How do I use Vicarius vRx MCP Server?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Vicarius vRx MCP Server search for vulnerabilities with severity critical" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Vicarius vRx MCP Server

by Space-C0wboy

Overview Schema Source Related Servers Discussions Admin

Python

Remote

Vicarius vRx MCP Server

A Model Context Protocol server that exposes the Vicarius vRx External Data API (REST) to AI assistants. It provides 88 tools across 37 API domains — Vulnerabilities/CVEs, Endpoints (Assets), Patches & Updates, Publishers & Products, Tasks & Events, Automations & Scripts, Users, and more — plus a generic vrx_request escape hatch for anything not covered by a dedicated tool. The tool set is generated directly from the vRx OpenAPI specification, so it stays faithful to the real API surface, and the generated output is deterministic and committed.

IMPORTANT

Unofficial project. This is an independent, internally-built MCP server developed against Vicarius's published API documentation. It is not an official Vicarius product and is not affiliated with, endorsed by, or supported by Vicarius. "Vicarius" and "vRx" are trademarks of their respective owner. For official support of the vRx platform or the API itself, contact Vicarius directly.

WARNING

Beta software — not yet recommended for production. This project is under active development. The tool surface may still change between versions, and not every endpoint has been exercised against every tenant/entitlement configuration.

This server can perform destructive actions against your vRx tenant. Tools can delete assets and asset groups, create/update/delete users and invitations, modify automations and scan inputs, and update tasks. A hallucinated tool argument from your AI assistant could change your tenant configuration.

Recommended posture:

Run read-only first. Set VRX_READ_ONLY=true to register only read tools and make vrx_request reject any non-GET request. Lift it only when you need to write.
Use a vRx API key scoped to the minimum permissions your use case requires.
Review every mutating tool call before allowing execution. Claude Desktop requires tool-call approval by default — keep that enabled.
Treat the API key with the same care as portal admin credentials.
The HTTP transport binds to 127.0.0.1 by default. Do not expose it to the public internet without adding authentication.

Tools

88 tools across 37 API controllers (59 read + 29 mutating), plus the vrx_request escape hatch — 89 total in full mode, 60 in read-only mode (mutating tools are not registered when read-only). The table below groups the controllers into functional domains.

Domain	Read	Write	Notable tools
Vulnerabilities & CVEs	9	0	`vulnerability_search`, `vulnerability_count`, `endpoint_vulnerability_filter`, `organization_endpoint_vulnerabilities_search`, `vulnerability_attack_vectors_search_by_fields`, `vulnerability_links_search_by_fields`
Endpoints (Assets)	7	5	`endpoint_search`, `endpoint_attributes_search`, `organization_endpoint_group_search`, `aggregation_search_group`, `endpoint_delete`, `organization_endpoint_group_insert`
Patches & Updates	11	3	`patch_management_patch`, `patch_management_cve_info`, `organization_endpoint_patch_patch_packages_filter`, `org_endpoint_external_references_search`, `patch_package_search_by_fields`
Publishers, Products & OS	9	0	`organization_publisher_products_search`, `organization_endpoint_publisher_product_versions_search`, `organization_publisher_operating_systems_search`, `operating_system_family_search_by_fields`
Tasks & Events	10	7	`task_event_filter`, `task_endpoints_event_filter`, `incident_event_filter`, `task_update`, `task_template_insert`, `automation_task_templates_insert`
Automations & Scripts	9	9	`automation_search`, `automations_automations`, `script_template_search`, `organization_scan_input_search`, `automation_delete`, `organization_scan_input_update`
Users & Invitations	3	5	`user_search`, `user_invitation_search`, `user_invitation_insert`, `user_invitation_update`, `user_invitation_delete`
Utilities	1	0	`date_get_current_date`

See docs/ENDPOINTS.md for the full tool ↔ method ↔ path mapping (all 88 tools with their mutating flag).

