NestDaddy
All servers NestDaddy MCP Blog Sign inTry it free
Security

vulntel

com.vulntel/mcp · v1.2.0

Free hosted CVE intel for bug-bounty agents: CVE fact-check, attack approaches from paid H1 reports

Website Source code Set it up

Connect Remote server

Terminal
claude mcp add --transport http mcp https://mcp.vulntel.com/mcp --header "Authorization: Bearer <YOUR_API_KEY>"
~/.cursor/mcp.json
{
  "mcpServers": {
    "mcp": {
      "url": "https://mcp.vulntel.com/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_API_KEY>"
      }
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "mcp": {
      "type": "http",
      "url": "https://mcp.vulntel.com/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_API_KEY>"
      }
    }
  }
}
Claude Desktop
Settings > Connectors > Add custom connector
URL: https://mcp.vulntel.com/mcp

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools 13 found in our last check

  • enrich_cve

    Full intelligence for a single CVE: CVSS, KEV status, EPSS, CISA SSVC (exploitation/automatable/technical_impact), P1-P4 priority with rationale, affected products/versions, Debian/Ubuntu/Alpine fixed builds per release (`distro_fixes`), and (live) public-exploit signal. Args: c…

  • check_technology

    Find vulnerabilities affecting a product across NVD (CPE) and OSV (package ecosystems), de-duplicated and ranked by priority/EPSS/CVSS. Distinct products that share a name are kept distinct. If one name maps to several VENDORS' unrelated products (e.g. "Sentry" → sentry, mobilei…

  • hunt_plan

    Turn a recon'd stack into a ranked dig-order for authorized bug-hunting. For each discovered component, returns its top high-risk CVEs (KEV / CISA-SSVC- active / high-EPSS first) AND its `recurring_loci` — the bug classes (CWE) this product family repeatedly fails at, ranked by…

  • observe

    Scan a host's exposed stack and join it to the CVE corpus — the recon workhorse. Fingerprints the homepage + JS bundles (recovering the backend identity and API endpoints homepage detection misses on SPAs), then ranks against live KEV / SSVC-active / high-EPSS into a dig-order.…

  • search_vulns

    Search the CVE corpus — one entry point, three retrieval modes picked from your arguments: - query= a concept / technique / weakness (e.g. "SSO SAML assertion replay", "deserialization gadget chain", "server-side request forgery cloud metadata"). By default it FUSES full-text ke…

  • find_attack_approaches

    Find how bugs *like this* were actually FOUND — retrieve real disclosed bug-bounty report mechanic-cards whose approach is closest (by mechanism) to your query or a seed CVE. The "what approach worked on a bug like this, on which program, and what did it pay" layer: grounded in…

  • find_continuations

    When you're STUCK mid-hunt: describe your POSITION — the attacker state/capabilities you hold, stripped of product names — and get the CONTINUATIONS that worked from positions like it, matched against the full disclosed-report BODIES (the concrete step/payload/precondition), not…

  • assist_submission

    Submission & escalation co-pilot for a bug-bounty finding. Paste your DRAFT finding (and what you already tried / couldn't achieve) and get a grounded brief built from the closest REAL disclosed reports: (1) precedent & validity — is this an accepted class, with citable reports…

  • program_outcome_prior

    At the START of an engagement on a bug-bounty PROGRAM, get a grounded prior over what bug classes have historically LANDED there — to decide what to look at first and what to skip. Built from real HackerOne disclosed reports: the class distribution for this program, each with LI…

  • new_in_scope

    Find FRESH attack surface: bounty-eligible assets that entered a public bug-bounty program's scope in the last `days` (HackerOne, Bugcrowd, Intigriti, YesWeHack, mirrored daily), the least-hunted surface there is. Raw scope additions are mostly not new (in one week 57 of 80 were…

  • verify_cve_claim

    Fact-check a claim about a CVE against the corpus — catch hallucinations before they ship. Verifies: does the CVE exist; does it affect the claimed product at the claimed version; is the severity right; is it actually KEV-exploited. Returns per-assertion verdicts (supported / re…

  • corpus_stats

    Corpus size and data freshness (CVE / KEV / EPSS counts and latest timestamps).

  • search_public_code

    Search public repositories for an exact code string; return WHERE it appears. Use it to hunt vendored / copy-pasted copies of known-vulnerable code: search a distinctive symbol or short fragment from the vulnerable function (a function name, a constant, one call), then FETCH AND…

Headers

NameDescription
Authorization
Optional, secret		Optional bearer token. Without one, nine of the 13 tools run 25 times a day per network (the answers say how many calls are left). A free key from https://vulntel.com/signup lifts that to 60 calls a minute and adds observe, new_in_scope, assist_submission and search_public_code: send Bearer <your-k…

Details

Endpointhttps://mcp.vulntel.com/mcp (Streamable HTTP)
First published3 Nov 2026
Last updated3 Nov 2026
Registry namecom.vulntel/mcp

More security servers See all

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.