xyz MCP by CyberXYZ

Connect Remote server

claude mcp add --transport http xyz-mcp https://mcp.cyberxyz.io/mcp --header "Authorization: Bearer <YOUR_API_KEY>"

{
  "mcpServers": {
    "xyz-mcp": {
      "url": "https://mcp.cyberxyz.io/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_API_KEY>"
      }
    }
  }
}

{
  "servers": {
    "xyz-mcp": {
      "type": "http",
      "url": "https://mcp.cyberxyz.io/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_API_KEY>"
      }
    }
  }
}

Settings > Connectors > Add custom connector
URL: https://mcp.cyberxyz.io/mcp

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools 5 found in our last check

• check_package

  Public safety verdict for ONE package (optionally one version) from CyberXYZ's global threat data: known-malicious releases (always shown in full), advisories, commit-level analysis and version anomalies. Call it BEFORE adding or installing an npm, PyPI, Go or NuGet dependency.…

• get_vulnerability

  Full detail for one advisory id (CVE-..., GHSA-..., or an OSV id such as PYSEC-...): every affected package (`affected_packages`: package, ecosystem, ranges, fixed), the primary one's version ranges and fixed version, severity, CVSS, EPSS (probability of exploitation in 30 days)…

• search

  Find a package by name across every ecosystem (exact match first, then prefix, then most advisories), with its advisory count and worst severity. Use it when you do not know a package's ecosystem or exact spelling; then call package_info or check_package.

• model_risk

  CyberXYZ's public report on a Hugging Face model's install risk: risk level, XYZ score, the driving reason, the worst dependencies and recent risk events. verdict UNKNOWN (not watched, pending, gated) is not safe: ask the user. Signing in adds every reason, all flagged dependenc…

• package_info

  CyberXYZ's public report for a package: every published advisory (CVE/GHSA ids, severity, CVSS, EPSS, KEV, affected ranges, fixed version), malicious-package records in full, how many packages depend on it, what it pulls in (counts and worst severity) and AI-model usage. Package…

Headers

Details

More developer tools servers See all

• AGILEX Docs

  Official AGILEX robotics product docs: manuals, CAN protocol, firmware, FAQ. Read-only.

• dotsy

  Build and publish static sites on dotsy with draft-first MCP tools, OAuth Connect, and API keys.

• Echoo public catalog

  Read-only Echoo product facts, pricing, documentation and published writing skills.

• Polska Szkoła AI

  AI training catalogue for organisations in Poland and the Kompas AI readiness test (Polish).

• QR Code Creator

  Free QR codes for any URL with no signup or API key, plus scan analytics. Pro makes links editable.

• 99tests

  Order human-run real-device app tests from your coding agent; verified bugs return as fix prompts.