vulnrable
Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS.
¿Debería usar esto?
Calidad y seguridad
Basado en el análisis automatizado de las definiciones de herramientas y el cumplimiento del protocolo.
Costo de contexto
Este es el número aproximado de tokens que se consumen cada vez que las herramientas del servidor se cargan en el contexto de un modelo. Los recuentos más altos reducen la atención disponible para otras tareas.
Instalar
Instalación con un clic
Agrega esto a tu archivo `claude_desktop_config.json`:
{
"mcpServers": {
"vulnrable": {
"url": "https://vulnrable.com/api/mcp"
}
}
}Puntos de conexión remotos
https://vulnrable.com/api/mcpstreamable-httpQué puede hacer
Inventario de herramientas
Herramientas (4)
🟢check_package(name, ecosystem)
Security assessment of one npm or PyPI package: letter grade, findings, known vulnerabilities, deprecation status, and — for MCP servers in our directory — the real resolved dependency count. Use before recommending or installing a package.
Esquema de entrada
{
"type": "object",
"properties": {
"name": {
"type": "string",
"maxLength": 214,
"description": "Exact package name"
},
"ecosystem": {
"type": "string",
"enum": [
"npm",
"PyPI"
]
}
},
"required": [
"name",
"ecosystem"
]
}🟢list_mcp_servers(sort_by, understates_only)
The MCP server directory with real resolved dependency counts. Use when recommending an MCP server, or to compare how much third-party code candidates pull into the agent. For a graded security assessment of one server, call check_package.
Esquema de entrada
{
"type": "object",
"properties": {
"sort_by": {
"type": "string",
"enum": [
"total_packages",
"name"
],
"default": "total_packages",
"description": "total_packages sorts heaviest first"
},
"understates_only": {
"type": "boolean",
"default": false,
"description": "Only servers whose count understates real surface (mostly prebuilt binaries)"
}
}
}🟢check_cve(id)
Details for one CVE or GHSA identifier, including whether CISA lists it as actively exploited (KEV) and its EPSS exploitation probability. Use to judge real-world urgency.
Esquema de entrada
{
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "e.g. CVE-2024-3094 or GHSA-xxxx-xxxx-xxxx"
}
},
"required": [
"id"
]
}⚪latest_vulns(limit, kev_only, min_severity)
Recently published vulnerabilities from the tracked pool, ranked KEV-first then by EPSS. Use for "what should I worry about this week".
Esquema de entrada
{
"type": "object",
"properties": {
"limit": {
"type": "integer",
"minimum": 1,
"maximum": 25,
"default": 10
},
"kev_only": {
"type": "boolean",
"default": false
},
"min_severity": {
"type": "string",
"enum": [
"LOW",
"MEDIUM",
"HIGH",
"CRITICAL"
]
}
}
}Comunidad
Evidencia