fips-mcp

# ScoutWyze FIPS MCP server

Is this product version FIPS 140-3 validated, in NIST's queue, or expiring? An MCP server for the
[ScoutWyze FIPS](https://scoutwyze-fips.fly.dev) status API. Answers come from NIST CMVP lists (active
certificates, Modules In Process, Implementation Under Test), with links to the NIST pages used.

Covers Windows 11 / Server, macOS / iOS, FortiOS, PAN-OS, Panorama, Cisco FTD, RHEL, Ubuntu, Samsung
Android, Aruba, SonicWall, F5, Juniper, VMware ESXi and Okta. Unmapped products are logged as requests.

## Install

```json
{
  "mcpServers": {
    "scoutwyze-fips": {
      "command": "npx",
      "args": ["-y", "@scoutwyze/fips-mcp"]
    }
  }
}
```

Optional env: `SCOUTWYZE_API_KEY` (prepaid key), `SCOUTWYZE_FIPS_BASE_URL` (local development only).

## Tools

| Tool | What it does | Cost |
|---|---|---|
| `fips_list_products` | Covered products and versions | Free |
| `fips_lookup` | Status of one product version, with certificates, sunset dates, post-quantum algorithms and receipts | A few free per day, then credits or x402 |
| `fips_expiring` | Covered versions whose certificates sunset within N days | Free |
| `fips_batch` | Up to 500 versions in one call | Prepaid credits |

Statuses: `ACTIVE`, `EXPIRING` (sunset within 180 days), `HISTORICAL`, `IN_QUEUE`, `NOT_VALIDATED`,
`UNVERIFIED`. If NIST data is stale, the answer is `UNVERIFIED`, never `ACTIVE`.

## Payments

This server never holds a private key or pays anything. A 402 response is returned as tool content;
a wallet-capable calling agent can pay the x402 challenge (USDC on Base) and retry with `X-PAYMENT`.

Not legal or compliance advice. Confirm with your assessor.