## Sectora Threat Intelligence Ask your AI *"is this CVE actually being exploited?"* and get real data back — not a guess from 2024 training cutoff. Sectora blends **EPSS scores**, **CISA KEV** status, **public exploit** availability, **Nuclei templates**, and **CVSS** into a single 0–100 **weaponization score**. Your LLM stops hallucinating severity and starts giving actionable answers grounded in live signals. --- ### 🛠️ Tools | Tool | What it does | |---|---| | `lookup_cve` | Full CVE enrichment — EPSS, KEV, exploits, Nuclei, ransomware use | | `get_weaponization_score` | 0–100 score blending 5 exploitation signals | | `search_cves` | Find CVEs by keyword, severity, KEV status, or exploit availability | | `assess_tech_risk` | Risk summary for a stack (e.g. `"nginx 1.25, OpenSSL 3.1, PostgreSQL 16"`) | | `get_kev_recent` | Newly added CISA KEV entries | | `get_trending_cves` | EPSS spikes + new exploits this week | | `lookup_ip_reputation` | Community IP rep from the Sectora Shield WAF network | | `get_threat_stats` | Database coverage stats | --- ### 💬 Try these prompts - *"Is CVE-2024-3400 being actively exploited? What's its weaponization score?"* - *"What's the weaponization score for Log4Shell?"* - *"Assess the security risk of running nginx 1.25 and OpenSSL 3.1"* - *"Show me the critical CVEs added to CISA KEV this week"* - *"Has IP 45.33.32.156 been reported for attacks?"* --- ### ⚡ Quick start (Claude Desktop) ```json { "mcpServers": { "sectora": { "type": "streamable-http", "url": "https://mcp.sectora.io/mcp" } } } Works out of the box with Claude Desktop, Claude Code, Cursor, Windsurf, ChatGPT, and any MCP-compatible client. --- 🎁 Free tier 300 requests/minute per IP. No signup. No credit card. Discovery calls (tools/list, initialize) don't count against quota. Need higher limits for production use? Get a free API key at sectora.io/settings/api-keys → 3,000 req/min. --- 🔒 Privacy We log request metadata (IP, country, tool name, latency) for abuse detection and service reliability. We do not log tool arguments or responses — the CVEs and IPs you look up are never stored. 30-day retention. Full details at sectora.io/legal/privacy. --- 🏢 About Built and operated by Sectora — an AI-era DAST platform that scans production apps for vulnerabilities. This MCP is our way of putting the same threat-intel enrichment our scanners use directly inside your AI workflow

MCP readiness

B · 84/100

Readiness is how fully this listing follows its protocol and how it behaved in our probes over 30 days. It is shown for reference and does not move it in search. Search order and leaderboards use the separate quality grade (here B, 77.6/100), which weighs availability, conformance, p95 speed and descriptor. How the two differ

Valid MCP handshake	10/10	initialize and tools/list both answered.
Live MCP endpoint	25/25	Endpoint answers the MCP initialize handshake (1506 ms).
Protocol revision	5/10	Speaks MCP 2025-03-26, 3 revision(s) behind 2026-07-28.
Signed descriptor	n/a	No MCP standard defines a signed server descriptor.
Uptime (30 days)	15/15	31/31 probes succeeded over 30 days (100%).
Tool declaration	10/10	Lists 14 tool(s) with descriptions.
Verified identity	5/10	Publisher declared (repository, package or homepage); claim this listing to verify domain control.
Freshness + modern flags	4/5	seen in a source within 7 days.
Auth declaration	2/5	Declares credential scheme: smithery_api_key.

Applicable criteria total 90 points, scaled to 100.

Responsiveness: Responsive (1506 ms; bands ≤2.5 s, ≤5 s, ≤8 s, slower; penalty only).

Measured 2026-11-11.

Nine criteria, the same as the A2A readiness score, read from our daily MCP probe (initialize + tools/list) and 30-day probe history. No MCP standard defines a signed server descriptor, so that criterion is n/a and the other 90 points are scaled to 100. Grades: A>=90, B>=75, C>=60, D>=40, F<40. Display only: search order uses the quality grade.

Compared with peers

Against 53,039 reachable MCP servers in our daily snapshot (2026-11-12 06:46 UTC). Display only; it does not change search order.

Readiness: Higher than 75% of peers; This listing 84 · peer median 81
Latency: Faster than 32% of peers; This listing 485 ms · peer median 326 ms

Where it loses the most points, and how to win them back

Protocol revision −5 — Support the current protocol revision.
Now: Speaks MCP 2025-03-26, 3 revision(s) behind 2026-07-28.
Verified identity −5 — Claim the listing and prove control of its domain.
Now: Publisher declared (repository, package or homepage); claim this listing to verify domain control.
Auth declaration −3 — State how to authenticate (an auth scheme, or that none is needed).
Now: Declares credential scheme: smithery_api_key.

How many agent tools actually work · All statistics

Listed in

Directories this entry was found in.

smithery since 2026-06-04 ↗

How to connect

MCP endpoint (streamable-http)

https://server.smithery.ai/oversight/threat-intel/mcp

JSON-RPC initialize probe

curl -X POST https://server.smithery.ai/oversight/threat-intel/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}'

Homepage

https://sectora.io/

Listed at (smithery)

https://sectora.io/