Security certifications MCP server: FIPS 140-3 and Common Criteria data for AI agents

Certification data is public but awkward to use: the CMVP and Common Criteria Portal publish thousands of certificates, security policies and reports, mostly as web pages and PDFs. The sec-certs project from the CRoCS lab at Masaryk University turns them into structured datasets. KBrain loads those datasets every week, links them to its CVE data, and exposes them as MCP tools, so an AI assistant or agent can query certificates the way it queries any other tool.

The tools

• get_certificate: one FIPS 140-3 or Common Criteria certificate by number or id, with all key facts and related CVEs.
• search_certificates: filtered search across both schemes, up to 100 results, active certificates first.
• certificates_for_cve: certified products that may be affected by a CVE.
• certs_server_status: certificate counts, CVE links and data freshness.

Every tool result names its source, sec-certs.org, and carries a note that CVE matches are automated. Agents can pass that context on to the person reading the answer.

Why hosted instead of self-hosted

• The full datasets are hundreds of megabytes of JSON. KBrain streams and normalises them weekly, so your agent never downloads them.
• Certificates are joined with NVD, CISA KEV and EPSS from the CVE brain, which would otherwise be a second pipeline to run.
• One KBrain MCP endpoint serves the certification tools next to the CVE tools and your other brains.

Agent workflows it supports

• A vulnerability agent that, for each new critical CVE, lists the certified products that may be affected.
• A procurement agent that checks a vendor questionnaire against the certification records.
• A post-quantum readiness agent that lists validated modules supporting ML-KEM or ML-DSA for each supplier.

Certificate data comes from sec-certs.org, built by the Centre for Research on Cryptography and Security (CRoCS) at Masaryk University from NIST CMVP and the Common Criteria Portal. KBrain refreshes it weekly and links it to the CVE brain.