Skip to main content
Glama

FIPS 140 certificate tracker

fips_sunset

List active FIPS validations by sunset date, the day each moves to NIST's historical list and stops being valid for new procurement. Answers 'what expires before date X' and 'which vendors are about to have nothing valid'. A certificate listed here may already have a 140-3 successor: check fips_search for the same module name before reporting a gap.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNo
beforeNoISO date, exclusive: before=2026-09-21 excludes the 21st itself
vendorNo
standardNo

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observed

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden. It discloses that the tool lists active validations, that sunset means moving to NIST's historical list and losing procurement validity, and that a listed certificate may already have a successor. It stops short of describing return fields or pagination, so it is not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences with no filler: core action first, then representative questions, then a caveat routed to the right sibling. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only listing tool with four optional parameters and no output schema, the description is largely complete: it states scope, domain meaning, likely use cases, and the critical caveat about 140-3 successors. It could describe expected output fields or clarify standard/limit usage, but those gaps are minor and partially covered by the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 25%, so the description needs to add meaning. It adds use-case meaning for before ('expires before date X') and vendor ('which vendors are about to have nothing valid'), but standard is left to the enum and limit to schema constraints. Compensation is useful but partial.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with a specific verb-resource-scope: 'List active FIPS validations by sunset date' and defines what a sunset means (moves to NIST's historical list, stops being valid for new procurement). This distinguishes it from siblings like fips_search or fips_in_process.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit query patterns ('what expires before date X', 'which vendors are about to have nothing valid') and names the alternative tool to check before reporting a gap: fips_search for the same module name. This gives clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.2/5.0
Disambiguation4/5

Each tool targets a distinct aspect: certificate number lookup, search by name/vendor, vendor portfolio, sunset dates, in-process submissions, and CVE associations. The only mild overlap is between fips_search and fips_vendor when querying by vendor, but the descriptions clarify that one checks current validation while the other returns the full grouped portfolio.

Naming Consistency5/5

All tool names follow a consistent fips_<topic> pattern in lowercase snake_case. Even though most are noun-like rather than verb_noun, the prefix and naming style are uniform and predictable across the set.

Tool Count5/5

Six tools is well-scoped for a FIPS 140 certificate tracker: each covers a distinct query type without redundancy. The count feels intentional and neither too thin nor bloated.

Completeness5/5

The tool set covers the main certificate lifecycle: in-process submissions, active certificates, sunset status, historical/revoked details via certificate lookup, vendor-level viewing, and CVE association. It also includes cross-referencing hints such as checking for 140-3 successors before reporting a gap, so the surface appears complete for the domain.