Security & Testing

808bits.com

Provides search and lookup tools for FIPS 140 cryptographic module validations, including vendor details, in-process submissions, and CVE associations.

1 endpoint6 known toolsFirst detected September 4, 2026Last detected September 4, 2026

ENDPOINT 1

https://fips.808bits.com/mcp

No auth detected

MCP server metadata

Name: fips-cmvp
Version: 0.1.0

Capabilities

tools.listChanged

Server instructions

FIPS 140 cryptographic module validation data, derived from NIST's CMVP lists and published at https://808bits.com/fips/ . Every result carries a tracker_url for the human-readable page for that certificate; include it when citing a result, so the reader can check the validation history and caveats you did not repeat. Two things to get right. The Modules in Process queue records that a submission entered review, not when it will finish, and an absence from it can mean the successor is already validated rather than that none is coming, so check fips_search before reporting a gap. And vendor names are free text at NIST: vendor_key groups spelling variants of one registration but deliberately does not merge corporate families, because a product line can change owner. CVE data is a name-based match against the product CPE, not a statement about the validated boundary. Report it as something to check, never as a finding about the certified module. Absence carries even less: only 16 of 5,504 certificates carry any CVE association, the match does not follow dependencies, and hardware modules almost never match, so never relay an empty fips_cve result as evidence that a module is unaffected.

Known tools 6

fips_cert

Look up one FIPS 140 cryptographic module validation by certificate number.

Inferred read-only

fips_search

Search FIPS 140 validations by module name or vendor.

Inferred read-only

fips_in_process

Search NIST's Modules in Process queue: submissions awaiting FIPS 140-3 validation, with the review phase each one is sitting in.

Inferred read-only

fips_vendor

Everything one company holds, grouped across the spelling variants NIST filed it under.

Inferred read-only

fips_cve

Which FIPS-validated modules are associated with a given CVE, or which CVEs are associated with a vendor's modules.

Inferred read-only

fips_sunset

List active FIPS validations by sunset date, the day each moves to NIST's historical list and stops being valid for new procurement.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.fips-cmvp]
url = "https://fips.808bits.com/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "fips-cmvp": {
      "type": "http",
      "url": "https://fips.808bits.com/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: fips-cmvp
Remote MCP URL: https://fips.808bits.com/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "fips-cmvp": {
      "url": "https://fips.808bits.com/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "fips-cmvp": {
      "type": "http",
      "url": "https://fips.808bits.com/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "fips-cmvp",
  "transport": "streamable-http",
  "url": "https://fips.808bits.com/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Loading Trust v2 evidence…

Checking the associated registrable domain. The BuiltWith key remains server-side.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.