# ScoutWyze FIPS [Health: Active]

**Category:** 🔑 Cryptography  
**Repository:** https://github.com/scoutwyze-max/fips-mcp  
**GitHub Stars:** 0  
**npm Downloads (last month):** 444  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/scoutwyze-fips

## Description
Is this product version FIPS 140-3 validated, in NIST's queue, or expiring? From NIST CMVP data.

## Tools
Capabilities this server exposes over MCP:

- **fips_list_products** — Free. Lists the products and versions ScoutWyze FIPS covers (vendor, product, aliases, versions). Call this first to pick exact product and version names for fips_lookup.
- **fips_lookup** — Returns the FIPS 140-3 status of one product version from NIST CMVP data: ACTIVE, EXPIRING (sunset within 180 days), HISTORICAL, IN_QUEUE (NIST in-process or lab Implementation Under Test list), NOT_VALIDATED or UNVERIFIED, with certificate numbers, sunset dates, post-quantum algorithms and links to the NIST pages used (receipts). The answer is fail-closed: if NIST data is stale it says UNVERIFIED rather than ACTIVE. A few free lookups per day; after that, either set SCOUTWYZE_API_KEY (prepaid credits) or the tool returns an HTTP 402 with an x402 USDC-on-Base challenge that a wallet-capable agent must pay and retry with X-PAYMENT. This server cannot pay it. Unmapped products return 404 with the known list and are always free. Not legal or compliance advice.
- **fips_expiring** — Free. Lists covered product versions whose FIPS certificates sunset within the given number of days (default 180).
- **fips_batch** — Checks up to 500 product versions in one call and returns per-item status plus counts. Requires a prepaid SCOUTWYZE_API_KEY (billed per item; no free tier, no x402). Without a key or credits it returns HTTP 402 with signup and credit-pack details.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "scoutwyze-fips": {
    "command": "npx",
    "args": ["-y","@scoutwyze/fips-mcp"],
    "env": {
      "SCOUTWYZE_API_KEY": "",
      "SCOUTWYZE_FIPS_BASE_URL": ""
    }
  }
}
```

**Requires environment variables:** `SCOUTWYZE_API_KEY`, `SCOUTWYZE_FIPS_BASE_URL` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What ScoutWyze FIPS MCP server does

ScoutWyze FIPS MCP server provides MCP access to the ScoutWyze FIPS status API. The API derives answers from NIST Cryptographic Module Validation Program data, including active certificates, Modules In Process, and Implementation Under Test records. Results include links to the NIST pages used for the response.

The service covers products and versions across platforms and vendors such as Windows 11 and Windows Server, macOS and iOS, FortiOS, PAN-OS, Panorama, Cisco FTD, RHEL, Ubuntu, Samsung Android, Aruba, SonicWall, F5, Juniper, VMware ESXi, and Okta. Products without a mapping are logged as requests rather than silently treated as validated.

Supported status values are `ACTIVE`, `EXPIRING`, `HISTORICAL`, `IN_QUEUE`, `NOT_VALIDATED`, and `UNVERIFIED`. `EXPIRING` means the certificate sunset is within 180 days. When the underlying NIST data is stale, the service returns `UNVERIFIED` instead of `ACTIVE`.

## How it works

An MCP client starts the package with `npx` and invokes one of the exposed tools. `fips_list_products` returns covered products and versions. `fips_lookup` checks one product version and can return certificate information, sunset dates, post-quantum algorithms, and receipts. `fips_expiring` finds covered versions whose certificates sunset within a requested number of days. `fips_batch` accepts up to 500 versions in a single request.

Listing products and finding expiring versions are free. Individual lookups include a few free requests per day, then require credits or an x402 payment. Batch requests use prepaid credits. The server itself does not hold a private key or make payments. If the API returns a 402 response, it places the x402 challenge in tool content so a wallet-capable calling agent can pay in USDC on Base and retry with `X-PAYMENT`.

## Setup and configuration

ScoutWyze FIPS MCP server runs as a standard stdio MCP process through the published npm package. Add this server configuration to an MCP client:

```json
{
  "mcpServers": {
    "scoutwyze-fips": {
      "command": "npx",
      "args": ["-y", "@scoutwyze/fips-mcp"]
    }
  }
}
```

Set `SCOUTWYZE_API_KEY` when using a prepaid key. `SCOUTWYZE_FIPS_BASE_URL` is available for local development only.

## Limitations and notes

The data is intended to answer status questions from NIST CMVP records, not to replace an assessor’s determination. The project explicitly states that its output is not legal or compliance advice, so results should be confirmed with the relevant assessor.

Coverage is limited to products and versions represented by the ScoutWyze FIPS service. A product that is not mapped may be recorded as a request. Status depends on the freshness and content of the source NIST data; stale data produces `UNVERIFIED`. Payment support also depends on the calling agent being able to handle the x402 challenge and provide the required retry header.

_Full upstream README: https://allmcps.com/mcp/scoutwyze-fips/readme_