MCP server exposing the Cyver reporting platform to Claude via the cyver-reporting wrapper.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"cyver-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# cyver-mcp A Model Context Protocol (MCP) server that lets Claude read from and write to the [Cyver](https://cyver.io/) pentest reporting platform through chat. Wraps the [`cyver-reporting`](https://pypi.org/project/cyver-reporting/) Python client and exposes 40 tools across reads, writes, and four modifications-gated tools. Findings carry OWASP Top 10 (Web + API) and checklist tags, applied through a dedicated tagging tool that reports failure rather than swallowing it, and preserved across later edits. ## Features - **22 read tools** (always on): projects, findings, clients, users (search + single-user detail), teams, client assets, plus reference data (vulnerability types, report templates, project templates, **per-project checklist + compliance catalogue with stable codes for tagging findings**), finding-library lookups, project-file listing and download (download returns inline image content for screenshots / PoC captures). - **Auto-resolved default project template.** `create_project` discovers "Default Pentest" by title at runtime, so callers don't need to look up or hard-code a UUID; pass an explicit `project_template_id` to override. - **14 write tools** (opt-in via `CYVER_ALLOW_WRITES=1`): create findings (from scratch or from a library template, with inline evidence, pre-emptive QA enforcement mirroring `/pentest-report-review` — rejects em dashes / sentinels / emojis / malformed CVE-CWE refs / severity-CVSS mismatches, requires the Background bold title to match the finding name, and is **engagement-type aware** (`engagement_type`, auto-detected from the finding content when omitted) so web / mobile / api findings get a best-guess OWASP Top 10 control *suggested* for review — apply it with `update_finding_compliance_links` — while cloud / CSA findings relax evidence / CWE / likelihood — and a dry-run preview that echoes the parent-project context before commit), append evidence, change finding status, change…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.