cmmc2-toolkit 0.2.0

CMMC 2.0 Level 2 compliance scanner and admin dashboard for web application teams

cmmc2-toolkit

A self-contained Python package that gives any web application team a CMMC 2.0 Level 2 compliance scanner and admin dashboard — installable via pip, zero infrastructure required.

Features

• 62 controls — all CMMC Level 1 (17), Level 2 practices, and optional Level 3 (24) controls
• Auto-scan for 5 platforms: Flask, Django, FastAPI, Express/Node.js, Spring Boot
• Dashboard — per-project compliance tracker with status, progress, target dates, and audit log
• POA&M — Plan of Action & Milestones view for Gap / Partial / Manual controls
• Excel export — one-click 3-tab workbook (Dashboard, POA&M, Audit Log)
• Audit log — every status change timestamped and attributed to a user
• REST API — agent ingest endpoint for CI/CD pipeline integration

Quickstart

pip install cmmc2-toolkit

cmmc2 serve                        # launch dashboard at http://localhost:5050
cmmc2 scan --path /path/to/project # run programmatic checks (CLI mode)
cmmc2 export --out poam.xlsx       # export POA&M to Excel

On first launch the dashboard creates an admin account automatically (admin / BWIadmin!2026 — change it immediately).

Supported platforms

Platform	Auto-detected by	Auto-checks
Flask	flask in requirements / app.py	25 controls
Django	django in requirements / manage.py	25 controls
FastAPI	fastapi in requirements / main.py	25 controls
Express / Next.js	express or next in package.json	25 controls
Spring Boot / WildFly	spring-boot in pom.xml / WEB-INF	25 controls

Unsupported platforms fall back to full manual tracking mode.

Dashboard

cmmc2 serve --port 5050

• Create projects by URL or local path
• Run a live scan against a local codebase
• Track status (Pass / Gap / Partial / Manual) per control
• Every status change requires a note — written to the immutable audit log
• Level 3 controls (NIST SP 800-172) are opt-in per project
• Export the full workbook (Dashboard + POA&M + Audit Log tabs) with one click

On Windows, use the included serve.ps1 launcher if cmmc2 is not yet on your PATH.

Architecture

cmmc2toolkit/
├── controls.py          # 62 CMMC control definitions (L1 + L2 + L3)
├── models.py            # Control, Finding dataclasses
├── cli.py               # click CLI (scan | serve | export | init)
├── detector/            # auto-detect platform from project files
├── adapters/            # platform-specific check runners
├── checks/              # atomic grep-based check functions
├── store/               # SQLiteStore + StoreBase ABC
├── auth/                # password hashing, TOTP, session management
├── dashboard/           # Flask micro-app (routes + Jinja2 templates)
└── export.py            # openpyxl 3-tab Excel export

Contributing an adapter

1. Subclass AdapterBase in cmmc2toolkit/adapters/adapter_<platform>.py
2. Implement check_all() -> list[Finding]
3. Register it in adapters/base.py → get_adapter() registry
4. Add fingerprint rules in detector/fingerprints.py
5. Open a PR

License

MIT