Vulnerability intel (vu1nz.com)
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Look up the vu1nz subscription status for a GitHub org. Bootstraps a 14-day free trial on first call. Returns ok, status (trialing/active/past_due/cancelled/exempt), days remaining, license_key, and upgrade URL.
GitHub org login (e.g. 'acme-corp').
Optional existing license_key for sanity check.
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.
Run in a terminal
claude mcp add --transport http vu1nz https://vu1nz.com/api/mcp
Look up the vu1nz subscription status for a GitHub org. Bootstraps a 14-day free trial on first call. Returns ok, status (trialing/active/past_due/cancelled/exempt), days remaining, license_key, and upgrade URL.
| Argument | Type | Description |
|---|---|---|
| github_org* | string | GitHub org login (e.g. 'acme-corp'). |
| license_key | string | Optional existing license_key for sanity check. |
{
"type": "object",
"required": [
"github_org"
],
"properties": {
"github_org": {
"type": "string",
"description": "GitHub org login (e.g. 'acme-corp')."
},
"license_key": {
"type": "string",
"description": "Optional existing license_key for sanity check."
}
}
}Add a webhook endpoint (public https URL). Returns the endpoint and its signing secret (shown once). Needs an API key.
| Argument | Type | Description |
|---|---|---|
| url* | string | https URL that receives signed CloudEvents. |
| events | array | Patterns: '*', 'scan.completed', 'scan.failed', 'scan.*'. Default all. |
| description | string |
{
"type": "object",
"required": [
"url"
],
"properties": {
"url": {
"type": "string",
"description": "https URL that receives signed CloudEvents."
},
"events": {
"type": "array",
"items": {
"type": "string"
},
"description": "Patterns: '*', 'scan.completed', 'scan.failed', 'scan.*'. Default all."
},
"description": {
"type": "string"
}
}
}Remove one of your webhook endpoints by id. Needs an API key.
| Argument | Type | Description |
|---|---|---|
| id* | string |
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string"
}
}
}Full content of a vu1nz blog post by slug.
| Argument | Type | Description |
|---|---|---|
| slug* | string | Blog post slug (e.g. 'what-dependabot-misses'). |
{
"type": "object",
"required": [
"slug"
],
"properties": {
"slug": {
"type": "string",
"description": "Blog post slug (e.g. 'what-dependabot-misses')."
}
}
}vu1nz-published security advisories with date, severity, and summary.
No arguments.
{
"type": "object",
"properties": {}
}All vu1nz blog posts: supply-chain analysis, release notes, security research. Returns slug, title, date, tags, summary, and URL.
No arguments.
{
"type": "object",
"properties": {}
}The catalog of CI/CD security checks vu1nz runs, each mapped to a CWE. Use to explain to a user what vu1nz would catch on their PRs.
No arguments.
{
"type": "object",
"properties": {}
}List your vu1nz webhook endpoints and the event types vu1nz emits (scan.completed, scan.failed). Needs an API key.
No arguments.
{
"type": "object",
"properties": {}
}Run vu1nz's 6 deterministic CI/CD security checks against any public GitHub repository's workflow files. Returns findings with severity, file, line, CWE, and recommendation.
| Argument | Type | Description |
|---|---|---|
| repo* | string | GitHub repo in 'owner/repo' format (or a full github.com URL). |
{
"type": "object",
"required": [
"repo"
],
"properties": {
"repo": {
"type": "string",
"description": "GitHub repo in 'owner/repo' format (or a full github.com URL)."
}
}
}Send a webhook.test event to one of your endpoints now and report the result. Needs an API key.
| Argument | Type | Description |
|---|---|---|
| id* | string |
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string"
}
}
}Recent malicious packages caught in the wild across npm, pip, cargo, rubygems. Sourced from OSV.dev with a curated fallback list (Shai-Hulud, Polyfill.io, ctx, ua-parser-js, etc.).
| Argument | Type | Description |
|---|---|---|
| limit | number | Max entries to return (1-50, default 25). |
{
"type": "object",
"properties": {
"limit": {
"type": "number",
"default": 25,
"description": "Max entries to return (1-50, default 25)."
}
}
}Recent webhook deliveries (status, attempts, last HTTP status), optionally for one endpoint. Needs an API key.
| Argument | Type | Description |
|---|---|---|
| limit | number | |
| endpoint_id | string |
{
"type": "object",
"properties": {
"limit": {
"type": "number",
"default": 20
},
"endpoint_id": {
"type": "string"
}
}
}We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 11, 2026.
No readOnlyHint / destructiveHint annotations, so clients can't tell a read from a write without asking.
Fix: Add annotations to each tool, e.g. { readOnlyHint: true } for tools that only read.