Security Intel MCP
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
| Endpoint | https://security.datakoot.com/mcp (streamable-http) |
|---|---|
| Registry version | 2.1.0 |
| Now | 5 tools · grade B (83) · pin ts_5abd722cbfe5006dc2fde6fde37dddca · protocol 2025-06-18 |
| First / last listed | 2026-10-28 07:12 UTC / 2026-10-28 07:12 UTC |
| Grade over time | 2026-10-28: B (83), 5 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: cve_lookup known_exploited epss_score package_vulnerabilities audit_dependencies
cve_lookup | Look up a CVE by ID and get a compact summary: description, CVSS score & severity, vector, CWE weakness, publish date, references — plus whether it is on the CISA Known-Exploited list (actively exploited in the wild) and its EPSS exploit-probability. Sources: NVD (NIST), CISA KEV, FIRST EPSS. params: cve_id* |
known_exploited | Check whether a CVE is on the CISA Known Exploited Vulnerabilities (KEV) catalog — confirmed exploited in the wild — or list the most recently added exploited vulnerabilities. Pass cve_id to check one; omit it to list recent (optionally filter by vendor/product, or ransomware_only). Source: CISA KEV, updated ~daily. params: cve_id, limit, vendor, ransomware_only |
epss_score | Get the EPSS exploit-probability score (0-1) and percentile for one or more CVEs — the likelihood each is exploited in the next 30 days. Use it to prioritize patching. Pass cve_id for one, or cve_ids (array or comma-separated) for many. Source: FIRST.org EPSS. params: cve_id, cve_ids |
package_vulnerabilities | List known vulnerabilities for a software package (optionally a specific version) via OSV. Ecosystems: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex. params: ecosystem*, name*, version |
audit_dependencies | Audit a whole dependency manifest for known vulnerabilities in one call. Paste a package.json (as 'manifest'), or pass a 'dependencies' array of {name, version} objects. Returns per-package findings and a summary. Ecosystem defaults to npm. params: manifest, dependencies, ecosystem |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.