Highlights:

Search tools (endpoint_search, vulnerability_search, organization_endpoint_group_search, …) accept an RSQL q filter plus from/size paging — see Querying.
Filter / count tools (*_filter, *_count) cover event streams (incident events, task events) and counts for dashboards.
Aggregation tools (aggregation_group, aggregation_search_group) power grouped/rollup queries (e.g. count of active CVEs grouped by vulnerability).
vrx_request escape hatch issues an arbitrary request against the API for any endpoint without a dedicated tool. In read-only mode it rejects every non-GET method.
Read-only safety is enforced at two layers — mutating tools are never registered in read-only mode, and vrx_request independently refuses mutations.

Related MCP server: VulnMCP

Quick start

Install

# with uv (recommended)
uv tool install vrx-mcp

# or with pip
pip install vrx-mcp

This installs the vrx-mcp console script. For development from source:

git clone https://github.com/Space-C0wboy/vicarius-vrx-mcp-server
cd vicarius-vrx-mcp-server
python -m venv .venv
.venv/Scripts/python -m pip install -e ".[dev]"   # Windows
# .venv/bin/python -m pip install -e ".[dev]"      # macOS/Linux

Getting an API key

In the vRx portal, go to Settings, select the api tag, then Create Integration.
Copy the generated API key — this is your VRX_API_KEY.
Your base URL is https://<your-dashboard>.vicarius.cloud/vicarius-external-data-api.

Requests authenticate with the vicarius-token header (the API key value); this server sets it for you on every request.

Configuration

Copy .env.example to .env and set:

Variable	Required	Default	Description
`VRX_API_KEY`	yes	—	Your vRx API key (Settings → api → Create Integration)
`VRX_BASE_URL`	yes	—	Full API base URL, e.g. `https://<dashboard>.vicarius.cloud/vicarius-external-data-api`. No default — the server fails fast if unset (no tenant is hardcoded)
`VRX_AUTH_HEADER`	no	`vicarius-token`	Header name carrying the API key
`VRX_READ_ONLY`	no	`false`	When true, no mutating tools are registered and `vrx_request` rejects non-GET requests
`VRX_TIMEOUT`	no	`60`	Request timeout in seconds
`LOG_LEVEL`	no	`INFO`	Logging level (logs go to stderr)
`MCP_HTTP_HOST` / `MCP_HTTP_PORT`	no	`127.0.0.1:8765`	HTTP transport bind

Run

stdio (default, for Claude Desktop/Code): vrx-mcp
HTTP: vrx-mcp --transport http --port 8765

Querying

vRx search endpoints use RSQL in the q query parameter:

Operator	Meaning	Example
`==`	equals	`endpointName=='HOST01'`
`=in=(a,b,c)`	in list	`endpointId=in=(101,102,103)`
`=re='regex'`	regex match	`vulnerabilityExternalReference.externalReferenceExternalId=re='.(cve-2024).'`
`>` / `<`	compare	`analyticsEventCreatedAtNano>1682913600000000000`

Pagination: every query takes from (offset) and size. size ≤ 500 per request and from ≤ 10,000. To page beyond offset 10,000, use seek paging: keep from=0, add a sort (e.g. -endpointId), and add a q comparison on the last value seen (e.g. q=endpointId<525236), repeating until the result is empty.

Response envelope: responses wrap results in a standard shape — serverResponseResult.serverResponseResultCode ("SUCCESS"), serverResponseCount (total matching records), and serverResponseObject (the array of records).

Rate limits: the API allows 60 queries / 60 seconds per organization scope and returns HTTP 429 with an X-Rate-Limit-Retry-After-Seconds header when exceeded. The client automatically retries 429s (and transient 5xx/network errors) with backoff, honoring that header.

Read-only mode

Set VRX_READ_ONLY=true to run the server safely against production. In this mode:

No mutating tools are registered — only the 59 read tools (+ vrx_request) are exposed.
vrx_request rejects any non-GET method, so it can only run read operations.

