Sectora

braineetech/sectora

Plugs Claude or any MCP client into live threat intelligence feeds from NVD, CISA KEV, EPSS, and ExploitDB. You get eight tools: CVE lookup and search, weaponization scoring, IP reputation checks, tech stack risk assessment, recent KEV entries, trending CVEs, and aggregate threat stats. Free tier runs at 300 requests per minute with no authentication, just point your config at their endpoint. Useful when you're triaging vulnerabilities in chat, need EPSS scores during security reviews, or want to check if a CVE is actively exploited without context switching to a browser. Pro tier bumps you to 3,000 rpm with API key analytics.

tools: 14
transport: HTTP
last updated: Apr 26, 2026

View on GitHub

Install

From registry metadata

$ npx add-mcp https://mcp.sectora.io/mcp --name sectora

Run in your terminal. add-mcp asks which agents to add it to (Claude Code, Codex, Cursor and more). Add -g to install it for every project.

Review the command, arguments and environment values before installing. MCP servers run with your local permissions.

Other ways

Claude Code

$ claude mcp add --transport http sectora https://mcp.sectora.io/mcp

Run in your terminal. Add --scope user to make it available in every project.

Tools

Verified live · 14 tools

Verified live against the running server on Nov 6, 2026.

lookup_cveGet full threat intelligence enrichment for a CVE including EPSS score, CISA KEV status, public exploits, Nuclei templates, risk level, and risk factors. Input must be a valid CVE ID.1 params

Get full threat intelligence enrichment for a CVE including EPSS score, CISA KEV status, public exploits, Nuclei templates, risk level, and risk factors. Input must be a valid CVE ID.

Parameters* required

cve_id*string

CVE identifier in format CVE-YYYY-NNNNN (e.g., CVE-2024-3400)

assess_tech_riskAssess security risk for a list of technologies. Returns known CVEs affecting each technology with severity breakdown. Input: comma-separated technology names only.1 params

Assess security risk for a list of technologies. Returns known CVEs affecting each technology with severity breakdown. Input: comma-separated technology names only.

Parameters* required

technologies*string

Comma-separated list of technology names (e.g., "Apache HTTP Server, OpenSSL, nginx"). Max 50 technologies.

search_cvesSearch for CVEs by keyword, severity, or other filters. Query must be alphanumeric text.4 params

Search for CVEs by keyword, severity, or other filters. Query must be alphanumeric text.

Parameters* required

has_exploitstring

Only show CVEs with public exploitsone of true · false

is_kevstring

Only show CVEs in CISA KEV catalogone of true · false

query*string

Search keyword (CVE ID, technology name, or description)

severitystring

Filter by severityone of CRITICAL · HIGH · MEDIUM · LOW

get_kev_recentGet recently added entries to the CISA Known Exploited Vulnerabilities (KEV) catalog.1 params

Get recently added entries to the CISA Known Exploited Vulnerabilities (KEV) catalog.

Parameters* required

daysstring

Number of days to look back (1-365, default: 30)

get_trending_cvesGet currently trending CVEs based on recent KEV additions, high EPSS scores, and exploit availability.1 params

Get currently trending CVEs based on recent KEV additions, high EPSS scores, and exploit availability.

Parameters* required

limitstring

Maximum results to return (1-100, default: 20)

get_weaponization_scoreGet the weaponization score (0-100) for a CVE. Factors in EPSS, KEV status, exploit availability, Nuclei templates, and CVSS. Input must be a valid CVE ID.1 params

Get the weaponization score (0-100) for a CVE. Factors in EPSS, KEV status, exploit availability, Nuclei templates, and CVSS. Input must be a valid CVE ID.

Parameters* required

cve_id*string

CVE identifier in format CVE-YYYY-NNNNN (e.g., CVE-2024-3400)

lookup_ip_reputationLook up community IP reputation from Sectora Shield WAF network. Shows if an IP has been reported for attacks. Accepts IPv4 or IPv6 (the Shield network sees both).1 params

Look up community IP reputation from Sectora Shield WAF network. Shows if an IP has been reported for attacks. Accepts IPv4 or IPv6 (the Shield network sees both).

Parameters* required

ip*string

IPv4 (e.g., 1.2.3.4) or IPv6 (e.g., 2606:4700::1) address to look up

get_threat_statsGet statistics about the Sectora threat intelligence database including counts of EPSS scores, KEV entries, Nuclei templates, and exploits. No input required.

Get statistics about the Sectora threat intelligence database including counts of EPSS scores, KEV entries, Nuclei templates, and exploits. No input required.

