Servers Playground How we check Add a server Log in

Dora

Down since Oct 25

io.tooloracle/dorav1.0.0 Domain verified

DORAOracle — 15 tools for DORA Art.5-32: risk register, ICT incidents, TLPT, third-party.

Legal & Government Security

Source Registry entry

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://tooloracle.io/dora/mcp/

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

breach_check

HaveIBeenPwned breach database — check domain/company breach exposure. DORA Art. 18 incident assessment.

limitinteger

Max results 1-50 (default: 20)

domainstring

Company domain e.g. 'meinbank.de' (optional — omit for latest breaches)

This tool isn't marked read-only, so it may change something on the server or in an account you connected.

I understand, run it anyway

Dora MCP server | mcptry

Tools (15)

breach_check

HaveIBeenPwned breach database — check domain/company breach exposure. DORA Art. 18 incident assessment.

Argument	Type	Description
limit	integer	Max results 1-50 (default: 20)
domain	string	Company domain e.g. 'meinbank.de' (optional — omit for latest breaches)

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "default": 20,
      "maximum": 50,
      "minimum": 1,
      "description": "Max results 1-50 (default: 20)"
    },
    "domain": {
      "type": "string",
      "description": "Company domain e.g. 'meinbank.de' (optional — omit for latest breaches)"
    }
  },
  "additionalProperties": false
}

cert_advisories

CERT-Bund security advisories — authoritative DE source for ICT threats. DORA Art. 17 threat monitoring.

Argument	Type	Description
limit	integer	Max results 1-30 (default: 15)
keyword	string	Filter by keyword e.g. 'Windows', 'Apache', 'Cisco'

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "default": 15,
      "maximum": 30,
      "minimum": 1,
      "description": "Max results 1-30 (default: 15)"
    },
    "keyword": {
      "type": "string",
      "description": "Filter by keyword e.g. 'Windows', 'Apache', 'Cisco'"
    }
  },
  "additionalProperties": false
}

cloud_status

Live status of AWS, GCP, Azure cloud providers. DORA Art. 28 third-party ICT risk monitoring.

Argument	Type	Description
limit	integer	Max incidents per provider (default: 10)
provider	string	Provider: aws, gcp, azure, all (default: all)

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "default": 10,
      "description": "Max incidents per provider (default: 10)"
    },
    "provider": {
      "type": "string",
      "description": "Provider: aws, gcp, azure, all (default: all)"
    }
  },
  "additionalProperties": false
}

cve_latest

Latest critical CVEs — daily DORA ICT risk briefing. Filter by severity and banking relevance.

Argument	Type	Description
days	integer	Last N days (default: 7)
limit	integer	Max results 1-20 (default: 10)
severity	string	CRITICAL, HIGH, MEDIUM (default: CRITICAL)
banking_only	boolean	Filter to banking-relevant vendors only (default: false)

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "days": {
      "type": "integer",
      "default": 7,
      "description": "Last N days (default: 7)"
    },
    "limit": {
      "type": "integer",
      "default": 10,
      "maximum": 20,
      "minimum": 1,
      "description": "Max results 1-20 (default: 10)"
    },
    "severity": {
      "type": "string",
      "description": "CRITICAL, HIGH, MEDIUM (default: CRITICAL)"
    },
    "banking_only": {
      "type": "boolean",
      "description": "Filter to banking-relevant vendors only (default: false)"
    }
  },
  "additionalProperties": false
}

cve_search

Search CVEs by keyword, vendor or product. Returns CVSS scores, attack vectors, DORA pillar mapping.

Argument	Type	Description
days	integer	Published within last N days (default: 30)
limit	integer	Max results 1-20 (default: 10)
vendor	string	Vendor/product e.g. 'SAP', 'Cisco', 'Microsoft Exchange'
keyword	string	Search keyword e.g. 'authentication bypass', 'remote code execution'
severity	string	CVSS severity: CRITICAL, HIGH, MEDIUM, LOW

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "days": {
      "type": "integer",
      "default": 30,
      "description": "Published within last N days (default: 30)"
    },
    "limit": {
      "type": "integer",
      "default": 10,
      "maximum": 20,
      "minimum": 1,
      "description": "Max results 1-20 (default: 10)"
    },
    "vendor": {
      "type": "string",
      "description": "Vendor/product e.g. 'SAP', 'Cisco', 'Microsoft Exchange'"
    },
    "keyword": {
      "type": "string",
      "description": "Search keyword e.g. 'authentication bypass', 'remote code execution'"
    },
    "severity": {
      "enum": [
        "CRITICAL",
        "HIGH",
        "MEDIUM",
        "LOW"
      ],
      "type": "string",
      "description": "CVSS severity: CRITICAL, HIGH, MEDIUM, LOW"
    }
  },
  "additionalProperties": false
}

dora_calendar

DORA compliance milestones and upcoming deadlines for financial institutions. All Art. references included.

No arguments.

Input schema (JSON)

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

dora_news

EBA/DORA regulatory news for banks. Topics: general, eba, incident, third_party, testing, guidelines, bafin, swift.

