scoutwyze-fips-mcp
Allows checking FIPS 140-3 validation status for Samsung Android versions, including certificates, sunset dates, and post-quantum algorithms.
Allows checking FIPS 140-3 validation status for Cisco FTD versions, including certificates and sunset dates.
Allows checking FIPS 140-3 validation status for iOS versions, including certificates and sunset dates.
Allows checking FIPS 140-3 validation status for macOS versions, including certificates and sunset dates.
Allows checking FIPS 140-3 validation status for Okta, including certificates and sunset dates.
Allows checking FIPS 140-3 validation status for Samsung Android versions, including certificates and sunset dates.
Allows checking FIPS 140-3 validation status for SonicWall products, including certificates and sunset dates.
Allows checking FIPS 140-3 validation status for Ubuntu versions, including certificates and sunset dates.
Allows checking FIPS 140-3 validation status for VMware ESXi versions, including certificates and sunset dates.
ScoutWyze FIPS MCP server
Is this product version FIPS 140-3 validated, in NIST's queue, or expiring? An MCP server for the ScoutWyze FIPS status API. Answers come from NIST CMVP lists (active certificates, Modules In Process, Implementation Under Test), with links to the NIST pages used.
Covers Windows 11 / Server, macOS / iOS, FortiOS, PAN-OS, Panorama, Cisco FTD, RHEL, Ubuntu, Samsung Android, Aruba, SonicWall, F5, Juniper, VMware ESXi and Okta. Unmapped products are logged as requests.
Install
{
"mcpServers": {
"scoutwyze-fips": {
"command": "npx",
"args": ["-y", "@scoutwyze/fips-mcp"]
}
}
}Optional env: SCOUTWYZE_API_KEY (prepaid key), SCOUTWYZE_FIPS_BASE_URL (local development only).
Related MCP server: Cybersecurity MCP Server
Tools
Tool | What it does | Cost |
| Covered products and versions | Free |
| Status of one product version, with certificates, sunset dates, post-quantum algorithms and receipts | A few free per day, then credits or x402 |
| Covered versions whose certificates sunset within N days | Free |
| Up to 500 versions in one call | Prepaid credits |
Statuses: ACTIVE, EXPIRING (sunset within 180 days), HISTORICAL, IN_QUEUE, NOT_VALIDATED,
UNVERIFIED. If NIST data is stale, the answer is UNVERIFIED, never ACTIVE.
Payments
This server never holds a private key or pays anything. A 402 response is returned as tool content;
a wallet-capable calling agent can pay the x402 challenge (USDC on Base) and retry with X-PAYMENT.
Not legal or compliance advice. Confirm with your assessor.
Available Tools
4 toolsfips_batchScoutWyze FIPS: check an inventoryA
Checks up to 500 product versions in one call and returns per-item status plus counts. Requires a prepaid SCOUTWYZE_API_KEY (billed per item; no free tier, no x402). Without a key or credits it returns HTTP 402 with signup and credit-pack details.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | e.g. [{"product":"Windows 11","version":"24H2"}] |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses the billing model (per item, no free tier, no x402), the auth prerequisite, and the exact failure mode (HTTP 402 with signup and credit-pack details). It omits what happens on partial failures within a batch and whether the call is read-only/idempotent, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero waste, with the capability and the batch limit front-loaded and the cost/auth/error caveats following. Every clause carries information an agent needs before calling.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers what the tool does, the batch ceiling, the paid-access requirement, and the 402 failure path, and summarizes the return shape despite there being no output schema. It would be stronger if it characterized the per-item status values or partial-failure semantics for a 500-item batch.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and there is a single parameter with an inline example, so the schema already does the work. The description only restates the 500-item cap already encoded as maxItems; it adds no meaning about the product/version string formats or limits beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (checks product versions) with the batch scope (up to 500 in one call) and the return shape (per-item status plus counts). It does not explicitly name fips_lookup as the single-item alternative, so the differentiation from siblings is only implicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys that this is the bulk path and that it requires a prepaid key with per-item billing, which implicitly routes single lookups elsewhere. But it never states when to prefer fips_lookup, fips_list_products, or fips_expiring over this tool, and no explicit exclusions are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fips_expiringScoutWyze FIPS: certificates sunsetting soonA
Free. Lists covered product versions whose FIPS certificates sunset within the given number of days (default 180).
