# fim-mcp

Local stdio MCP server for the Tripwire Enterprise REST API.

The first version wraps the core FIM workflows:

- list and fetch nodes
- get policy test results
- list and fetch element versions
- explore allowlist software, open port, user, and service results
- promote element versions
- check promote request status
- make a raw Tripwire API request for uncovered endpoints

## Setup

```powershell
python -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install -e .
Copy-Item .env.example .env
```

Edit `.env`:

```dotenv
TE_HOST=https://TECONSOLEHOST/api
TE_USERNAME=administrator
TE_API_TOKEN=replace-with-token
TE_VERIFY_SSL=false
TE_TIMEOUT=30
```

`TE_HOST` may point at either the API root (`https://server/api`) or the versioned API root (`https://server/api/v1`).

## Run

```powershell
python -m fim_mcp
```

For MCP clients that need a command:

```json
{
  "mcpServers": {
    "fim-mcp": {
      "command": "python",
      "args": ["-m", "fim_mcp"],
      "env": {
        "TE_HOST": "https://TECONSOLEHOST/api",
        "TE_USERNAME": "administrator",
        "TE_API_TOKEN": "replace-with-token",
        "TE_VERIFY_SSL": "false"
      }
    }
  }
}
```

If your Python user scripts directory is on PATH, the installed `fim-mcp` command works too.

## Use with Codex

Codex reads MCP server definitions from `config.toml` in your Codex home directory. On Windows this is usually:

```text
C:\Users\<you>\.codex\config.toml
```

After running the setup steps above, add this to that file. Use the full path to the virtual environment Python for the repo:

```toml
[mcp_servers.fim-mcp]
command = 'C:\path\to\fim-mcp\.venv\Scripts\python.exe'
args = ['-m', 'fim_mcp']
startup_timeout_sec = 30

[mcp_servers.fim-mcp.env]
TE_HOST = 'https://TECONSOLEHOST/api'
TE_USERNAME = 'administrator'
TE_API_TOKEN = 'replace-with-token'
TE_VERIFY_SSL = 'false'
TE_TIMEOUT = '30'
```

For this checkout, the command path would look like:

```toml
command = 'C:\Users\chris\Downloads\vibes\te mcp\.venv\Scripts\python.exe'
```

If you install the package somewhere already on PATH, you can use the console script instead:

```toml
[mcp_servers.fim-mcp]
command = 'fim-mcp'
args = []
startup_timeout_sec = 30

[mcp_servers.fim-mcp.env]
TE_HOST = 'https://TECONSOLEHOST/api'
TE_USERNAME = 'administrator'
TE_API_TOKEN = 'replace-with-token'
TE_VERIFY_SSL = 'false'
TE_TIMEOUT = '30'
```

Restart Codex, or start a new Codex session, after editing `config.toml`. To verify the server is available, ask Codex to list Tripwire Enterprise nodes or call `te_get_status`. If the server starts correctly, Codex will have access to the `te_*` tools listed below.

## Tools

- `te_get_status`
- `te_list_nodes`
- `te_get_node`
- `te_get_policy_test_results`
- `te_get_policy_test_result`
- `te_list_versions`
- `te_get_version`
- `te_list_allowlist_software_results`
- `te_list_allowlist_open_port_results`
- `te_list_allowlist_user_results`
- `te_list_allowlist_service_results`
- `te_promote_versions`
- `te_get_promote_request`
- `te_api_request`

Most list tools accept a `filters` object. The keys map directly to Tripwire Enterprise query parameters, so filters such as `name`, `sub_name`, `nodeId`, `state`, `pageLimit`, and `pageStart` can be passed without code changes.

Set `raw: true` on wrapped tools to return the Tripwire JSON unchanged. The default response returns a smaller MCP-friendly summary plus a `count`.