Read-only mode is strongly recommended for analyst-assistant, reporting, and dashboard use cases where the model should never change tenant state. The shipped .env.example defaults to read-only.

Editor integration

Claude Code

claude mcp add vrx \
  --env VRX_API_KEY=your-key-here \
  --env VRX_BASE_URL=https://your-dashboard.vicarius.cloud/vicarius-external-data-api \
  --env VRX_READ_ONLY=true \
  -- vrx-mcp

Claude Desktop

Edit claude_desktop_config.json:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "vrx": {
      "command": "vrx-mcp",
      "env": {
        "VRX_API_KEY": "your-key-here",
        "VRX_BASE_URL": "https://your-dashboard.vicarius.cloud/vicarius-external-data-api",
        "VRX_READ_ONLY": "true"
      }
    }
  }
}

Restart Claude Desktop, then confirm vrx appears in the tools menu.

Example prompts

"List the first 100 assets in vRx." → endpoint_search (from=0, size=100).
"Find the asset named HOST01." → endpoint_search (q=endpointName=='HOST01').
"Show me all Critical CVEs." → vulnerability_search (q=vulnerabilitySensitivityLevel.sensitivityLevelName=='Critical').
"Which assets are affected by CVE-2024-3094?" → vulnerability_search to resolve the CVE, then endpoint_search with a searchQuerys join body on OrganizationEndpointVulnerabilities.
"List endpoints with critical missing patches." → org_endpoint_external_references_search (q=...patchSensitivityLevel.sensitivityLevelName=='Critical').
"Get attack vectors and links for a vulnerability." → vulnerability_attack_vectors_search_by_fields / vulnerability_links_search_by_fields (q=vulnerabilityId==<id>).
"Show the recent event log." → incident_event_filter (sort + analyticsEventCreatedAtNano range).
"Count active CVEs grouped by vulnerability." → aggregation_search_group.
"Call an endpoint I don't have a tool for." → vrx_request (method, path, query, body).

How tools are generated

The tool modules are generated from the vRx OpenAPI specification:

python scripts/generate_from_openapi.py "Reference Material/api-docs.json"

This regenerates the modules under src/vrx_mcp/tools/_generated/ and the catalog at docs/ENDPOINTS.md. The generated files are not hand-edited — to change a tool, edit the generator (its OVERRIDES / MUTATING_OVERRIDES maps) and regenerate. Generation is deterministic, so re-running it produces a byte-identical, reviewable diff.

The OpenAPI spec and other vRx reference material live in the Reference Material/ directory, which is gitignored (vendor/customer-proprietary material, not redistributed).

Key generator behavior:

Operations are grouped by OpenAPI controller tag into one module per domain.
Redundant GET/POST search twins are collapsed to a single tool (the POST/body form).
Each operation is classified mutating (PUT/DELETE, or a non-search POST) or read (GET, or a search-style POST); mutating tools are hidden in read-only mode.

Development

.venv/Scripts/python -m pytest        # full suite (httpx fully mocked; no live calls)
.venv/Scripts/python -m ruff check .  # lint
.venv/Scripts/python scripts/generate_from_openapi.py "Reference Material/api-docs.json"  # regenerate

CI runs ruff + pytest on Python 3.10 / 3.11 / 3.12 (see .github/workflows/ci.yml).

Maintainers: see CONTRIBUTING.md for the release process.

License

MIT

Support

This is an unofficial, internal project. For vRx platform or API questions, contact Vicarius directly. For issues with this MCP server, open an issue on the GitHub repository.

Available Tools

89 tools

aggregation_groupC

aggregation · POST /aggregation/group — Group objects by stuff. Required: metricActionName, metricAnalyticsEventAction, q, from, size, group.

