Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Details for one CVE or GHSA identifier, including whether CISA lists it as actively exploited (KEV) and its EPSS exploitation probability. Use to judge real-world urgency.
e.g. CVE-2024-3094 or GHSA-xxxx-xxxx-xxxx
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Details for one CVE or GHSA identifier, including whether CISA lists it as actively exploited (KEV) and its EPSS exploitation probability. Use to judge real-world urgency.
| Argument | Type | Description |
|---|---|---|
| id* | string | e.g. CVE-2024-3094 or GHSA-xxxx-xxxx-xxxx |
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "e.g. CVE-2024-3094 or GHSA-xxxx-xxxx-xxxx"
}
}
}Security assessment of one npm or PyPI package: letter grade, findings, known vulnerabilities, deprecation status, and — for MCP servers in our directory — the real resolved dependency count. Use before recommending or installing a package.
| Argument | Type | Description |
|---|---|---|
| name* | string | Exact package name |
| ecosystem* | string |
{
"type": "object",
"required": [
"name",
"ecosystem"
],
"properties": {
"name": {
"type": "string",
"maxLength": 214,
"description": "Exact package name"
},
"ecosystem": {
"enum": [
"npm",
"PyPI"
],
"type": "string"
}
}
}Recently published vulnerabilities from the tracked pool, ranked KEV-first then by EPSS. Use for "what should I worry about this week".
| Argument | Type | Description |
|---|---|---|
| limit | integer | |
| kev_only | boolean | |
| min_severity | string |
{
"type": "object",
"properties": {
"limit": {
"type": "integer",
"default": 10,
"maximum": 25,
"minimum": 1
},
"kev_only": {
"type": "boolean",
"default": false
},
"min_severity": {
"enum": [
"LOW",
"MEDIUM",
"HIGH",
"CRITICAL"
],
"type": "string"
}
}
}The MCP server directory with real resolved dependency counts. Use when recommending an MCP server, or to compare how much third-party code candidates pull into the agent. For a graded security assessment of one server, call check_package.
| Argument | Type | Description |
|---|---|---|
| sort_by | string | total_packages sorts heaviest first |
| understates_only | boolean | Only servers whose count understates real surface (mostly prebuilt binaries) |
{
"type": "object",
"properties": {
"sort_by": {
"enum": [
"total_packages",
"name"
],
"type": "string",
"default": "total_packages",
"description": "total_packages sorts heaviest first"
},
"understates_only": {
"type": "boolean",
"default": false,
"description": "Only servers whose count understates real surface (mostly prebuilt binaries)"
}
}
}