vulnrable

Name: vulnrable
Author: com.vulnrable

MCP serverMCP

Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS.

by com.vulnrablehomepage ↗v1.0.0

Is this yours?

This record is unclaimed

Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.

Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"vulnrable","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.

Claim this record

Observed by Wellknown

Evidence

Everything here was measured by our prober or read from a registry. Nothing is self-reported.

30-day availability54/54 checks ok

when	check	result	http	latency	detail
2 h ago	mcp initialize	ok	200	212 ms	server vulnrable 1.0.0 · protocol 2025-06-18 · 4 tools
8 h ago	mcp initialize	ok	200	148 ms	server vulnrable 1.0.0 · protocol 2025-06-18 · 4 tools
15 h ago	mcp initialize	ok	200	253 ms	server vulnrable 1.0.0 · protocol 2025-06-18 · 4 tools
22 h ago	mcp initialize	ok	200	142 ms	server vulnrable 1.0.0 · protocol 2025-06-18 · 4 tools
29 h ago	mcp initialize	ok	200	146 ms	server vulnrable 1.0.0 · protocol 2025-06-18 · 4 tools
35 h ago	mcp initialize	ok	200	98 ms	server vulnrable 1.0.0 · protocol 2025-06-18 · 4 tools
2 d ago	mcp initialize	ok	200	292 ms	server vulnrable 1.0.0 · protocol 2025-06-18 · 4 tools
2 d ago	mcp initialize	ok	200	205 ms	server vulnrable 1.0.0 · protocol 2025-06-18 · 4 tools
2 d ago	mcp initialize	ok	200	112 ms	server vulnrable 1.0.0 · protocol 2025-06-18 · 4 tools
3 d ago	mcp initialize	ok	200	360 ms	server vulnrable 1.0.0 · protocol 2025-06-18 · 4 tools

Tools observed via MCP handshake

check_package — Security assessment of one npm or PyPI package: letter grade, findings, known vulnerabilities, deprecation status, and — for MCP servers in our directory — the
list_mcp_servers — The MCP server directory with real resolved dependency counts. Use when recommending an MCP server, or to compare how much third-party code candidates pull into
check_cve — Details for one CVE or GHSA identifier, including whether CISA lists it as actively exploited (KEV) and its EPSS exploitation probability. Use to judge real-wor
latest_vulns — Recently published vulnerabilities from the tracked pool, ranked KEV-first then by EPSS. Use for "what should I worry about this week".

Declared by sources

What the publisher says

Attributed to the source that supplied each field. Treated as claims, not facts.

No long description beyond the summary.

kind Official MCP Registry

name Official MCP Registry

summary Official MCP Registry

version Official MCP Registry

description Official MCP Registry

homepageUrl Official MCP Registry

publisherName Official MCP Registry

Provenance

Where this record came from

Every source is kept verbatim. Field changes are logged as events.

Official MCP Registrycom.vulnrable/vulnrable

first seen 15 d ago · fetched 2 d agoopen ↗

Field history (6 recent events)

15 d ago · declared · summary → "Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS."
15 d ago · declared · description → "Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS."
15 d ago · declared · publisherName → "com.vulnrable"
15 d ago · declared · homepageUrl → "https://vulnrable.com"
15 d ago · declared · version → "1.0.0"
15 d ago · declared · protocols → ["mcp"]

This record is unclaimed

Evidence

What the publisher says

Capabilities

Where this record came from