Inputs: metricActionName, metricAnalyticsEventAction, q, sort, +8 more.

aggregation_search_groupC

aggregation · POST /aggregation/searchGroup — Group objects by stuff. Required: objectName, q, from, size, group.

Inputs: objectName, q, sort, includeOriginalDoc, +12 more.

automation_deleteC

automation · DELETE /automation/delete — Disable instance of the object. Requires a JSON request body.

Inputs: body.

automation_insertC

automation · PUT /automation/insert — insert instance of the object Requires a JSON request body.

Inputs: body.

automations_automationsC

automations · GET /v1/automations — Returns list of automations

Inputs: from_, size, sort, dateFrom, +12 more.

automations_automations_1C

automations · POST /v1/automations — Inserts automation Requires a JSON request body.

Inputs: body.

automations_automations_2C

automations · GET /v1/automations/{id} — Returns automation by id Required: id.

Inputs: id (required).

automations_automations_3B

automations · PUT /v1/automations/{id} — Updates automation Required: id. Requires a JSON request body.

Inputs: id (required), body.

automation_searchC

automation · POST /automation/search — Returns events Required: q, from, size.

Inputs: q, sort, group, from_, +3 more.

automation_search_allC

automation · POST /automation/searchAll — Returns events Required: q, from, size.

Inputs: q, sort, group, from_, +3 more.

automation_search_by_fieldsC

automation · POST /automation/searchByFields — Get object by connection. Required: from, size, q.

Inputs: from_, size, enabled, addCount, +5 more.

automations_update_stateC

automations · PUT /v1/automations/{id}/updateState — Updates automation state Required: id. Requires a JSON request body.

Inputs: id (required), body.

automation_task_templates_delete_manyD

automation_task_templates · DELETE /automationTaskTemplates/deleteMany — Disable instance of the objects. Required: q. Requires a JSON request body.

Inputs: q, body.

automation_task_templates_insertC

automation_task_templates · PUT /automationTaskTemplates/insert — Insert instance of the object Requires a JSON request body.

Inputs: body.

automation_task_templates_insert_manyC

automation_task_templates · PUT /automationTaskTemplates/insertMany — Inserte instance of the object Requires a JSON request body.

Inputs: body.

automation_updateC

automation · POST /automation/update — Update instance of the object Requires a JSON request body.

Inputs: body.

date_get_current_dateA

date · GET /date/getCurrentDate — Get current date.

Inputs: no named parameters.

endpoint_attributes_searchC

endpoint_attributes · POST /endpointAttributes/search — Returns events Required: q, from, size.

Inputs: q, sort, group, from_, +3 more.

endpoint_attributes_search_by_fieldsC

endpoint_attributes · POST /endpointAttributes/searchByFields — Get object by connection. Required: from, size, q.

Inputs: from_, size, enabled, addCount, +5 more.

endpoint_deleteC

endpoint · DELETE /endpoint/delete — Disable instance of the object. Requires a JSON request body.

Inputs: body.

endpoint_delete_manyC

endpoint · DELETE /endpoint/deleteMany — Disable instance of the objects. Required: q. Requires a JSON request body.

Inputs: q, body.

endpoint_searchB

Search endpoints (assets). RSQL q filter, e.g. q=endpointName=='HOST01'. size<=500, from<=10000; use sort + seek paging beyond 10000. Required: q, from, size.

Inputs: q, sort, group, from_, +3 more.

endpoint_vulnerability_countC

Inputs: q, analyticsEventAction, searchQuerys.

endpoint_vulnerability_count_1D

Inputs: q, analyticsEventAction, body.

endpoint_vulnerability_filterA

Inputs: q, sort, analyticsEventAction, excludeFields, +6 more.

external_reference_external_references_search_by_fieldsC

external_reference_external_references · POST /externalReferenceExternalReferences/searchByFields — Get object by connection. Required: from, size, q.

