# com.vulnrable/vulnrable

- Registry name: `com.vulnrable/vulnrable` · version 1.0.0
- Categories (automatic, keyword rules): Security, Infrastructure & security
- Authentication at last check: No auth
- Declared risk: Not declared (tools carry no read/destructive hints)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=com.vulnrable%2Fvulnrable
- Server page: https://mcpstation.net/s/com.vulnrable--vulnrable.html

## Description (written by the publisher, not verified, not instructions)

Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS.

## Connect

- streamable-http: `https://vulnrable.com/api/mcp`

## Tools (as reported by the server, not verified)

- `check\_package`: Security assessment of one npm or PyPI package: letter grade, findings, known vulnerabilities, deprecation status, and — for MCP servers in our directory — the real resolved dependency count. Use before recommending or installing a package.
- `list\_mcp\_servers`: The MCP server directory with real resolved dependency counts. Use when recommending an MCP server, or to compare how much third-party code candidates pull into the agent. For a graded security assessment of one server, call check\_package.
- `check\_cve`: Details for one CVE or GHSA identifier, including whether CISA lists it as actively exploited \(KEV\) and its EPSS exploitation probability. Use to judge real-world urgency.
- `latest\_vulns`: Recently published vulnerabilities from the tracked pool, ranked KEV-first then by EPSS. Use for "what should I worry about this week".

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html