Argument	Type	Description
lang	string	Language: en or de (default: en)
limit	integer	Max articles 1-20 (default: 10)
topic	string	Topic: general, eba, incident, third_party, testing, guidelines, bafin, swift, fintech

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "lang": {
      "type": "string",
      "description": "Language: en or de (default: en)"
    },
    "limit": {
      "type": "integer",
      "default": 10,
      "maximum": 20,
      "minimum": 1,
      "description": "Max articles 1-20 (default: 10)"
    },
    "topic": {
      "type": "string",
      "description": "Topic: general, eba, incident, third_party, testing, guidelines, bafin, swift, fintech"
    }
  },
  "additionalProperties": false
}

health_check

DORAOracle server status and all backend connectivity checks.

No arguments.

Input schema (JSON)

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

incident_timeline

Generate a DORA Art. 19-aligned ICT incident reporting timeline with the regulatory deadline structure. Supports - does not constitute - compliant reporting.

Argument	Type	Description
sector	string	Sector: banking, insurance, payment (default: banking)
incident_time	string	ISO timestamp of incident e.g. '2026-03-19T14:00:00Z' (default: now)
classification	string	Incident class: major, significant, minor (default: major)

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "sector": {
      "type": "string",
      "description": "Sector: banking, insurance, payment (default: banking)"
    },
    "incident_time": {
      "type": "string",
      "description": "ISO timestamp of incident e.g. '2026-03-19T14:00:00Z' (default: now)"
    },
    "classification": {
      "type": "string",
      "description": "Incident class: major, significant, minor (default: major)"
    }
  },
  "additionalProperties": false
}

kev_check

Check if a specific CVE is in CISA KEV (actively exploited in the wild). Returns DORA incident classification guidance.

Argument	Type	Description
cve_id	string	CVE ID to check e.g. 'CVE-2021-44228' (Log4Shell)

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "cve_id": {
      "type": "string",
      "description": "CVE ID to check e.g. 'CVE-2021-44228' (Log4Shell)"
    }
  },
  "additionalProperties": false
}

kev_list

CISA Known Exploited Vulnerabilities — actively exploited CVEs with patch deadlines. DORA Art. 9 patch compliance.

Argument	Type	Description
days	integer	Added to KEV within last N days (default: 30)
limit	integer	Max results 1-50 (default: 15)
vendor	string	Filter by vendor e.g. 'Cisco', 'Microsoft', 'SAP'
overdue	boolean	Show only overdue patches (default: false)

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "days": {
      "type": "integer",
      "default": 30,
      "description": "Added to KEV within last N days (default: 30)"
    },
    "limit": {
      "type": "integer",
      "default": 15,
      "maximum": 50,
      "minimum": 1,
      "description": "Max results 1-50 (default: 15)"
    },
    "vendor": {
      "type": "string",
      "description": "Filter by vendor e.g. 'Cisco', 'Microsoft', 'SAP'"
    },
    "overdue": {
      "type": "boolean",
      "description": "Show only overdue patches (default: false)"
    }
  },
  "additionalProperties": false
}

mitre_techniques

MITRE ATT&CK techniques for DORA TLPT / TIBER-EU penetration testing. Maps to DORA Art. 26.

Argument	Type	Description
limit	integer	Max results 1-20 (default: 10)
tactic	string	Filter by tactic: Initial Access, Lateral Movement, Impact, Persistence, etc.
keyword	string	Search keyword e.g. 'ransomware', 'phishing', 'credential'

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "default": 10,
      "maximum": 20,
      "minimum": 1,
      "description": "Max results 1-20 (default: 10)"
    },
    "tactic": {
      "type": "string",
      "description": "Filter by tactic: Initial Access, Lateral Movement, Impact, Persistence, etc."
    },
    "keyword": {
      "type": "string",
      "description": "Search keyword e.g. 'ransomware', 'phishing', 'credential'"
    }
  },
  "additionalProperties": false
}

provider_risk

DORA Art. 28 ICT third-party risk assessment: CVE history, news, GLEIF registration, contractual checklist.

Argument	Type	Description
provider	string	Provider name e.g. 'SAP', 'Salesforce', 'AWS', 'Temenos'

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "provider": {
      "type": "string",
      "description": "Provider name e.g. 'SAP', 'Salesforce', 'AWS', 'Temenos'"
    }
  },
  "additionalProperties": false
}

threat_actors

Feodo Tracker: live C2 botnet servers (Emotet, QakBot, etc.). Actionable IP blocklist for DORA Art. 9.

Argument	Type	Description
limit	integer	Max results 1-100 (default: 20)
status	string	Filter by status: online, offline
malware	string	Filter by malware family: Emotet, QakBot, Dridex, TrickBot

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "default": 20,
      "maximum": 100,
      "minimum": 1,
      "description": "Max results 1-100 (default: 20)"
    },
    "status": {
      "type": "string",
      "description": "Filter by status: online, offline"
    },
    "malware": {
      "type": "string",
      "description": "Filter by malware family: Emotet, QakBot, Dridex, TrickBot"
    }
  },
  "additionalProperties": false
}

tlpt_scenarios

TIBER-EU threat scenarios for DORA resilience testing planning. Banking-specific attack simulations.

Argument	Type	Description
focus	string	Focus area: swift, ransomware, insider, ddos, cloud (default: all)
sector	string	Sector: banking (default: banking)

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "focus": {
      "type": "string",
      "description": "Focus area: swift, ransomware, insider, ddos, cloud (default: all)"
    },
    "sector": {
      "type": "string",
      "description": "Sector: banking (default: banking)"
    }
  },
  "additionalProperties": false
}