Inputs: from_, size, enabled, addCount, +5 more.

external_reference_external_references_search_by_objectsC

external_reference_external_references · POST /externalReferenceExternalReferences/searchByObjects — Get object by connection. Required: from, size, q. Requires a JSON request body.

Inputs: enabled, from_, size, q, +1 more.

incident_event_countD

Inputs: q, analyticsEventAction, searchQuerys.

incident_event_count_1C

Inputs: q, analyticsEventAction, body.

incident_event_filterC

Inputs: q, sort, analyticsEventAction, excludeFields, +6 more.

operating_system_family_search_by_fieldsD

operating_system_family · POST /operatingSystemFamily/searchByFields — Get object by connection. Required: from, size, q.

Inputs: from_, size, enabled, addCount, +5 more.

organization_endpoint_group_deleteC

organization_endpoint_group · DELETE /organizationEndpointGroup/delete — Disable instance of the object. Requires a JSON request body.

Inputs: body.

organization_endpoint_group_insertC

organization_endpoint_group · PUT /organizationEndpointGroup/insert — insert instance of the object Requires a JSON request body.

Inputs: body.

organization_endpoint_group_searchC

organization_endpoint_group · POST /organizationEndpointGroup/search — Returns events Required: q, from, size.

Inputs: q, sort, group, from_, +3 more.

organization_endpoint_group_search_by_fieldsC

organization_endpoint_group · POST /organizationEndpointGroup/searchByFields — Get object by connection. Required: from, size, q.

Inputs: from_, size, enabled, addCount, +5 more.

organization_endpoint_group_updateC

organization_endpoint_group · POST /organizationEndpointGroup/update — Update instance of the object Requires a JSON request body.

Inputs: body.

organization_endpoint_patch_patch_packages_countD

Inputs: q, analyticsEventAction, searchQuerys.

organization_endpoint_patch_patch_packages_count_1C

Inputs: q, analyticsEventAction, body.

organization_endpoint_patch_patch_packages_filterD

Inputs: q, sort, analyticsEventAction, excludeFields, +6 more.

organization_endpoint_publisher_operating_systems_searchC

organization_endpoint_publisher_operating_systems · POST /organizationEndpointPublisherOperatingSystems/search — Returns events Required: q, from, size.

Inputs: q, sort, group, from_, +3 more.

organization_endpoint_publisher_product_versions_searchC

organization_endpoint_publisher_product_versions · POST /organizationEndpointPublisherProductVersions/search — Returns events Required: q, from, size.

Inputs: q, sort, group, from_, +3 more.

organization_endpoint_vulnerabilities_searchC

organization_endpoint_vulnerabilities · POST /organizationEndpointVulnerabilities/search — Returns events Required: q, from, size.

Inputs: q, sort, group, from_, +3 more.

organization_external_reference_source_settings_deleteC

organization_external_reference_source_settings · DELETE /organizationExternalReferenceSourceSettings/delete — Disable instance of the object. Requires a JSON request body.

Inputs: body.

organization_external_reference_source_settings_insertC

organization_external_reference_source_settings · PUT /organizationExternalReferenceSourceSettings/insert — insert instance of the object Requires a JSON request body.

Inputs: body.

organization_external_reference_source_settings_updateC

organization_external_reference_source_settings · POST /organizationExternalReferenceSourceSettings/update — Update instance of the object Requires a JSON request body.

Inputs: body.

organization_publisher_operating_systems_locate_object_positionC

organization_publisher_operating_systems · GET /organizationPublisherOperatingSystems/locateObjectPosition — Returns events Required: q, positionQuery.

Inputs: q, positionQuery, sort.

organization_publisher_operating_systems_searchC

organization_publisher_operating_systems · POST /organizationPublisherOperatingSystems/search — Returns events Required: q, from, size.

Inputs: q, sort, group, from_, +3 more.

organization_publisher_products_locate_object_positionD

organization_publisher_products · GET /organizationPublisherProducts/locateObjectPosition — Returns events Required: q, positionQuery.

