fips-compliance-checker

FIPS 140-3 Compliance Checker

A Claude Code plugin that provides comprehensive FIPS 140-3 compliance auditing for containerized applications running on Red Hat Enterprise Linux 9 (or later).

Overview

This plugin helps ensure your applications meet FIPS 140-3 cryptographic compliance requirements by:

• Analyzing source code for cryptographic operations
• Scanning dependencies for non-compliant libraries
• Detecting prohibited or non-approved algorithms
• Verifying container base images and configurations
• Identifying operations that bypass RHEL's FIPS-certified cryptographic boundary

Installation

Via Git URL (Direct Reference)

Add this plugin directly via Git URL:

# SSH
/plugin add git@github.com:grdryn/fips-compliance-checker-claude-code-plugin.git

# HTTPS
/plugin add https://github.com/grdryn/fips-compliance-checker-claude-code-plugin

Via Marketplace

If a marketplace includes this plugin, install via:

/plugin install fips-compliance-checker@<marketplace-name>

Prerequisites

The Python scanner uses Bandit in a containerized environment and requires one of the following container runtimes:

• Podman (recommended for RHEL/Fedora):

  dnf install podman
  

• Docker:

  # See https://docs.docker.com/get-docker/
  

On first run, the scanner will automatically pull the Bandit container image (ghcr.io/pycqa/bandit/bandit:latest, ~50MB).

Air-gapped environments: Pre-pull the image and ensure it's available in your local registry:

podman pull ghcr.io/pycqa/bandit/bandit:latest
# or
docker pull ghcr.io/pycqa/bandit/bandit:latest

Usage

Slash Command (Explicit)

Use the fully-qualified /fips-compliance-checker:fips-scan command for direct invocation:

# Scan the current project
/fips-compliance-checker:fips-scan

# Scan a specific container image
/fips-compliance-checker:fips-scan quay.io/myorg/myapp:v1.2.3

Note: Claude Code CLI currently requires the fully-qualified format /plugin-name:command-name.

Natural Language (Auto-selection)

The agent will automatically activate when you ask FIPS-related questions:

• "Can you check if my app is FIPS compliant?"
• "I've added encryption to my authentication module. Is this FIPS compliant?"
• "We need to verify FIPS compliance before deploying to production"
• "Is using the standard Go crypto package okay for FIPS?"

The agent proactively activates when you mention:

• Cryptographic operations (encryption, hashing, TLS/SSL)
• FIPS, compliance, or security certifications
• Container images for Red Hat products or RHEL deployments
• Working with crypto libraries in Java, Python, Go, Rust, or C/C++

What Gets Scanned

Dependencies

• requirements.txt, Pipfile (Python)
• go.mod, go.sum (Go)
• Cargo.toml, Cargo.lock (Rust)
• pom.xml, build.gradle (Java)
• package.json (Node.js)
• CMakeLists.txt, Makefile (C/C++)

Source Code Analysis

• Direct cryptographic operations
• Algorithm usage patterns
• Random number generation methods
• Key derivation functions
• JWT libraries and algorithm choices
• Certificate validation settings

Container Analysis

• Base image compliance (UBI9, RHEL9, etc.)
• Installed cryptographic packages
• FIPS mode capability
• Static linking detection

Build Configuration

• Static linking flags
• Vendored dependencies
• Compilation flags affecting FIPS
• Environment variables

Default Exclusions

By default, the scanner excludes non-production code from analysis to focus on actual runtime compliance issues. The following patterns are automatically excluded:

Test Code

• */tests/* - Test directories
• */test_*.py - Test file prefix pattern
• */*_test.py - Test file suffix pattern
• */conftest.py - pytest configuration

Examples & Documentation

• */examples/*, */samples/* - Example code directories
• */demo/*, */demos/* - Demo applications
• */docs/examples/* - Documentation examples
• */tutorials/* - Tutorial code
• */playground/* - Experimental/playground code

Scripts & Utilities

• */benchmarks/* - Benchmark code
• */scripts/* - Utility scripts
• */tools/* - Development tools
• */utilities/* - Helper utilities

Build Artifacts

• */venv/*, */.venv/*, */env/* - Virtual environments
• */build/*, */dist/* - Build outputs
• */__pycache__/*, */.eggs/* - Python cache
• */node_modules/* - Node.js dependencies

Custom Exclusions

You can add additional exclusion patterns using the --exclude flag:

# Scan Python code with custom exclusions
cd scripts/python
./scan-python-fips.sh --exclude "*/vendor/*" --exclude "*/legacy/*"

Note: Custom exclusions are added to the default patterns (not replacing them).

Suppressing Findings