Security Intel MCP

Server Details

CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.

If you are the author of this connector, you can claim ownership with GitHub, an HTTP challenge, or a DNS record. Claimed connector authors can inspect health checks, view analytics, and manage their listing.

Status: Unhealthy
Last Tested: 2026-09-10 04:40
Transport: Streamable HTTP
URL
Repository: datakoot/security-intel-mcp
GitHub Stars: 0
Server Listing: Security Intel MCP

TDQS

A3.9/5.0

Scored 2026-08-01 18:05 across 3 tools

Disambiguation5/5

The three tools have clearly distinct purposes: auditing a dependency manifest, looking up a specific CVE by ID, and listing vulnerabilities for a particular package. No overlaps or ambiguous boundaries exist.

Naming Consistency3/5

Tool names are readable but not consistently patterned. 'audit_dependencies' uses verb_noun, 'cve_lookup' is noun_verb, and 'package_vulnerabilities' is a noun phrase, mixing conventions without being chaotic.

Tool Count4/5

Three tools is on the smaller side but appropriate for a focused security intelligence server. Each tool provides a distinct and necessary function, and the count feels lean rather than insufficient.

Completeness4/5

The domain of vulnerability intelligence is well-covered with manifest auditing, CVE details, and package lookups. Minor gaps exist (e.g., no search or advisory listing), but core workflows are supported without dead ends.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

5 tool updatesJul 18, 2026

Changedaudit_dependencies5 fields changed

addedInput schema / properties / dependencies

Added value: +{
+  "description": "[{name, version}] entries",
+  "items": {
+    "type": "object"
+  },
+  "type": "array"
+}

addedInput schema / properties / ecosystem

Added value: +{
+  "description": "Default npm",
+  "type": "string"
+}

removedInput schema / properties / format

Removed value: -{
-  "description": "Optional: npm | pypi | go. Auto-detected if omitted.",
-  "type": "string"
-}

changedInput schema / properties / manifest / description

Previous value: -"Full contents of a package.json, requirements.txt, or go.mod file"New value: +"Raw package.json contents"

changedInput schema / required

Previous value: -[
-  "manifest"
-]New value: +[]

Changedcve_lookup2 fields changed
- changedInput schema / properties / cve_id / description
```
Previous value: -"CVE identifier, e.g. CVE-2021-44228"New value: +"e.g. CVE-2021-44228"
```
- removedInput schema / properties / cve_id / pattern
```
Removed value: -"^CVE-\\d{4}-\\d{4,}$"
```
Removedip_reputation

Changedpackage_vulnerabilities3 fields changed

removedInput schema / properties / ecosystem / description

Removed value: -"Package ecosystem: npm, PyPI, Go, Maven, crates.io, RubyGems, Packagist, NuGet, Hex, Pub, Debian, Alpine"

removedInput schema / properties / name / description

Removed value: -"Package name, e.g. lodash or org.apache.logging.log4j:log4j-core"

changedInput schema / properties / version / description

Previous value: -"Exact version to check (optional; omit to list all known vulns)"New value: +"Optional; if given, only vulns affecting that version are returned"

Removedurl_check

1 tool updateJul 11, 2026
- Addedaudit_dependencies
4 tool updatesJul 10, 2026
- First observedcve_lookup
- First observedip_reputation
- First observedpackage_vulnerabilities
- First observedurl_check

Frequently Asked Questions

Claiming proves that you control a remote MCP connector. It does not move, proxy, or interrupt the server.

Open the connector listing, choose Claim ownership, and sign in to Glama.
Complete one verification method:
- GitHub identity – fastest for official registry listings. For a namespace such as io.github.alice/server, link the matching GitHub user, then choose Claim with GitHub. An organization namespace such as io.github.acme/server also needs that organization to have installed the Glama AI GitHub App and approved its permissions, because GitHub discloses organization membership only to apps it has installed. Use HTTP or DNS when it has not.
- HTTP challenge – works when you can deploy a public file. Generate a token, publish the exact JSON Glama shows at /.well-known/glama.json on the same origin as the connector, then choose Check HTTP challenge.
- DNS challenge – works when you control DNS but cannot change the server. Generate a token, create the exact TXT record Glama shows, wait for it to propagate, then choose Check DNS challenge.
After verification, Glama sends a confirmation email and gives you access to listing details, thumbnails, health checks, and analytics. Keep the HTTP file or DNS record in place: Glama periodically checks it and ownership remains verified while the token is discoverable.

The HTTP ownership file has this structure:

{
  "$schema": "https://glama.ai/mcp/schemas/connector.json",
  "claim": "glama_claim_..."
}

Claim tokens are opaque, stable, and bound to the signed-in Glama account. They contain no email address or other personal information. If Glama can no longer discover a verified HTTP or DNS token, it starts a seven-day grace period before removing claim-based access. Restore the same token during that period to keep ownership verified. Never publish an email address, Glama session token, GitHub token, or connector credential as ownership proof.

If verification fails, confirm that you copied the current token exactly. The HTTP file must be public, return valid JSON with a successful HTTP response, and stay on the connector's origin. DNS changes may need more time to propagate. A claim cannot transfer to a different origin or hostname: if the connector target changes, Glama starts the grace period and the new target must be claimed separately after the previous claim is released.

For a connector linked to the official MCP Registry, registry updates continue to replace its name, description, and URL by default. After claiming, open Manage connector and enable Use Glama listing details as the source of truth if edits made on Glama should be preserved. Categories and thumbnails are always managed on Glama; registry linkage and technical connection settings continue to sync.

Related MCP Connectors

Security Intel MCP A
com.datakoot
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Penetration Testing Security
31
dependency-trust A
ai.kaiv
Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.
Security Developer Tools
51
AgentAegis A
io.github.astafford8488
Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.
Security Penetration Testing
2821
Vulnerability Intel MCPOAuth
net.nexlab
Defensive vulnerability intelligence search across public CVE/NVD and GitHub advisory APIs with CVSS
Penetration Testing Security
1

Related MCP Servers

DepHealth MCP
Security Code Analysis
hasarahman
A
license
A
quality
D
maintenance
Dependency security & health auditing for AI agents with no account or API key required.
Updated 2 months ago (2026-07-04 22:58 UTC)
2
2
MIT
vuln-intel-mcp
Security Penetration Testing
rohanrajnist
A
license
Not graded
quality
C
maintenance
Provides CVE lookup, search, and exploit intelligence from public vulnerability sources (NVD, CISA KEV, EPSS) for AI agents to produce remediation guidance without consuming LLM tokens for data fetching.
Updated 2 months ago (2026-07-06 06:18 UTC)
1
MIT
agentguard
Security Code Analysis AI & Machine Learning
shuaicongxiaomai
A
license
Not graded
quality
B
maintenance
Provides security checks for AI agents, including secret scanning, CVE lookup, and dependency vulnerability scanning, all running locally except for CVE lookups.
Updated 2 months ago (2026-07-02 10:56 UTC)
MIT
Fetter MCPofficial
Security Developer Tools CI/CD & DevOps
fetter-io
F
license
Not graded
quality
D
maintenance
Provides real-time Python package vulnerability data, enabling AI agents to check CVEs, CVSS scores, and safe versions for informed dependency decisions.
Updated 6 months ago (2026-02-26 22:38 UTC)
1
-