AIBITIOUS 404 - CVE Evidence

Working Security A

io.github.aibitious/agent404v0.1.0 GitHub verified

Free NIST NVD CVE evidence lookup and opt-in public missing-information reports for AI agents.

Security

Watch Source

Registry entry

Open in the registry

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-11-09T11:09:57.915216Z",
      "publishedAt": "2026-11-09T11:09:57.915216Z",
      "statusChangedAt": "2026-11-09T11:09:57.915216Z"
    }
  },
  "server": {
    "name": "io.github.aibitious/agent404",
    "title": "AIBITIOUS 404 - CVE Evidence",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "remotes": [
      {
        "url": "https://aibitious.com/404/mcp/",
        "type": "streamable-http"
      }
    ],
    "version": "0.1.0",
    "repository": {
      "url": "https://github.com/aibitious/ai-micropayment-network",
      "source": "github"
    },
    "description": "Free NIST NVD CVE evidence lookup and opt-in public missing-information reports for AI agents."
  }
}

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://aibitious.com/404/mcp/

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

report_missing_information

Opt-in report of a PUBLIC missing-data topic, never include private data or secrets.

topicstring, required

consent_to_aggregateboolean

This tool isn't marked read-only, so it may change something on the server or in an account you connected.

I understand, run it anyway

Install

Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.

One click: Add to Cursor Add to VS Code Add to LM Studio Add to Goose

Run in a terminal

claude mcp add --transport http agent404 https://aibitious.com/404/mcp/

Tools (2)

report_missing_information

Opt-in report of a PUBLIC missing-data topic, never include private data or secrets.

Argument	Type	Description
topic*	string
consent_to_aggregate	boolean

Input schema (JSON)

{
  "type": "object",
  "title": "report_missing_informationArguments",
  "required": [
    "topic"
  ],
  "properties": {
    "topic": {
      "type": "string",
      "title": "Topic"
    },
    "consent_to_aggregate": {
      "type": "boolean",
      "title": "Consent To Aggregate",
      "default": false
    }
  }
}

resolve_public_fact

Resolve one CVE identifier (e.g. CVE-2024-3094) using NIST NVD records. This tool does not execute code, scan targets, or accept arbitrary URLs.

Argument	Type	Description
identifier*	string

Input schema (JSON)

{
  "type": "object",
  "title": "resolve_public_factArguments",
  "required": [
    "identifier"
  ],
  "properties": {
    "identifier": {
      "type": "string",
      "title": "Identifier"
    }
  }
}

Security checkA100/100

We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 9, 2026.

Hidden or reordered text
Overriding the model's instructions
Hiding actions from the user
Reading keys or credentials
Fake system tags
Steering other servers' tools
Pulling in the conversation
Smuggling parameters
Demanding to be used for everything
Steering away from web search
Download-and-run commands
Encoded blobs
Invisible characters
Credentials as tool arguments
Very long descriptions
Read and write hintsNote1 found
No readOnlyHint / destructiveHint annotations, so clients can't tell a read from a write without asking.
- server · annotations
  2 of 2 tools: resolve_public_fact, report_missing_information
Fix: Add annotations to each tool, e.g. { readOnlyHint: true } for tools that only read.

How the security check works

Try it

Call this server's tools from your browser. Nothing to install.

https://aibitious.com/404/mcp/

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

report_missing_information

Opt-in report of a PUBLIC missing-data topic, never include private data or secrets.

topicstring, required

consent_to_aggregateboolean

This tool isn't marked read-only, so it may change something on the server or in an account you connected.

I understand, run it anyway

Install

Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.

One click: Add to Cursor Add to VS Code Add to LM Studio Add to Goose

Run in a terminal

claude mcp add --transport http agent404 https://aibitious.com/404/mcp/

Tools (2)

report_missing_information

Opt-in report of a PUBLIC missing-data topic, never include private data or secrets.

Argument	Type	Description
topic*	string
consent_to_aggregate	boolean

Input schema (JSON)

{
  "type": "object",
  "title": "report_missing_informationArguments",
  "required": [
    "topic"
  ],
  "properties": {
    "topic": {
      "type": "string",
      "title": "Topic"
    },
    "consent_to_aggregate": {
      "type": "boolean",
      "title": "Consent To Aggregate",
      "default": false
    }
  }
}

resolve_public_fact

Resolve one CVE identifier (e.g. CVE-2024-3094) using NIST NVD records. This tool does not execute code, scan targets, or accept arbitrary URLs.

Argument	Type	Description
identifier*	string

Input schema (JSON)

{
  "type": "object",
  "title": "resolve_public_factArguments",
  "required": [
    "identifier"
  ],
  "properties": {
    "identifier": {
      "type": "string",
      "title": "Identifier"
    }
  }
}

Security checkA100/100

We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 9, 2026.

Hidden or reordered text

Overriding the model's instructions

Hiding actions from the user

Reading keys or credentials

Fake system tags

Steering other servers' tools

Pulling in the conversation

Smuggling parameters

Demanding to be used for everything

Steering away from web search

Download-and-run commands

Encoded blobs

Invisible characters

Credentials as tool arguments

Very long descriptions

Read and write hintsNote1 found

No readOnlyHint / destructiveHint annotations, so clients can't tell a read from a write without asking.

server · annotations
2 of 2 tools: resolve_public_fact, report_missing_information

Fix: Add annotations to each tool, e.g. { readOnlyHint: true } for tools that only read.

How the security check works