Sectora is an MCP server with 14 tools an agent can call, among them assess_dependency, assess_tech_risk, get_kev_recent. It answers at https://mcp.sectora.io/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 6 of 6 times since 11 September 2026; the last check, on 22 October 2026, succeeded.
Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
assess_dependency | Check a single package@version for known vulnerabilities via OSV.dev (npm, PyPI, Go, Maven, NuGet, RubyGems, Packagist, crates.io, etc.). Returns advisories with CVE IDs, severity, fixed versions, and references. Free tier eligible. Inputs: name, version, ecosystem |
assess_tech_risk | Assess security risk for a list of technologies. Returns known CVEs affecting each technology with severity breakdown. Input: comma-separated technology names only. Inputs: technologies |
get_kev_recent | Get recently added entries to the CISA Known Exploited Vulnerabilities (KEV) catalog. Inputs: days |
get_my_posture | Get Shield WAF posture score and breakdown for a domain registered under this account. Returns 0-100 score, letter grade, per-component breakdown (origin lock, virtual patching, TLS, etc.), and edge_health (whether Shield is actually interc Inputs: domain |
get_scan | Get a scan with all its findings (full detail: title, description, evidence, remediation, CVSS). Requires API key. Inputs: scan_id |
get_threat_stats | Get statistics about the Sectora threat intelligence database including counts of EPSS scores, KEV entries, Nuclei templates, and exploits. No input required. |
get_trending_cves | Get currently trending CVEs based on recent KEV additions, high EPSS scores, and exploit availability. Inputs: limit |
get_weaponization_score | Get the weaponization score (0-100) for a CVE. Factors in EPSS, KEV status, exploit availability, Nuclei templates, and CVSS. Input must be a valid CVE ID. Inputs: cve_id |
list_my_findings | List the API key owner's open security findings across all scans. Use this to answer "what's my current exposure?" Filter by severity, status, or domain. Returns finding summaries; call get_scan for full detail. Requires API key. Inputs: severity, status, domain, limit |
list_my_scans | List the API key owner's recent scans with summary counts. Requires API key. Inputs: limit, status |
lookup_cve | Get full threat intelligence enrichment for a CVE including EPSS score, CISA KEV status, public exploits, Nuclei templates, risk level, and risk factors. Input must be a valid CVE ID. Inputs: cve_id |
lookup_ip_reputation | Look up community IP reputation from Sectora Shield WAF network. Shows if an IP has been reported for attacks. Accepts IPv4 or IPv6 (the Shield network sees both). Inputs: ip |
scan_url | Kick off a DAST security scan against a public URL the API key owner controls. Two-step flow: first call returns a preview (target, profile, ETA, quota remaining); confirm by calling again with confirm:true to actually start the scan. Retur Inputs: url, profile, confirm |
search_cves | Search for CVEs by keyword, severity, or other filters. Query must be alphanumeric text. Inputs: query, severity, is_kev, has_exploit |
Every block below points at https://mcp.sectora.io/mcp. Pick your client and copy.
claude mcp add --transport http sectora https://mcp.sectora.io/mcp
{
"mcpServers": {
"sectora": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://mcp.sectora.io/mcp"]
}
}
}{
"mcpServers": {
"sectora": {
"url": "https://mcp.sectora.io/mcp"
}
}
}{
"servers": {
"sectora": {
"type": "http",
"url": "https://mcp.sectora.io/mcp"
}
}
}{
"context_servers": {
"sectora": {
"url": "https://mcp.sectora.io/mcp"
}
}
}{
"mcpServers": {
"sectora": {
"serverUrl": "https://mcp.sectora.io/mcp"
}
}
}{
"mcpServers": {
"sectora": {
"url": "https://mcp.sectora.io/mcp"
}
}
}name: Sectora
version: 0.0.1
schema: v1
mcpServers:
- name: Sectora
type: streamable-http
url: https://mcp.sectora.io/mcp{
"mcpServers": {
"sectora": {
"httpUrl": "https://mcp.sectora.io/mcp"
}
}
}{
"mcpServers": {
"sectora": {
"type": "http",
"url": "https://mcp.sectora.io/mcp"
}
}
}{
"mcpServers": {
"sectora": {
"url": "https://mcp.sectora.io/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fmcp.sectora.io%2Fmcp&type=streamable_http&id=sectora&name=Sectora
It answered our last check on 22 October 2026 in 187 ms. Over 6 checks since 11 September 2026 it answered 6. Status here comes from Neuronto's own probes, not from the publisher.
14, as returned by the server's own tools/list on 17 September 2026: assess_dependency, assess_tech_risk, get_kev_recent, get_my_posture, get_scan, get_threat_stats, get_trending_cves, get_weaponization_score, and 6 more.
It answered our last check on 22 October 2026 in 187 ms. Over 6 checks since 11 September 2026 it answered 6.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://mcp.sectora.io/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: io.github.megabrainee. Endpoint host: mcp.sectora.io. ARD identifier: urn:air:io.github.megabrainee:mcp:sectora.
First indexed 10 September 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.