Inputs: q, positionQuery, sort.

organization_publisher_products_searchC

organization_publisher_products · POST /organizationPublisherProducts/search — Returns events Required: q, from, size.

Inputs: q, sort, group, from_, +3 more.

organization_scan_input_insert_and_uploadC

organization_scan_input · PUT /organizationScanInput/insertAndUpload — Inserts object and stores its file Required: q.

Inputs: q, body.

organization_scan_input_redirectC

organization_scan_input · GET /organizationScanInput/redirect — Redirect to static file by id. Required: id.

Inputs: id, preformExternalRedirect.

organization_scan_input_searchC

organization_scan_input · POST /organizationScanInput/search — Returns events Required: q, from, size.

Inputs: q, sort, group, from_, +3 more.

organization_scan_input_updateC

organization_scan_input · POST /organizationScanInput/update — Update instance of the object Requires a JSON request body.

Inputs: body.

organization_scan_input_uploadC

organization_scan_input · PUT /organizationScanInput/upload — Stores events Requires a JSON request body.

Inputs: body.

org_endpoint_external_references_searchC

organization_endpoint_external_reference_external_references · POST /organizationEndpointExternalReferenceExternalReferences/search — Returns events Required: q, from, size.

Inputs: q, sort, group, from_, +3 more.

org_endpoint_publisher_os_locate_positionD

organization_endpoint_publisher_operating_systems · GET /organizationEndpointPublisherOperatingSystems/locateObjectPosition — Returns events Required: q, positionQuery.

Inputs: q, positionQuery, sort.

patch_management_cve_infoB

patch_management · GET /patchManagement/patch/{patchId}/cveInfo — Returns CVE info for a specific patch Required: patchId, source. Allowed values: source=XPATCH|VICARIUS.

Inputs: patchId (required), source, from_, size, +3 more.

patch_management_patchC

patch_management · GET /patchManagement/patch — Returns list of patches Required: searchQueries, softwareType. Allowed values: softwareType=APP|OS.

Inputs: q, searchQueries, from_, size, +3 more.

patch_management_patch_1B

patch_management · POST /patchManagement/patch — Returns list of patches Required: softwareType. Allowed values: softwareType=APP|OS.

Inputs: q, from_, size, patchIds, +3 more.

patch_package_links_search_by_fieldsC

patch_package_links · POST /patchPackageLinks/searchByFields — Get object by connection. Required: from, size, q.

Inputs: from_, size, enabled, addCount, +5 more.

patch_package_search_by_fieldsC

patch_package · POST /patchPackage/searchByFields — Get object by connection. Required: from, size, q.

Inputs: from_, size, enabled, addCount, +5 more.

publisher_product_photos_redirect_to_publisher_product_photoB

Inputs: productId, publisherId, photoType, httpStatus, +1 more.

script_template_commands_search_by_fieldsC

script_template_commands · POST /scriptTemplateCommands/searchByFields — Get object by connection. Required: from, size, q.

Inputs: from_, size, enabled, addCount, +5 more.

script_template_searchC

script_template · POST /scriptTemplate/search — Returns events Required: q, from, size.

Inputs: q, sort, group, from_, +3 more.

task_endpoints_event_countC

Inputs: q, analyticsEventAction, searchQuerys.

task_endpoints_event_count_1D

Inputs: q, analyticsEventAction, body.

task_endpoints_event_filterC

Inputs: q, sort, analyticsEventAction, excludeFields, +6 more.

task_endpoints_event_task_typesB

task_endpoints_event · GET /taskEndpointsEvent/taskTypes — Returns a list of task types

Inputs: no named parameters.

task_event_countD

Inputs: q, analyticsEventAction, searchQuerys.

task_event_count_1D

Inputs: q, analyticsEventAction, body.

task_event_filterC

Inputs: q, sort, analyticsEventAction, excludeFields, +6 more.

task_template_insertC

task_template · PUT /taskTemplate/insert — Insert instance of the object Requires a JSON request body.

