io.github.megabrainee/sectora

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "sectora": {
      "url": "https://mcp.sectora.io/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (14)

• lookup_cve

  Get full threat intelligence enrichment for a CVE including EPSS score, CISA KEV status, public exploits, Nuclei templates, risk level, and risk factors. Input must be a valid CVE ID.

  Parameters:

  • cve_id (required) — string — CVE identifier in format CVE-YYYY-NNNNN (e.g., CVE-2024-3400)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• assess_tech_risk

  Assess security risk for a list of technologies. Returns known CVEs affecting each technology with severity breakdown. Input: comma-separated technology names only.

  Parameters:

  • technologies (required) — string — Comma-separated list of technology names (e.g., "Apache HTTP Server, OpenSSL, nginx"). Max 50 technologies.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• search_cves

  Search for CVEs by keyword, severity, or other filters. Query must be alphanumeric text.

  Parameters:

  • query (required) — string — Search keyword (CVE ID, technology name, or description)
  • is_kev — string — Only show CVEs in CISA KEV catalog
  • severity — string — Filter by severity
  • has_exploit — string — Only show CVEs with public exploits

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_kev_recent

  Get recently added entries to the CISA Known Exploited Vulnerabilities (KEV) catalog.

  Parameters:

  • days — string — Number of days to look back (1-365, default: 30)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_trending_cves

  Get currently trending CVEs based on recent KEV additions, high EPSS scores, and exploit availability.

  Parameters:

  • limit — string — Maximum results to return (1-100, default: 20)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_weaponization_score

  Get the weaponization score (0-100) for a CVE. Factors in EPSS, KEV status, exploit availability, Nuclei templates, and CVSS. Input must be a valid CVE ID.

  Parameters:

  • cve_id (required) — string — CVE identifier in format CVE-YYYY-NNNNN (e.g., CVE-2024-3400)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• lookup_ip_reputation

  Look up community IP reputation from Sectora Shield WAF network. Shows if an IP has been reported for attacks. Accepts IPv4 or IPv6 (the Shield network sees both).

  Parameters:

  • ip (required) — string — IPv4 (e.g., 1.2.3.4) or IPv6 (e.g., 2606:4700::1) address to look up

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_threat_stats

  Get statistics about the Sectora threat intelligence database including counts of EPSS scores, KEV entries, Nuclei templates, and exploits. No input required.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_my_findings

  List the API key owner's open security findings across all scans. Use this to answer "what's my current exposure?" Filter by severity, status, or domain. Returns finding summaries; call get_scan for full detail. Requires API key.

  Parameters:

  • limit — string — Max findings (1-100, default: 25)
  • domain — string — Limit to a single domain (e.g., app.example.com)
  • status — string — Filter by confirmation status
  • severity — string — Comma-separated severities to include: critical, high, medium, low, info

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_my_scans

  List the API key owner's recent scans with summary counts. Requires API key.

  Parameters:

  • limit — string — Max scans (1-100, default: 25)
  • status — string — Filter by status (queued, running, completed, failed)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_scan

  Get a scan with all its findings (full detail: title, description, evidence, remediation, CVSS). Requires API key.

  Parameters:

  • scan_id (required) — string — Scan UUID

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• scan_url

  Kick off a DAST security scan against a public URL the API key owner controls. Two-step flow: first call returns a preview (target, profile, ETA, quota remaining); confirm by calling again with confirm:true to actually start the scan. Returns scan_id; poll status with get_scan. Domain must be verified in the Sectora account. Daily quota: 25 scans/24h per user, plus the plan's monthly scan limit. Requires an API key with the scans:create scope.

  Parameters:

  • url (required) — string — Full URL to scan (must start with http:// or https://)
  • confirm — string — Set to "true" to actually execute the scan. Without this, the call returns a preview only.
  • profile — string — Scan profile: quick (~2 min), standard (~10 min), deep (~30 min)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_my_posture

  Get Shield WAF posture score and breakdown for a domain registered under this account. Returns 0-100 score, letter grade, per-component breakdown (origin lock, virtual patching, TLS, etc.), and edge_health (whether Shield is actually intercepting traffic). Requires API key.

  Parameters:

  • domain (required) — string — Domain registered under your Sectora account

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• assess_dependency

  Check a single package@version for known vulnerabilities via OSV.dev (npm, PyPI, Go, Maven, NuGet, RubyGems, Packagist, crates.io, etc.). Returns advisories with CVE IDs, severity, fixed versions, and references. Free tier eligible.

  Parameters:

  • name (required) — string — Package name (e.g., "lodash", "django", "github.com/gorilla/mux")
  • version (required) — string — Exact version (e.g., "4.17.20")
  • ecosystem (required) — string — Package ecosystem: npm, PyPI, Go, Maven, NuGet, RubyGems, Packagist, crates.io

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

Publisher website Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.