| Name | Required | Description | Default |
|---|---|---|---|
| within | No | Days ahead, default 180 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the behavioral burden. It does disclose that the tool is free and implies a read-only listing operation, but it does not state authentication needs, rate limits, pagination behavior, or whether results include already-expired certificates.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short clauses, front-loads the operation and scope, and contains no wasted language. The one-word pricing note is useful context rather than padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple optional-parameter list tool with no output schema, the description covers what it does, the default window, and the 'free' trait. It could be more complete by clarifying what 'covered' means and how results are ordered, but nothing essential for invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the input schema already documents the single 'within' parameter with its range and default of 180. The description repeats the default but adds no additional formatting or semantic detail beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: it lists covered product versions whose FIPS certificates sunset within a given day window. This clearly separates it in spirit from a general product list, but it does not explicitly name or distinguish itself from sibling tools like fips_list_products.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context is clear enough: use it when you need to find certificates sunsetting soon. However, the description gives no explicit when-not-to-use guidance and does not point to alternatives such as fips_list_products for full inventory or fips_lookup for a specific certificate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fips_list_productsScoutWyze FIPS: list covered productsA
Free. Lists the products and versions ScoutWyze FIPS covers (vendor, product, aliases, versions). Call this first to pick exact product and version names for fips_lookup.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the behavioral burden, and it partially does: "Free" discloses cost, "lists" implies a read-only enumeration, and the return contents are enumerated. It omits any statement about permissions/auth requirements, listing size, or pagination behavior for what could be a large catalog, so the safety profile is inferred rather than declared.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero waste. Cost and scope come first, then the call-to-action routing to fips_lookup, so the most decision-relevant information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, yet the description compensates by naming the record fields (vendor, product, aliases, versions). Combined with the explicit prerequisite relationship to fips_lookup, an agent has everything needed to call this correctly and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate; baseline for a parameterless tool is 4. The description correctly implies a single unfiltered enumeration with no filter arguments to explain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (lists) plus the resource (products and versions covered by ScoutWyze FIPS) and enumerates the fields returned: vendor, product, aliases, versions. It also distinguishes itself from the sibling fips_lookup by positioning itself as the prerequisite discovery step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Call this first to pick exact product and version names for fips_lookup" gives an explicit sequencing rule and names the alternative it feeds, which is unusually actionable. It does not mention the other siblings (fips_expiring, fips_batch) or any case where this call should be skipped, so it stops short of a full when/when-not treatment.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fips_lookupScoutWyze FIPS: is this version FIPS 140-3 validated?A
Returns the FIPS 140-3 status of one product version from NIST CMVP data: ACTIVE, EXPIRING (sunset within 180 days), HISTORICAL, IN_QUEUE (NIST in-process or lab Implementation Under Test list), NOT_VALIDATED or UNVERIFIED, with certificate numbers, sunset dates, post-quantum algorithms and links to the NIST pages used (receipts). The answer is fail-closed: if NIST data is stale it says UNVERIFIED rather than ACTIVE. A few free lookups per day; after that, either set SCOUTWYZE_API_KEY (prepaid credits) or the tool returns an HTTP 402 with an x402 USDC-on-Base challenge that a wallet-capable agent must pay and retry with X-PAYMENT. This server cannot pay it. Unmapped products return 404 with the known list and are always free. Not legal or compliance advice.