Inputs: body.

task_template_insert_manyC

task_template · PUT /taskTemplate/insertMany — Inserte instance of the object Requires a JSON request body.

Inputs: body.

task_template_updateC

task_template · POST /taskTemplate/update — Update instance of the object Requires a JSON request body.

Inputs: body.

task_updateC

task · POST /task/update — Update instance of the object Requires a JSON request body.

Inputs: body.

user_invitation_deleteB

user_invitation · DELETE /userInvitation/delete — Disable instance of the object. Requires a JSON request body.

Inputs: body.

user_invitation_insertC

user_invitation · PUT /userInvitation/insert — insert instance of the object Requires a JSON request body.

Inputs: body.

user_invitation_insert_manyC

user_invitation · PUT /userInvitation/insertMany — Insert instance of the object Requires a JSON request body.

Inputs: body.

user_invitation_resendC

user_invitation · POST /userInvitation/resend — Resend invitation Requires a JSON request body.

Inputs: body.

user_invitation_searchC

user_invitation · POST /userInvitation/search — Returns events Required: q, from, size.

Inputs: q, sort, group, from_, +3 more.

user_invitation_search_by_fieldsD

user_invitation · POST /userInvitation/searchByFields — Get object by connection. Required: from, size, q.

Inputs: from_, size, enabled, addCount, +5 more.

user_invitation_updateC

user_invitation · POST /userInvitation/update — Update instance of the object Requires a JSON request body.

Inputs: body.

user_searchD

user · POST /user/search — Returns events Required: q, from, size.

Inputs: q, sort, group, from_, +3 more.

vrx_requestA

Issue an arbitrary request to the Vicarius vRx External Data API for endpoints without a dedicated tool. path is relative to the API base (e.g. '/endpoint/search'). Search uses RSQL in the q query param: == (equals), =in=(a,b) (in-list), =re='regex' (regex), > / < (compare). Pagination: size <= 500, from (offset) <= 10000; beyond 10000 use seek paging (sort + a q comparison on the last value). In read-only mode only GET is permitted.

Inputs: method (required), path (required), query, body.

vulnerability_attack_vectors_search_by_fieldsD

vulnerability_attack_vectors · POST /vulnerabilityAttackVectors/searchByFields — Get object by connection. Required: from, size, q.

Inputs: from_, size, enabled, addCount, +5 more.

vulnerability_countC

vulnerability · GET /vulnerability/count — Count objects by stuff. Required: q, searchQuerys.

Inputs: q, enabled, searchQuerys.

vulnerability_internal_tags_search_by_fieldsC

vulnerability_internal_tags · POST /vulnerabilityInternalTags/searchByFields — Get object by connection. Required: from, size, q.

Inputs: from_, size, enabled, addCount, +5 more.

vulnerability_links_search_by_fieldsD

vulnerability_links · POST /vulnerabilityLinks/searchByFields — Get object by connection. Required: from, size, q.

Inputs: from_, size, enabled, addCount, +5 more.

vulnerability_searchA

Search vulnerabilities/CVEs. RSQL q filter, e.g. q=vulnerabilitySensitivityLevel.sensitivityLevelName=='Critical'. size<=500, from<=10000. Required: q, from, size.

Inputs: q, sort, group, from_, +3 more.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

D1.9/5.0

Scored 2026-06-24 16:40 across 89 tools

Disambiguation2/5

Multiple tools have nearly identical descriptions (e.g., 'Groups objects by stuff'), and many share the same actions (count, search, filter) across different entities with little distinction. The presence of GET and POST variants for count tools and numbered suffixes (e.g., _1, _2) adds confusion.

Naming Consistency2/5

Tool names mix inconsistent patterns: long underscore-separated paths, version numbers (e.g., automations_automations_1), and generic verbs (search, count, filter) without a clear consistent structure. Some names include HTTP methods or API details, making them unwieldy.

