vulnrable
Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS.
Should I use this
Quality & Safety
Based on automated analysis of tool definitions and protocol compliance.
Context Cost
This is the approximate number of tokens consumed each time the server's tools are loaded into a model's context. Higher counts reduce the attention available for other tasks.
Install
One-Click Install
Add this to your `claude_desktop_config.json` file:
{
"mcpServers": {
"vulnrable": {
"url": "https://vulnrable.com/api/mcp"
}
}
}Remote endpoints
https://vulnrable.com/api/mcpstreamable-httpWhat it can do
Tool inventory
Tools (4)
🟢check_package(name, ecosystem)
Security assessment of one npm or PyPI package: letter grade, findings, known vulnerabilities, deprecation status, and — for MCP servers in our directory — the real resolved dependency count. Use before recommending or installing a package.
Input Schema
{
"type": "object",
"properties": {
"name": {
"type": "string",
"maxLength": 214,
"description": "Exact package name"
},
"ecosystem": {
"type": "string",
"enum": [
"npm",
"PyPI"
]
}
},
"required": [
"name",
"ecosystem"
]
}🟢list_mcp_servers(sort_by, understates_only)
The MCP server directory with real resolved dependency counts. Use when recommending an MCP server, or to compare how much third-party code candidates pull into the agent. For a graded security assessment of one server, call check_package.
Input Schema
{
"type": "object",
"properties": {
"sort_by": {
"type": "string",
"enum": [
"total_packages",
"name"
],
"default": "total_packages",
"description": "total_packages sorts heaviest first"
},
"understates_only": {
"type": "boolean",
"default": false,
"description": "Only servers whose count understates real surface (mostly prebuilt binaries)"
}
}
}🟢check_cve(id)
Details for one CVE or GHSA identifier, including whether CISA lists it as actively exploited (KEV) and its EPSS exploitation probability. Use to judge real-world urgency.
Input Schema
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "e.g. CVE-2024-3094 or GHSA-xxxx-xxxx-xxxx"
}
},
"required": [
"id"
]
}⚪latest_vulns(limit, kev_only, min_severity)
Recently published vulnerabilities from the tracked pool, ranked KEV-first then by EPSS. Use for "what should I worry about this week".
Input Schema
{
"type": "object",
"properties": {
"limit": {
"type": "integer",
"minimum": 1,
"maximum": 25,
"default": 10
},
"kev_only": {
"type": "boolean",
"default": false
},
"min_severity": {
"type": "string",
"enum": [
"LOW",
"MEDIUM",
"HIGH",
"CRITICAL"
]
}
}
}Community
Evidence