io.tooloracle/cybershield

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

CyberShield - 12 cybersecurity tools: NIS2 mapping, MITRE ATT&CK, vulns, threat intel.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "cybershield": {
      "url": "https://tooloracle.io/cybershield/mcp/",
      "transport": "streamable-http"
    }
  }
}

Measured tools (12)

• threat_landscape

  Current cyber threat landscape overview per ENISA categories. Top 8 threats with sector relevance and mitigations.

  Parameters:

  • sector — string — energy|finance|healthcare|manufacturing|public_admin|general

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• cve_risk_score

  CVE risk prioritization combining CVSS, EPSS, KEV catalog, exploit availability. Returns weighted priority score with patching SLA.

  Parameters:

  • cve_id — string
  • cvss_score — number
  • epss_score — number — 0-1 EPSS probability
  • in_kev_catalog — boolean
  • public_exploit — boolean
  • internet_facing — boolean
  • affected_systems — integer

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• attack_surface_check

  Attack surface assessment checklist. Web apps, remote access, cloud, IoT, email. Prioritized security checks.

  Parameters:

  • iot_devices — boolean
  • cloud_services — boolean
  • employee_count — integer
  • web_applications — boolean
  • remote_access_vpn — boolean

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• phishing_indicators

  Analyze email/URL for phishing indicators. Scores sender, urgency, attachments, URL patterns. Returns verdict and recommended actions.

  Parameters:

  • subject — string
  • sender_email — string
  • suspicious_url — string
  • creates_urgency — boolean
  • asks_for_credentials — boolean
  • has_unexpected_attachment — boolean

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• nis2_compliance

  NIS2 Directive (EU 2022/2555) compliance assessment. All 10 Art. 21 measures, entity classification, penalties, incident reporting.

  Parameters:

  • sector — string
  • mfa_deployed — boolean
  • access_control — boolean
  • employee_count — integer
  • risk_management — boolean
  • incident_handling — boolean
  • business_continuity — boolean
  • cryptography_policy — boolean
  • annual_turnover_meur — number
  • supply_chain_security — boolean
  • cyber_hygiene_training — boolean
  • vulnerability_management — boolean
  • incident_reporting_process — boolean

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• nis2_incident_report

  NIS2 incident notification template. 24h early warning, 72h notification, 1-month final report templates.

  Parameters:

  • severity — string
  • incident_type — string
  • affected_services — string
  • cross_border_impact — boolean
  • affected_users_estimate — integer

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• iso27001_gap

  ISO 27001:2022 Annex A gap analysis. All 93 controls across 4 themes, new 2022 controls highlighted, certification process.

  Parameters:

  • controls — object — Optional: status of specific controls

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• dora_ict_risk

  DORA Art. 5-12 ICT risk management compliance check. 8 articles assessed with specific requirements per article.

  Parameters:

  • learning_evolving — boolean
  • response_recovery — boolean
  • detection_measures — boolean
  • ict_risk_framework — boolean
  • communication_plans — boolean
  • ict_asset_inventory — boolean
  • protection_prevention — boolean

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• password_policy

  Generate password policy per NIST SP 800-63B (2024) and BSI recommendations. Modern best practices — no forced rotation.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• incident_playbook

  Incident response playbook for ransomware, data breach, phishing compromise. Phase-by-phase actions with legal obligations.

  Parameters:

  • incident_type — string — ransomware | data_breach | phishing_compromise

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• risk_matrix

  Risk assessment matrix (likelihood × impact). ISO 31000/27005 methodology. Provide risks for assessment or get template.

  Parameters:

  • risks — string — JSON array [{name, likelihood(1-5), impact(1-5)}]

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• security_metrics

  Security KPI/metrics dashboard template. MTTD, MTTR, patch compliance, phishing rate. Board-ready reporting guidance.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.