Tool Count1/5

89 tools is excessive for a single MCP server. This suggests an overly fine-grained API surface that would overwhelm agents. Many tools are redundant or too narrow, and the count far exceeds typical well-scoped servers (3-15 tools).

Completeness2/5

While many entities are covered, there are significant gaps: limited create/update/delete operations for core resources, and the inclusion of a generic 'vrx_request' tool indicates the set is incomplete. Descriptions like 'Get object by connection' are vague, and many CRUD operations are missing.

Maintenance

ActivityMaintained

ResponsivenessNo recent community issues

Resources

Related MCP Connectors

OneSchema MCP Server
co.oneschema
MCP server that lets AI assistants use all OneSchema features exposed via the public API.
Data Platforms App Automation
1
https://api.oneschema.co/mcp
Excession Labs: CVE intelligence and security researchA
ai.excessionlabs
The main MCP server has 10 tools, including six public, read-only CVE tools, site search and page reading. CVE results include source software/version evidence and available CISA KEV and dated FIRST EPSS data. The separate request_security_test action requires an agent key, consent and authorization. A no-account, read-only CVE-only endpoint is https://excessionlabs.ai/mcp/cve. Docs: https://excessionlabs.ai/cve-intelligence/.
Penetration Testing Search
101
https://excessionlabs.ai/mcp
Unified.to MCP ServerB
to.unified.docs
Unified MCP Server is a remote MCP connector for AI agents and vertical AI products that provides access to 22,000+ authorized SaaS tools across 400+ integrations and 24 categories directly inside LLMs (Claude, GPT, Gemini, Cohere). Tools operate only on explicitly authorized customer connections, enabling agents to safely read and write against live third-party systems.
App Automation Agent Orchestration Developer Tools
362
https://mcp-api.unified.to/mcp
jumpcloud-genai
com.jumpcloud
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
Cloud Platforms Security Developer Tools
2
https://mcp.jumpcloud.com/v1

Related MCP Servers

Integrations MCP
App Automation Developer Tools
Shriram-Vasudevan
F
license
Not graded
quality
D
maintenance
A comprehensive MCP server providing over 390 tools across 66 providers, including major SaaS platforms like GitHub, Slack, and Stripe. It enables AI assistants to interact directly with a wide array of public APIs and utility services through a single interface.
Updated 8 months ago (2026-03-20 04:28 UTC)
-
VulnMCP
Security AI & Machine Learning Search
vulnerability-lookup
A
license
A
quality
B
maintenance
An MCP server for vulnerability management that provides tools for automated severity and CWE classification using NLP models. It enables AI agents to query the Vulnerability Lookup API for detailed CVE information and search for security vulnerabilities across various sources.
Updated 8 days ago (2026-11-05 13:20 UTC)
16
43
AGPL 3.0
OpenAPI MCP Bridge
API Testing Developer Tools
samuellawrence
A
license
Not graded
quality
C
maintenance
A generic MCP server that converts any OpenAPI/Swagger specification into MCP tools, enabling AI assistants to search, explore, and execute REST APIs.
Updated 8 days ago (2026-11-06 02:50 UTC)
MIT
Enterprise MCP Server
File Systems Databases Version Control
Walkaroo-Dev
F
license
Not graded
quality
D
maintenance
A single MCP server that exposes safe, permission-checked tools for AI assistants to reach file systems, databases, APIs, Git, cloud services, and business applications.
Updated 4 months ago (2026-07-11 12:20 UTC)
-

Vicarius vRx MCP Server

Tools

Quick start

Install

Getting an API key

Configuration

Run

Querying

Read-only mode

Editor integration

Claude Code

Claude Desktop

Example prompts

How tools are generated

Development

License

Support

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

Integrations MCP

VulnMCP

OpenAPI MCP Bridge

Enterprise MCP Server