| Name | Required | Description | Default |
|---|---|---|---|
| product | Yes | Product name or alias, e.g. "FortiOS", "Windows 11", "RHEL" | |
| version | No | Version, e.g. "7.6", "24H2", "9" |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so: fail-closed behavior (UNVERIFIED rather than ACTIVE when data is stale), the rate limit and prepaid-credit model, the exact 402/x402 USDC-on-Base challenge and X-PAYMENT retry contract, the statement that the server itself cannot pay, and that 404s are free. It also discloses what the response includes (certificates, sunset dates, PQC algorithms, receipt links) and a legal-advice disclaimer.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core purpose and return values, then layers on the payment and failure semantics. Dense but nearly every clause earns its place; the x402 paragraph is long but is genuinely load-bearing for an agent that hits a 402.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, yet the description enumerates the possible status values and the fields returned, plus the failure modes (402, 404) and their remedies. Nothing an agent needs in order to call this correctly or interpret a non-200 is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and both parameters carry examples, so the schema does the heavy lifting. The description adds only the notion of a single product-version pair and does not elaborate on alias matching or version-format tolerance beyond what the schema already shows.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — 'Returns the FIPS 140-3 status of one product version from NIST CMVP data' — and enumerates the exact return statuses, so the agent knows what comes back. The 'one product version' scope implicitly separates it from fips_batch and fips_list_products, which operate over sets.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear operational context: free lookups per day, API-key/credit path, 402 x402 payment retry flow, and that unmapped products return 404 with the known list (pointing toward fips_list_products). It never explicitly names fips_batch or fips_expiring as the alternative for multi-product or sunset-focused queries, so routing between siblings is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.0- First observed
fips_batch - First observed
fips_expiring - First observed
fips_list_products - First observed
fips_lookup
TDQS
Scored across 4 tools
Each tool has a distinct role: enumerate the catalog (fips_list_products), check one version (fips_lookup), filter by sunset window (fips_expiring), and bulk-check many versions (fips_batch). The only mild overlap is fips_lookup vs fips_batch, but the descriptions explicitly separate single vs up-to-500 and free-tier vs prepaid-key paths.
All four tools share a fips_ prefix and snake_case with action-oriented suffixes (list_products, lookup, expiring, batch). Minor deviation in that three are verb/noun-ish while fips_expiring and fips_batch are adjective/noun forms, but overall predictable.
Four tools is a reasonable fit for a narrow FIPS-status lookup service: catalog discovery, single lookup, expiring filter, and bulk check. It is on the lean side but nothing feels redundant or missing at the workflow level.
The surface covers the core lifecycle: discover products/versions, look up status with receipts, monitor sunsets, and batch-check at scale. Gaps are minor, e.g. no dedicated tool to retrieve full certificate detail or search by certificate number, but agents can work around these via fips_lookup.
Maintenance
Related MCP Connectors
Pay-per-call DNS/TLS truth and npm/PyPI breakage checks via x402. No account or API key.
CVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.
Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.
Package vuln advisories from OSV.dev: CVEs, severity, fixes, manifest audit. Pay per call via x402.
Related MCP Servers
- AlicenseBqualityDmaintenanceDefense-grade cryptographic compliance and analysis tools for MCP, including FIPS 140-3 validation, CNSA 2.0 analysis, post-quantum readiness assessment, and classical cipher utilities.182MIT
- AlicenseNot gradedqualityDmaintenanceEnables searching the NIST NVD for CVEs, retrieving full CVE details, checking software for known vulnerabilities, and searching the CPE database.1MIT
- AlicenseNot gradedqualityAmaintenanceSearch and audit CVEs by keyword, severity, CWE, CISA KEV status, and CPE via the NIST National Vulnerability Database.705 npm1Apache 2.0
- AlicenseNot gradedqualityAmaintenanceProvides keyless, read-only access to CISA KEV, SSVC, and full ICS advisory corpus, letting users check CVE statuses, compute BOD 26-04 remediation timelines, and search advisories by vendor, product, CVE, CVSS, or sector.351 npm1Apache 2.0