Sectora

Connect Remote server

claude mcp add --transport http sectora https://mcp.sectora.io/mcp

{
  "mcpServers": {
    "sectora": {
      "url": "https://mcp.sectora.io/mcp"
    }
  }
}

{
  "servers": {
    "sectora": {
      "type": "http",
      "url": "https://mcp.sectora.io/mcp"
    }
  }
}

Settings > Connectors > Add custom connector
URL: https://mcp.sectora.io/mcp

Tools 14 found in our last check

• lookup_cve

  Get full threat intelligence enrichment for a CVE including EPSS score, CISA KEV status, public exploits, Nuclei templates, risk level, and risk factors. Input must be a valid CVE ID.

• assess_tech_risk

  Assess security risk for a list of technologies. Returns known CVEs affecting each technology with severity breakdown. Input: comma-separated technology names only.

• search_cves

  Search for CVEs by keyword, severity, or other filters. Query must be alphanumeric text.

• get_kev_recent

  Get recently added entries to the CISA Known Exploited Vulnerabilities (KEV) catalog.

• get_trending_cves

  Get currently trending CVEs based on recent KEV additions, high EPSS scores, and exploit availability.

• get_weaponization_score

  Get the weaponization score (0-100) for a CVE. Factors in EPSS, KEV status, exploit availability, Nuclei templates, and CVSS. Input must be a valid CVE ID.

• lookup_ip_reputation

  Look up community IP reputation from Sectora Shield WAF network. Shows if an IP has been reported for attacks. Accepts IPv4 or IPv6 (the Shield network sees both).

• get_threat_stats

  Get statistics about the Sectora threat intelligence database including counts of EPSS scores, KEV entries, Nuclei templates, and exploits. No input required.

• list_my_findings

  List the API key owner's open security findings across all scans. Use this to answer "what's my current exposure?" Filter by severity, status, or domain. Returns finding summaries; call get_scan for full detail. Requires API key.

• list_my_scans

  List the API key owner's recent scans with summary counts. Requires API key.

• get_scan

  Get a scan with all its findings (full detail: title, description, evidence, remediation, CVSS). Requires API key.

• scan_url

  Kick off a DAST security scan against a public URL the API key owner controls. Two-step flow: first call returns a preview (target, profile, ETA, quota remaining); confirm by calling again with confirm:true to actually start the scan. Returns scan_id; poll status with get_scan.…

• get_my_posture

  Get Shield WAF posture score and breakdown for a domain registered under this account. Returns 0-100 score, letter grade, per-component breakdown (origin lock, virtual patching, TLS, etc.), and edge_health (whether Shield is actually intercepting traffic). Requires API key.

• assess_dependency

  Check a single package@version for known vulnerabilities via OSV.dev (npm, PyPI, Go, Maven, NuGet, RubyGems, Packagist, crates.io, etc.). Returns advisories with CVE IDs, severity, fixed versions, and references. Free tier eligible.

Details

More security servers See all

• BlackVeil DNS & Email Security Scanner

  DNS and email security scanner with 82 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.

• Forwardsmith buyer desk (read-only)

  Read-only desk for buyers and assistants: offer, prices, fit check, readiness scan, intake draft.

• MakeItSay

  Change the words in a screenshot or photo and keep the original font and layout.

• Kestrova Solidity Security Scan

  Free Slither scan of Solidity contracts for AI coding agents; optional paid report (1 USDC, x402).

• Paragon Boxing & BJJ Gear Advisor

  Read-only boxing and BJJ gear guidance, sizing, product comparison, rules and identity checks.

• Spurvik EU AI Act

  Live URL scan, AI Act risk check, 24-EU-language Art. 50 badge, HMAC receipts & approval gates.