No parameters. Call it with no arguments.

list_my_findingsList the API key owner's open security findings across all scans. Use this to answer "what's my current exposure?" Filter by severity, status, or domain. Returns finding summaries; call get_scan for full detail. Requires API key.4 params

List the API key owner's open security findings across all scans. Use this to answer "what's my current exposure?" Filter by severity, status, or domain. Returns finding summaries; call get_scan for full detail. Requires API key.

Parameters* required

domainstring

Limit to a single domain (e.g., app.example.com)

limitstring

Max findings (1-100, default: 25)

severitystring

Comma-separated severities to include: critical, high, medium, low, info

statusstring

Filter by confirmation statusone of open · confirmed

list_my_scansList the API key owner's recent scans with summary counts. Requires API key.2 params

List the API key owner's recent scans with summary counts. Requires API key.

Parameters* required

limitstring

Max scans (1-100, default: 25)

statusstring

Filter by status (queued, running, completed, failed)

get_scanGet a scan with all its findings (full detail: title, description, evidence, remediation, CVSS). Requires API key.1 params

Get a scan with all its findings (full detail: title, description, evidence, remediation, CVSS). Requires API key.

Parameters* required

scan_id*string

Scan UUID

scan_urlKick off a DAST security scan against a public URL the API key owner controls. Two-step flow: first call returns a preview (target, profile, ETA, quota remaining); confirm by calling again with confirm:true to actually start the scan. Returns scan_id; poll status with get_scan...3 params

Kick off a DAST security scan against a public URL the API key owner controls. Two-step flow: first call returns a preview (target, profile, ETA, quota remaining); confirm by calling again with confirm:true to actually start the scan. Returns scan_id; poll status with get_scan...

Parameters* required

confirmstring

Set to "true" to actually execute the scan. Without this, the call returns a preview only.one of true · false

profilestring

Scan profile: quick (~2 min), standard (~10 min), deep (~30 min)one of quick · standard · deep

url*string

Full URL to scan (must start with http:// or https://)

get_my_postureGet Shield WAF posture score and breakdown for a domain registered under this account. Returns 0-100 score, letter grade, per-component breakdown (origin lock, virtual patching, TLS, etc.), and edge_health (whether Shield is actually intercepting traffic). Requires API key.1 params

Get Shield WAF posture score and breakdown for a domain registered under this account. Returns 0-100 score, letter grade, per-component breakdown (origin lock, virtual patching, TLS, etc.), and edge_health (whether Shield is actually intercepting traffic). Requires API key.

Parameters* required

domain*string

Domain registered under your Sectora account

assess_dependencyCheck a single package@version for known vulnerabilities via OSV.dev (npm, PyPI, Go, Maven, NuGet, RubyGems, Packagist, crates.io, etc.). Returns advisories with CVE IDs, severity, fixed versions, and references. Free tier eligible.3 params

Check a single package@version for known vulnerabilities via OSV.dev (npm, PyPI, Go, Maven, NuGet, RubyGems, Packagist, crates.io, etc.). Returns advisories with CVE IDs, severity, fixed versions, and references. Free tier eligible.

Parameters* required

ecosystem*string

Package ecosystem: npm, PyPI, Go, Maven, NuGet, RubyGems, Packagist, crates.io

name*string

Package name (e.g., "lodash", "django", "github.com/gorilla/mux")

version*string

Exact version (e.g., "4.17.20")

Readme

Details

Repository: github.com/braineetech/sectora
Website: sectora.io/mcp
Category: Security & Pentesting
Transport: HTTP
Registry: MCP registry, active
Tools verified: Nov 6, 2026

Related Security & Pentesting MCP servers

View all

Frogeye Security Scannerfrogeye-ai/mcpZero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.0stars

Gsep Mcpgsepcore/gsep-mcpAI agent security via MCP: C3 firewall, C4 immune system, C5 action guard, self-evolving prompts.0stars

AgentSec MCPio.github.traveljamboree/agentsec-mcpSecurity intelligence via x402 on Base. CVE lookup, IP reputation, secret scanning.0stars

Shadowgate Mcpjosephibra/shadowgate-mcpSecurity firewall for AI agents — scans MCP calls for injection, secrets, and risks.0stars

Mcp Servermiddlebrick/mcp-serverScan APIs for OWASP Top 10, LLM, and GraphQL security vulnerabilities.0stars

SecurityScansecurityscan-api/securityscan-apiScan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.0stars