Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.
| Endpoint | https://mcp.sectora.io/mcp (streamable-http) |
|---|---|
| Registry version | 1.1.0 |
| Now | 14 tools · grade B (87) · pin ts_01602fcc9a65d82e9da086ae98b44b45 · protocol 2025-03-26 |
| First / last listed | 2026-10-30 03:23 UTC / 2026-10-30 03:23 UTC |
| Grade over time | 2026-10-30: B (87), 14 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: lookup_cve assess_tech_risk search_cves get_kev_recent get_trending_cves get_weaponization_score lookup_ip_reputation get_threat_stats list_my_findings list_my_scans get_scan scan_url get_my_posture assess_dependency
lookup_cve | Get full threat intelligence enrichment for a CVE including EPSS score, CISA KEV status, public exploits, Nuclei templates, risk level, and risk factors. Input must be a valid CVE ID. params: cve_id* |
assess_tech_risk | Assess security risk for a list of technologies. Returns known CVEs affecting each technology with severity breakdown. Input: comma-separated technology names only. params: technologies* |
search_cves | Search for CVEs by keyword, severity, or other filters. Query must be alphanumeric text. params: query*, severity, is_kev, has_exploit |
get_kev_recent | Get recently added entries to the CISA Known Exploited Vulnerabilities (KEV) catalog. params: days |
get_trending_cves | Get currently trending CVEs based on recent KEV additions, high EPSS scores, and exploit availability. params: limit |
get_weaponization_score | Get the weaponization score (0-100) for a CVE. Factors in EPSS, KEV status, exploit availability, Nuclei templates, and CVSS. Input must be a valid CVE ID. params: cve_id* |
lookup_ip_reputation | Look up community IP reputation from Sectora Shield WAF network. Shows if an IP has been reported for attacks. Accepts IPv4 or IPv6 (the Shield network sees both). params: ip* |
get_threat_stats | Get statistics about the Sectora threat intelligence database including counts of EPSS scores, KEV entries, Nuclei templates, and exploits. No input required. params: none |
list_my_findings | List the API key owner's open security findings across all scans. Use this to answer "what's my current exposure?" Filter by severity, status, or domain. Returns finding summaries; call get_scan for full detail. Requires API key. params: severity, status, domain, limit |
list_my_scans | List the API key owner's recent scans with summary counts. Requires API key. params: limit, status |
get_scan | Get a scan with all its findings (full detail: title, description, evidence, remediation, CVSS). Requires API key. params: scan_id* |
scan_url | Kick off a DAST security scan against a public URL the API key owner controls. Two-step flow: first call returns a preview (target, profile, ETA, quota remaining); confirm by calling again with confirm:true to actually start the scan. Returns scan_id; poll status with get_scan. Domain must be verified in the Sectora account. Daily quota: 25 scans/24h per user, plus the plan's monthly scan limit. R params: url*, profile, confirm |
get_my_posture | Get Shield WAF posture score and breakdown for a domain registered under this account. Returns 0-100 score, letter grade, per-component breakdown (origin lock, virtual patching, TLS, etc.), and edge_health (whether Shield is actually intercepting traffic). Requires API key. params: domain* |
assess_dependency | Check a single package@version for known vulnerabilities via OSV.dev (npm, PyPI, Go, Maven, NuGet, RubyGems, Packagist, crates.io, etc.). Returns advisories with CVE IDs, severity, fixed versions, and references. Free tier eligible. params: name*, version*, ecosystem* |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.