fim-mcp

Local stdio MCP server for the Tripwire Enterprise REST API.

The first version wraps the core FIM workflows:

• list and fetch nodes
• get policy test results
• list and fetch element versions
• explore allowlist software, open port, user, and service results
• promote element versions
• check promote request status
• make a raw Tripwire API request for uncovered endpoints

Setup

python -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install -e .
Copy-Item .env.example .env

Edit .env:

TE_HOST=https://TECONSOLEHOST/api
TE_USERNAME=administrator
TE_API_TOKEN=replace-with-token
TE_VERIFY_SSL=false
TE_TIMEOUT=30

TE_HOST may point at either the API root (https://server/api) or the versioned API root (https://server/api/v1).

Run

python -m fim_mcp

For MCP clients that need a command:

{
  "mcpServers": {
    "fim-mcp": {
      "command": "python",
      "args": ["-m", "fim_mcp"],
      "env": {
        "TE_HOST": "https://TECONSOLEHOST/api",
        "TE_USERNAME": "administrator",
        "TE_API_TOKEN": "replace-with-token",
        "TE_VERIFY_SSL": "false"
      }
    }
  }
}

If your Python user scripts directory is on PATH, the installed fim-mcp command works too.

Use with Codex

Codex reads MCP server definitions from config.toml in your Codex home directory. On Windows this is usually:

C:\Users\<you>\.codex\config.toml

After running the setup steps above, add this to that file. Use the full path to the virtual environment Python for the repo:

[mcp_servers.fim-mcp]
command = 'C:\path\to\fim-mcp\.venv\Scripts\python.exe'
args = ['-m', 'fim_mcp']
startup_timeout_sec = 30

[mcp_servers.fim-mcp.env]
TE_HOST = 'https://TECONSOLEHOST/api'
TE_USERNAME = 'administrator'
TE_API_TOKEN = 'replace-with-token'
TE_VERIFY_SSL = 'false'
TE_TIMEOUT = '30'

For this checkout, the command path would look like:

command = 'C:\Users\chris\Downloads\vibes\te mcp\.venv\Scripts\python.exe'

If you install the package somewhere already on PATH, you can use the console script instead:

[mcp_servers.fim-mcp]
command = 'fim-mcp'
args = []
startup_timeout_sec = 30

[mcp_servers.fim-mcp.env]
TE_HOST = 'https://TECONSOLEHOST/api'
TE_USERNAME = 'administrator'
TE_API_TOKEN = 'replace-with-token'
TE_VERIFY_SSL = 'false'
TE_TIMEOUT = '30'

Restart Codex, or start a new Codex session, after editing config.toml. To verify the server is available, ask Codex to list Tripwire Enterprise nodes or call te_get_status. If the server starts correctly, Codex will have access to the te_* tools listed below.

Tools

• te_get_status
• te_list_nodes
• te_get_node
• te_get_policy_test_results
• te_get_policy_test_result
• te_list_versions
• te_get_version
• te_list_allowlist_software_results
• te_list_allowlist_open_port_results
• te_list_allowlist_user_results
• te_list_allowlist_service_results
• te_promote_versions
• te_get_promote_request
• te_api_request

Most list tools accept a filters object. The keys map directly to Tripwire Enterprise query parameters, so filters such as name, sub_name, nodeId, state, pageLimit, and pageStart can be passed without code changes.

Set raw: true on wrapped tools to return the Tripwire JSON unchanged. The default response returns a smaller MCP-friendly summary plus a count.