Fips Cmvp MCP server

What it does

An MCP server that provides read-only access to NIST FIPS 140 cryptographic module validation data, including current certificates and the queue of submissions awaiting validation. It is for developers, security teams, and compliance specialists who need to query validated cryptographic modules, check vendor certifications, track validation status, and monitor CVE associations.

• Look up the validation status, level, and expiration date of a specific FIPS 140 certificate by its number.
• Search whether a vendor or product currently holds a valid FIPS 140 certification and at what level.
• Check which validated cryptographic modules are associated with a specific CVE or which CVEs affect a vendor's certified modules.

Tools this server exposes

Tool	Does
fips_cert	Returns the status, level, sunset date, and validation history for a single certificate number.
fips_search	Checks whether a vendor or product holds a current FIPS 140 validation and reports the certification level.
fips_vendor	Returns all FIPS 140 certificates held by a company across all spelling variants NIST has used.
fips_cve	Reports which validated modules are associated with a given CVE and which CVEs touch a vendor's certifications.
fips_in_process	Reports whether a vendor's replacement module has been submitted to NIST and what phase of review it is in.
fips_sunset	Lists which validated certificates expire before a given date and identifies vendors about to lose all active certifications.

Before you enable it

An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.