Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "cve-vulnerability-lookup": {
      "type": "http",
      "url": "https://security.datakoot.com/mcp"
    }
  }
}

claude mcp add --transport http cve-vulnerability-lookup https://security.datakoot.com/mcp

[mcp_servers.cve-vulnerability-lookup]
url = "https://security.datakoot.com/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cve-vulnerability-lookup": {
      "type": "remote",
      "url": "https://security.datakoot.com/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "cve-vulnerability-lookup": {
      "type": "http",
      "url": "https://security.datakoot.com/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=cve-vulnerability-lookup&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vc2VjdXJpdHkuZGF0YWtvb3QuY29tL21jcCJ9"
}

{
  "servers": {
    "cve-vulnerability-lookup": {
      "type": "http",
      "url": "https://security.datakoot.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "cve-vulnerability-lookup": {
      "httpUrl": "https://security.datakoot.com/mcp"
    }
  }
}

extensions:
  "cve-vulnerability-lookup":
    enabled: true
    name: "cve-vulnerability-lookup"
    type: streamable_http
    uri: "https://security.datakoot.com/mcp"
    timeout: 300

Quality 86 / 100good

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene100 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations5 of 5 tools declare readOnlyHint or destructiveHint
pass
tools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
pass
tools.token_costabout 910 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability75 · weight 15

warn
stability.changes10 tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

5 tools, about 910 tokens to load them all · tool set 5a518a3e605f · tools last changed 2026-10-08 · checked 2026-10-20 17:34 UTC

Tool changes

2026-10-08audit_dependencieschangedoutput schema
2026-10-08package_vulnerabilitieschangedoutput schema
2026-10-08epss_scorechangedoutput schema
2026-10-08known_exploitedchangedoutput schema
2026-10-08cve_lookupchangedoutput schema
2026-10-03audit_dependencieschangedtitle, input schema, output schema, annotations
2026-10-03package_vulnerabilitieschangedtitle, output schema, annotations
2026-10-03epss_scorechangedtitle, output schema, annotations
2026-10-03known_exploitedchangedtitle, output schema, annotations
2026-10-03cve_lookupchangedtitle, input schema, output schema, annotations

Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 93 / 100

provenance90

liveness98

freshness85

hygiene100

+repository +namespace-matches-repo +dns-namespace +reachable +uptime-96% ~updated-48d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://security.datakoot.com/mcp` streamable-http	none	yes	96%	177 ms	2025-06-18	2026-10-20

Tools (5)

`audit_dependencies`read-only	Audit a whole dependency manifest for known vulnerabilities in one call. Paste a package.json (as 'manifest'), or pass a 'dependencies' array of {name, version} objects. Returns per-package findings and a summary. Ecosystem defaults to npm.
`cve_lookup`read-only	Look up a CVE by ID and get a compact summary: description, CVSS score & severity, vector, CWE weakness, publish date, references — plus whether it is on the CISA Known-Exploited list (actively exploited in the wild) and its EPSS exploit-probability. Sources: NVD (NIST), CISA KEV, FIRST EPSS.
`epss_score`read-only	Get the EPSS exploit-probability score (0-1) and percentile for one or more CVEs — the likelihood each is exploited in the next 30 days. Use it to prioritize patching. Pass cve_id for one, or cve_ids (array or comma-separated) for many. Source: FIRST.org EPSS.
`known_exploited`read-only	Check whether a CVE is on the CISA Known Exploited Vulnerabilities (KEV) catalog — confirmed exploited in the wild — or list the most recently added exploited vulnerabilities. Pass cve_id to check one; omit it to list recent (optionally filter by vendor/product, or ransomware_only). Source: CISA KEV, updated ~daily.
`package_vulnerabilities`read-only	List known vulnerabilities for a software package (optionally a specific version) via OSV. Ecosystems: npm, pypi, cargo, go, maven, rubygems, nuget, composer, pub, hex.

Schemas: list_tools.

Similar MCP servers

More from com.datakoot

And 3 more from this publisher.

Official server.json

{
  "name": "com.datakoot/cve-vulnerability-lookup",
  "title": "Security Intel MCP",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://security.datakoot.com/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "2.1.0",
  "repository": {
    "url": "https://github.com/datakoot/security-intel-mcp",
    "source": "github"
  },
  "description": "CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys."
}