Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS.
| Endpoint | https://vulnrable.com/api/mcp (streamable-http) |
|---|---|
| Registry version | 1.0.0 |
| Now | 4 tools · grade A (98) · pin ts_e43c00819848aa172ad6d91a48ee9a56 · protocol 2025-06-18 |
| First / last listed | 2026-10-24 23:14 UTC / 2026-10-24 23:14 UTC |
| Grade over time | 2026-10-24: A (98), 4 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: check_package list_mcp_servers check_cve latest_vulns
check_package | Security assessment of one npm or PyPI package: letter grade, findings, known vulnerabilities, deprecation status, and — for MCP servers in our directory — the real resolved dependency count. Use before recommending or installing a package. params: name*, ecosystem* |
list_mcp_servers | The MCP server directory with real resolved dependency counts. Use when recommending an MCP server, or to compare how much third-party code candidates pull into the agent. For a graded security assessment of one server, call check_package. params: sort_by, understates_only |
check_cve | Details for one CVE or GHSA identifier, including whether CISA lists it as actively exploited (KEV) and its EPSS exploitation probability. Use to judge real-world urgency. params: id* |
latest_vulns | Recently published vulnerabilities from the tracked pool, ranked KEV-first then by EPSS. Use for "what should I worry about this week". params: limit, kev_only, min_severity |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.