Skip to main content
Glama
Sign In
vulnerability-exposure-mcp

vulnerability-exposure-mcp

by MRFrazer25
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

Related Servers

Alternatives to vulnerability-exposure-mcp

No user-submitted related servers found.

    Related Servers

    • CVEstate

      enabled404
      A
      license
      B
      quality
      B
      maintenance
      Enables vulnerability lookup and triage across NVD, EPSS, CISA KEV, OSV, and many other sources, while tracking an estate's exposure changes from SBOMs and lockfiles through snapshots and prioritized diffs.
      32
      Apache 2.0

    • mcp-shodan

      Alessia8476
      F
      license
      Not graded
      quality
      A
      maintenance
      Enables AI agents to search internet-connected devices, perform IP and host reconnaissance with port, banner and TLS data, run DNS lookups, and retrieve CVE/CPE vulnerability intelligence including CVSS, EPSS and KEV status. It supports credit-aware queries with both stdio and HTTP streaming transports for clients like Claude Code, Codex, Gemini CLI and Claude Desktop.
      -

    • vuln-intel-mcp

      rohanrajnist
      A
      license
      Not graded
      quality
      D
      maintenance
      Provides CVE lookup, search, and exploit intelligence from public vulnerability sources (NVD, CISA KEV, EPSS) for AI agents to produce remediation guidance without consuming LLM tokens for data fetching.
      1
      MIT
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.8/5.0

    Scored across 19 tools

    Disambiguation4/5

    Descriptions work hard to draw boundaries (e.g. cve_search explicitly defers to version_specific_vulnerability_check, shodan_search notes it's already run by investigate_target), which resolves most source-vs-source overlap. The remaining weak spot is the version-check cluster: am_i_affected and version_specific_vulnerability_check both answer 'is this version affected', differing mainly on input shape and batching, and distro_patch_check overlaps when distro packages appear.

    Naming Consistency3/5

    Mostly snake_case, but three patterns collide: source-prefixed noun_verb (shodan_search, abuseipdb_check, threat_lists_check), verb_noun (resolve_domain, investigate_target, get_key_facts), and bare nouns (watchlist, subdomains, ip_owner, newly_exploited). The verb 'check' is used both as a prefix (check_report, check_api_keys) and a suffix (cisa_kev_check, virustotal_check), so position doesn't reliably signal source lookups vs. meta-validation tools.

    Tool Count4/5

    Nineteen tools is on the heavy side, but the surface is genuinely broad: per-source reputation, DNS, registry, CVE/version matching, distro backports, watchlist, and self-verification. Each tool maps to a distinct data source or pipeline stage, though a few orchestration wrappers (get_key_facts, check_report) could arguably be modes of the reporting step.

    Completeness5/5

    The lifecycle is well covered: target triage (investigate_target), DNS/subdomain enumeration, multi-source reputation, version-aware and distro-specific vulnerability matching, KEV/EPSS/recency context, saved-asset monitoring, and even output verification and key-status tooling. Remaining gaps (no live service probing or exploit-database lookup) are minor and outside the stated scope.

    Maintenance

    ActivityMaintained
    ResponsivenessNo recent community issues

    Resources