Replace Next.js API with static JSON on GitHub Pages

The SCF data is static and ~1.3MB total. Agents don't need
server-side filtering for that. Replaced the Next.js project
with a build script that pre-generates all JSON files into
docs/ for GitHub Pages hosting.

1,451 control files, 33 family files, 15 crosswalk files,
summary, llms.txt, and a landing page. No dependencies,
no runtime, no cost.

Author: ethanolivertroy

.gitignore

@@ -1,41 +1,2 @@
-# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
-
-# dependencies
-/node_modules
-/.pnp
-.pnp.*
-.yarn/*
-!.yarn/patches
-!.yarn/plugins
-!.yarn/releases
-!.yarn/versions
-
-# testing
-/coverage
-
-# next.js
-/.next/
-/out/
-
-# production
-/build
-
-# misc
+node_modules
 .DS_Store
-*.pem
-
-# debug
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-.pnpm-debug.log*
-
-# env files (can opt-in for committing if needed)
-.env*
-
-# vercel
-.vercel
-
-# typescript
-*.tsbuildinfo
-next-env.d.ts

AGENTS.md

@@ -1,36 +1,62 @@
-This is a [Next.js](https://nextjs.org) project bootstrapped with [`create-next-app`](https://nextjs.org/docs/app/api-reference/cli/create-next-app).
+# SCF API
 
-## Getting Started
+The [Secure Controls Framework](https://securecontrolsframework.com) is the best cross-framework control mapping out there. It's also trapped in spreadsheets. I use SCF as the backend for most of my control tooling, and I got tired of parsing `.xlsx` files every time I needed a lookup.
 
-First, run the development server:
+So I built this: the entire SCF v2025.4 served as static JSON files on GitHub Pages. 1,451 controls across 33 families, with bidirectional crosswalk mappings to 15 frameworks (NIST 800-53, CMMC, FedRAMP, ISO 27001, HIPAA, GDPR, PCI DSS, CCPA, NIS2, and the rest).
+
+No server. No API keys. No rate limits. Just fetch the JSON files directly.
+
+## For AI Agents
+
+Hit `llms.txt` at the root of the site. It's a machine-readable index of every file path and what it contains. Your agent reads it once and knows how to navigate the entire dataset. That's the [llms.txt standard](https://llmstxt.org): agents self-discover what's available instead of you hand-wiring each call.
+
+## Files
+
+| Path | What it contains |
+|------|-----------------|
+| `api/summary.json` | Control counts, family breakdown, framework coverage, weight distribution |
+| `api/controls.json` | All 1,451 controls with crosswalk mappings to all 15 frameworks |
+| `api/controls/{ID}.json` | Single control (e.g., `GOV-01`, `CRY-05.3`) |
+| `api/families.json` | All 33 control families with counts |
+| `api/families/{CODE}.json` | Family detail with all its controls (e.g., `GOV`, `NET`) |
+| `api/crosswalks.json` | All 15 mapped frameworks with coverage stats |
+| `api/crosswalks/{FRAMEWORK}.json` | Full bidirectional crosswalk (e.g., `nist-800-53-r5`, `hipaa`) |
+| `llms.txt` | Machine-readable file index for agents |
+
+## Examples
 
 ```bash
-npm run dev
-# or
-yarn dev
-# or
-pnpm dev
-# or
-bun dev
+# Fetch the full controls dataset
+curl https://ethanolivertroy.github.io/scf-api/api/controls.json
+
+# Get a single control with all its crosswalk mappings
+curl https://ethanolivertroy.github.io/scf-api/api/controls/GOV-01.json
+
+# Get the NIST 800-53 crosswalk (both directions)
+curl https://ethanolivertroy.github.io/scf-api/api/crosswalks/nist-800-53-r5.json
+
+# Get all controls in the Network Security family
+curl https://ethanolivertroy.github.io/scf-api/api/families/NET.json
 ```
 
-Open [http://localhost:3000](http://localhost:3000) with your browser to see the result.
+## How it works
 
-You can start editing the page by modifying `app/page.tsx`. The page auto-updates as you edit the file.
+No server, no database. A build script reads the source SCF JSON files, enriches each control with crosswalk mappings from all 15 frameworks, and generates static JSON files into `docs/`. GitHub Pages serves them directly.
 
-This project uses [`next/font`](https://nextjs.org/docs/app/building-your-application/optimizing/fonts) to automatically optimize and load [Geist](https://vercel.com/font), a new font family for Vercel.
+Total output is ~8.7MB across 1,500+ files. An agent grabs `api/controls.json` (the full dataset), loads it into context, and works with it locally. Sub-second fetches, zero infrastructure.
 
-## Learn More
+## Rebuilding
 
-To learn more about Next.js, take a look at the following resources:
+```bash
+node scripts/build.mjs
+```
 
-- [Next.js Documentation](https://nextjs.org/docs) - learn about Next.js features and API.
-- [Learn Next.js](https://nextjs.org/learn) - an interactive Next.js tutorial.
+Regenerates everything in `docs/`. Commit and push to update the live site.
 
-You can check out [the Next.js GitHub repository](https://github.com/vercel/next.js) - your feedback and contributions are welcome!
+## Note on CORS
 
-## Deploy on Vercel
+GitHub Pages doesn't set CORS headers. CLI tools, MCP servers, and server-side code can fetch these files without issues. Browser-based JavaScript running on a different domain will get blocked. If you need browser access, deploy behind a proxy or use a CORS-friendly host.
 
-The easiest way to deploy your Next.js app is to use the [Vercel Platform](https://vercel.com/new?utm_medium=default-template&filter=next.js&utm_source=create-next-app&utm_campaign=create-next-app-readme) from the creators of Next.js.
+## Data license
 
-Check out our [Next.js deployment documentation](https://nextjs.org/docs/app/building-your-application/deploying) for more details.
+SCF data is from [securecontrolsframework.com](https://securecontrolsframework.com), licensed under CC BY-ND.