On Windows, use the included `serve.ps1` launcher if `cmmc2` is not yet on your PATH.

## Architecture

```
cmmc2toolkit/
├── controls.py          # 62 CMMC control definitions (L1 + L2 + L3)
├── models.py            # Control, Finding dataclasses
├── cli.py               # click CLI (scan | serve | export | init)
├── detector/            # auto-detect platform from project files
├── adapters/            # platform-specific check runners
├── checks/              # atomic grep-based check functions
├── store/               # SQLiteStore + StoreBase ABC
├── auth/                # password hashing, TOTP, session management
├── dashboard/           # Flask micro-app (routes + Jinja2 templates)
└── export.py            # openpyxl 3-tab Excel export
```

## Contributing an adapter

1. Subclass `AdapterBase` in `cmmc2toolkit/adapters/adapter_<platform>.py`
2. Implement `check_all() -> list[Finding]`
3. Register it in `adapters/base.py` → `get_adapter()` registry
4. Add fingerprint rules in `detector/fingerprints.py`
5. Open a PR

## License

MIT
