io.tooloracle/dora

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

DORAOracle — 15 tools for DORA Art.5-32: risk register, ICT incidents, TLPT, third-party.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "dora": {
      "url": "https://tooloracle.io/dora/mcp/",
      "transport": "streamable-http"
    }
  }
}

Measured tools (15)

• cve_search

  Search CVEs by keyword, vendor or product. Returns CVSS scores, attack vectors, DORA pillar mapping.

  Parameters:

  • days — integer — Published within last N days (default: 30)
  • limit — integer — Max results 1-20 (default: 10)
  • vendor — string — Vendor/product e.g. 'SAP', 'Cisco', 'Microsoft Exchange'
  • keyword — string — Search keyword e.g. 'authentication bypass', 'remote code execution'
  • severity — string — CVSS severity: CRITICAL, HIGH, MEDIUM, LOW

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• cve_latest

  Latest critical CVEs — daily DORA ICT risk briefing. Filter by severity and banking relevance.

  Parameters:

  • days — integer — Last N days (default: 7)
  • limit — integer — Max results 1-20 (default: 10)
  • severity — string — CRITICAL, HIGH, MEDIUM (default: CRITICAL)
  • banking_only — boolean — Filter to banking-relevant vendors only (default: false)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• kev_list

  CISA Known Exploited Vulnerabilities — actively exploited CVEs with patch deadlines. DORA Art. 9 patch compliance.

  Parameters:

  • days — integer — Added to KEV within last N days (default: 30)
  • limit — integer — Max results 1-50 (default: 15)
  • vendor — string — Filter by vendor e.g. 'Cisco', 'Microsoft', 'SAP'
  • overdue — boolean — Show only overdue patches (default: false)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• kev_check

  Check if a specific CVE is in CISA KEV (actively exploited in the wild). Returns DORA incident classification guidance.

  Parameters:

  • cve_id — string — CVE ID to check e.g. 'CVE-2021-44228' (Log4Shell)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• cert_advisories

  CERT-Bund security advisories — authoritative DE source for ICT threats. DORA Art. 17 threat monitoring.

  Parameters:

  • limit — integer — Max results 1-30 (default: 15)
  • keyword — string — Filter by keyword e.g. 'Windows', 'Apache', 'Cisco'

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• breach_check

  HaveIBeenPwned breach database — check domain/company breach exposure. DORA Art. 18 incident assessment.

  Parameters:

  • limit — integer — Max results 1-50 (default: 20)
  • domain — string — Company domain e.g. 'meinbank.de' (optional — omit for latest breaches)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• threat_actors

  Feodo Tracker: live C2 botnet servers (Emotet, QakBot, etc.). Actionable IP blocklist for DORA Art. 9.

  Parameters:

  • limit — integer — Max results 1-100 (default: 20)
  • status — string — Filter by status: online, offline
  • malware — string — Filter by malware family: Emotet, QakBot, Dridex, TrickBot

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• incident_timeline

  Generate a DORA Art. 19-aligned ICT incident reporting timeline with the regulatory deadline structure. Supports - does not constitute - compliant reporting.

  Parameters:

  • sector — string — Sector: banking, insurance, payment (default: banking)
  • incident_time — string — ISO timestamp of incident e.g. '2026-03-19T14:00:00Z' (default: now)
  • classification — string — Incident class: major, significant, minor (default: major)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• mitre_techniques

  MITRE ATT&CK techniques for DORA TLPT / TIBER-EU penetration testing. Maps to DORA Art. 26.

  Parameters:

  • limit — integer — Max results 1-20 (default: 10)
  • tactic — string — Filter by tactic: Initial Access, Lateral Movement, Impact, Persistence, etc.
  • keyword — string — Search keyword e.g. 'ransomware', 'phishing', 'credential'

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• tlpt_scenarios

  TIBER-EU threat scenarios for DORA resilience testing planning. Banking-specific attack simulations.

  Parameters:

  • focus — string — Focus area: swift, ransomware, insider, ddos, cloud (default: all)
  • sector — string — Sector: banking (default: banking)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• cloud_status

  Live status of AWS, GCP, Azure cloud providers. DORA Art. 28 third-party ICT risk monitoring.

  Parameters:

  • limit — integer — Max incidents per provider (default: 10)
  • provider — string — Provider: aws, gcp, azure, all (default: all)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• provider_risk

  DORA Art. 28 ICT third-party risk assessment: CVE history, news, GLEIF registration, contractual checklist.

  Parameters:

  • provider — string — Provider name e.g. 'SAP', 'Salesforce', 'AWS', 'Temenos'

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• dora_news

  EBA/DORA regulatory news for banks. Topics: general, eba, incident, third_party, testing, guidelines, bafin, swift.

  Parameters:

  • lang — string — Language: en or de (default: en)
  • limit — integer — Max articles 1-20 (default: 10)
  • topic — string — Topic: general, eba, incident, third_party, testing, guidelines, bafin, swift, fintech

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• dora_calendar

  DORA compliance milestones and upcoming deadlines for financial institutions. All Art. references included.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• health_check

  DORAOracle server status and all backend connectivity checks.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.