ScoutWyze FIPS

What ScoutWyze FIPS MCP server does

ScoutWyze FIPS MCP server provides MCP access to the ScoutWyze FIPS status API. The API derives answers from NIST Cryptographic Module Validation Program data, including active certificates, Modules In Process, and Implementation Under Test records. Results include links to the NIST pages used for the response.

The service covers products and versions across platforms and vendors such as Windows 11 and Windows Server, macOS and iOS, FortiOS, PAN-OS, Panorama, Cisco FTD, RHEL, Ubuntu, Samsung Android, Aruba, SonicWall, F5, Juniper, VMware ESXi, and Okta. Products without a mapping are logged as requests rather than silently treated as validated.

Supported status values are ACTIVE, EXPIRING, HISTORICAL, IN_QUEUE, NOT_VALIDATED, and UNVERIFIED. EXPIRING means the certificate sunset is within 180 days. When the underlying NIST data is stale, the service returns UNVERIFIED instead of ACTIVE.

How it works

An MCP client starts the package with npx and invokes one of the exposed tools. fips_list_products returns covered products and versions. fips_lookup checks one product version and can return certificate information, sunset dates, post-quantum algorithms, and receipts. fips_expiring finds covered versions whose certificates sunset within a requested number of days. fips_batch accepts up to 500 versions in a single request.

Listing products and finding expiring versions are free. Individual lookups include a few free requests per day, then require credits or an x402 payment. Batch requests use prepaid credits. The server itself does not hold a private key or make payments. If the API returns a 402 response, it places the x402 challenge in tool content so a wallet-capable calling agent can pay in USDC on Base and retry with X-PAYMENT.

Setup and configuration

ScoutWyze FIPS MCP server runs as a standard stdio MCP process through the published npm package. Add this server configuration to an MCP client:

{
  "mcpServers": {
    "scoutwyze-fips": {
      "command": "npx",
      "args": ["-y", "@scoutwyze/fips-mcp"]
    }
  }
}

Set SCOUTWYZE_API_KEY when using a prepaid key. SCOUTWYZE_FIPS_BASE_URL is available for local development only.

Limitations and notes

The data is intended to answer status questions from NIST CMVP records, not to replace an assessor’s determination. The project explicitly states that its output is not legal or compliance advice, so results should be confirmed with the relevant assessor.

Coverage is limited to products and versions represented by the ScoutWyze FIPS service. A product that is not mapped may be recorded as a request. Status depends on the freshness and content of the source NIST data; stale data produces UNVERIFIED. Payment support also depends on the calling agent being able to handle the x402 challenge and provide the required retry header.