com.vulnrable/vulnrable

com.vulnrable/vulnrable · v1.0.0

Measured by MCP Station

Last check	Reachable
Checked at	—
Check success 7 / 30 days	—
First-try success 30 days	—
Median response	—
Lookups 30 days	—
Authentication	No auth
MCP version	2025-06-18
Rank score	—
Declared risk	Not declared (tools carry no read/destructive hints)
Capabilities declared	tools
Tool definitions	4 tools · with description 100% · input schema is an object 100% · read/destructive hints 0%

Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS.

streamable-http · https://vulnrable.com/api/mcp

claude mcp add --transport http vulnrable https://vulnrable.com/api/mcp

{
  "mcpServers": {
    "vulnrable": {
      "url": "https://vulnrable.com/api/mcp"
    }
  }
}

check_package
Security assessment of one npm or PyPI package: letter grade, findings, known vulnerabilities, deprecation status, and — for MCP servers in our directory — the real resolved dependency count. Use before recommending or installing a package.
list_mcp_servers
The MCP server directory with real resolved dependency counts. Use when recommending an MCP server, or to compare how much third-party code candidates pull into the agent. For a graded security assessment of one server, call check_package.
check_cve
Details for one CVE or GHSA identifier, including whether CISA lists it as actively exploited (KEV) and its EPSS exploitation probability. Use to judge real-world urgency.
latest_vulns
Recently published vulnerabilities from the tracked pool, ranked KEV-first then by EPSS. Use for "what should I worry about this week".

Website · JSON · Text for agents · Registry updated 2026-10-07