Claude MarketplacesSubmit
tooloracle avatar

Cybershield

tooloracle/cybershield

This is a cybersecurity toolkit that gives you 12 focused operations for threat analysis and compliance work. You get NIS2 directive mapping for European compliance requirements, MITRE ATT&CK framework lookups for understanding adversary tactics, vulnerability data queries, and threat intelligence feeds. Reach for this when you're building security dashboards, automating compliance checks, or need to enrich security alerts with context about attack patterns and known vulnerabilities. It's delivered over streamable HTTP from tooloracle.io, so you can integrate it without managing local dependencies. Useful if you're working in security operations, compliance reporting, or building internal security tools that need structured threat data.

tools
12
transport
HTTP
last updated
May 7, 2026
View on GitHub

Install

From registry metadata
$ npx add-mcp https://tooloracle.io/cybershield/mcp/ --name cybershield

Run in your terminal. add-mcp asks which agents to add it to (Claude Code, Codex, Cursor and more). Add -g to install it for every project.

Review the command, arguments and environment values before installing. MCP servers run with your local permissions.

Other ways

Claude Code

$ claude mcp add --transport http cybershield https://tooloracle.io/cybershield/mcp/

Run in your terminal. Add --scope user to make it available in every project.

Tools

Verified live · 12 tools

Verified live against the running server on Nov 6, 2026.

threat_landscapeCurrent cyber threat landscape overview per ENISA categories. Top 8 threats with sector relevance and mitigations.1 params

Current cyber threat landscape overview per ENISA categories. Top 8 threats with sector relevance and mitigations.

Parameters* required
sectorstring
energy|finance|healthcare|manufacturing|public_admin|general
cve_risk_scoreCVE risk prioritization combining CVSS, EPSS, KEV catalog, exploit availability. Returns weighted priority score with patching SLA.7 params

CVE risk prioritization combining CVSS, EPSS, KEV catalog, exploit availability. Returns weighted priority score with patching SLA.

Parameters* required
affected_systemsinteger
cve_idstring
cvss_scorenumber
epss_scorenumber
0-1 EPSS probability
in_kev_catalogboolean
internet_facingboolean
public_exploitboolean
attack_surface_checkAttack surface assessment checklist. Web apps, remote access, cloud, IoT, email. Prioritized security checks.5 params

Attack surface assessment checklist. Web apps, remote access, cloud, IoT, email. Prioritized security checks.

Parameters* required
cloud_servicesboolean
employee_countinteger
iot_devicesboolean
remote_access_vpnboolean
web_applicationsboolean
phishing_indicatorsAnalyze email/URL for phishing indicators. Scores sender, urgency, attachments, URL patterns. Returns verdict and recommended actions.6 params

Analyze email/URL for phishing indicators. Scores sender, urgency, attachments, URL patterns. Returns verdict and recommended actions.

Parameters* required
asks_for_credentialsboolean
creates_urgencyboolean
has_unexpected_attachmentboolean
sender_emailstring
subjectstring
suspicious_urlstring
nis2_complianceNIS2 Directive (EU 2022/2555) compliance assessment. All 10 Art. 21 measures, entity classification, penalties, incident reporting.13 params

NIS2 Directive (EU 2022/2555) compliance assessment. All 10 Art. 21 measures, entity classification, penalties, incident reporting.

Parameters* required
access_controlboolean
annual_turnover_meurnumber
business_continuityboolean
cryptography_policyboolean
cyber_hygiene_trainingboolean
employee_countinteger
incident_handlingboolean
incident_reporting_processboolean
mfa_deployedboolean
risk_managementboolean
sectorstring
supply_chain_securityboolean
vulnerability_managementboolean
nis2_incident_reportNIS2 incident notification template. 24h early warning, 72h notification, 1-month final report templates.5 params

NIS2 incident notification template. 24h early warning, 72h notification, 1-month final report templates.

Parameters* required
affected_servicesstring
affected_users_estimateinteger
cross_border_impactboolean
incident_typestring
severitystring
iso27001_gapISO 27001:2022 Annex A gap analysis. All 93 controls across 4 themes, new 2022 controls highlighted, certification process.1 params

ISO 27001:2022 Annex A gap analysis. All 93 controls across 4 themes, new 2022 controls highlighted, certification process.

Parameters* required
controlsobject
Optional: status of specific controls
dora_ict_riskDORA Art. 5-12 ICT risk management compliance check. 8 articles assessed with specific requirements per article.7 params

DORA Art. 5-12 ICT risk management compliance check. 8 articles assessed with specific requirements per article.

Parameters* required
communication_plansboolean
detection_measuresboolean
ict_asset_inventoryboolean
ict_risk_frameworkboolean
learning_evolvingboolean
protection_preventionboolean
response_recoveryboolean
password_policyGenerate password policy per NIST SP 800-63B (2024) and BSI recommendations. Modern best practices — no forced rotation.

Generate password policy per NIST SP 800-63B (2024) and BSI recommendations. Modern best practices — no forced rotation.

No parameters. Call it with no arguments.

incident_playbookIncident response playbook for ransomware, data breach, phishing compromise. Phase-by-phase actions with legal obligations.1 params

Incident response playbook for ransomware, data breach, phishing compromise. Phase-by-phase actions with legal obligations.

Parameters* required
incident_typestring
ransomware | data_breach | phishing_compromise
risk_matrixRisk assessment matrix (likelihood × impact). ISO 31000/27005 methodology. Provide risks for assessment or get template.1 params

Risk assessment matrix (likelihood × impact). ISO 31000/27005 methodology. Provide risks for assessment or get template.

Parameters* required
risksstring
JSON array [{name, likelihood(1-5), impact(1-5)}]
security_metricsSecurity KPI/metrics dashboard template. MTTD, MTTR, patch compliance, phishing rate. Board-ready reporting guidance.

Security KPI/metrics dashboard template. MTTD, MTTR, patch compliance, phishing rate. Board-ready reporting guidance.

No parameters. Call it with no arguments.

Sponsors

Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthlyAgent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any language

Readme

CyberShield MCP Server v1.0.0

Security Operations & NIS2/DORA Cyber Compliance MCP Server — 12 tools for NIS2 compliance, ISO 27001:2022 gap analysis, DORA ICT risk (Art.5-12), incident playbooks, CVE prioritization, attack surface checks, phishing detection.

Port 12601 | Part of ToolOracle & FeedOracle Infrastructure

Quick Connect

# Claude Desktop / Claude Code
claude mcp add cybershield https://tooloracle.io/cybershield/mcp

# Or use directly
curl -X POST https://tooloracle.io/cybershield/mcp/ \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

12 Tools

| threat_landscape | Tool 1 | | cve_risk_score | Tool 2 | | attack_surface_check | Tool 3 | | phishing_indicators | Tool 4 | | nis2_compliance | Tool 5 | | nis2_incident_report | Tool 6 | | iso27001_gap | Tool 7 | | dora_ict_risk | Tool 8 | | password_policy | Tool 9 | | incident_playbook | Tool 10 | | risk_matrix | Tool 11 | | security_metrics | Tool 12 |

Endpoints

View the full README on GitHub

Details

Repository
github.com/tooloracle/cybershield
Transport
HTTP
Registry
MCP registry, active
Tools verified
Nov 6, 2026

More from tooloracle