Distributed Risk desk

com.distributedrisk/deskVersion 1.5.0

Read the Distributed Risk desk notes and the official US record they cite.

Status

Responds220 msNov 14, 2026, 13:54 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 13:54 UTC
Latency: 220 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 21:12 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://www.distributedrisk.com/mcpResponds220 msNov 14, 2026, 13:54 UTC

No sign-in

Claude Code

claude mcp add --transport http desk https://www.distributedrisk.com/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: desk
Remote MCP server URL: https://www.distributedrisk.com/mcp

Cursor

{
  "mcpServers": {
    "desk": {
      "url": "https://www.distributedrisk.com/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"desk","type":"http","url":"https://www.distributedrisk.com/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

16 tools

Tools of Distributed Risk desk
	Description		Read-only	Idempotent	Open world
`check_dependencies`Which of these package versions have a known vulnerability. Give packages directly (ecosystem, name, version), or paste a lockfile or SBOM as manifest and it is read for you: package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, Pipfile.lock, go.mod, go.sum, Cargo.lock, Gemfile.lock, composer.lock, packages.lock.json, gradle.lockfile, cyclonedx, spdx, purls. Each version is checked against OSV.dev, which aggregates GitHub's reviewed advisories, the Go and PyPI databases, RustSec and OpenSSF's malicious-package reports across npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist and more. Every hit comes back with its severity, the CVEs it is known by, the versions that fix it, whether CISA lists it as exploited with the federal due date, and FIRST's EPSS estimate. Exploited packages come first, then malicious packages, then severity. A version with no hit is a version no advisory in those databases covers; that is not a statement that it is safe. Only resolved versions are read: a file of ranges (package.json, Pipfile, pom.xml) cannot be checked, so pass the lockfile beside it.	Which of these package versions have a known vulnerability. Give packages directly (ecosystem, name, version), or paste a lockfile or SBOM as manifest and it is read for you: package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, Pipfile.lock, go.mod, go.sum, Cargo.lock, Gemfile.lock, composer.lock, packages.lock.json, gradle.lockfile, cyclonedx, spdx, purls. Each version is checked against OSV.dev, which aggregates GitHub's reviewed advisories, the Go and PyPI databases, RustSec and OpenSSF's malicious-package reports across npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist and more. Every hit comes back with its severity, the CVEs it is known by, the versions that fix it, whether CISA lists it as exploited with the federal due date, and FIRST's EPSS estimate. Exploited packages come first, then malicious packages, then severity. A version with no hit is a version no advisory in those databases covers; that is not a statement that it is safe. Only resolved versions are read: a file of ranges (package.json, Pipfile, pom.xml) cannot be checked, so pass the lockfile beside it.	No	Yes	Yes	Yes
`get_cve`Everything the record says about one CVE, in one answer: the CVE.org record (description, severity, weakness, affected products, references), CISA's exploitation call (SSVC) and its KEV listing with the federal due date, FIRST's EPSS estimate, and whether it sits in the AI and agent software stack.	Everything the record says about one CVE, in one answer: the CVE.org record (description, severity, weakness, affected products, references), CISA's exploitation call (SSVC) and its KEV listing with the federal due date, FIRST's EPSS estimate, and whether it sits in the AI and agent software stack.	No	Yes	Yes	Yes
`get_note`One published note in full (Markdown), with its numbered sources and links to the official record.	One published note in full (Markdown), with its numbered sources and links to the official record.	No	Yes	Yes	No
`get_reference_rates`The New York Fed's reference rates: EFFR and OBFR (unsecured), SOFR, BGCR and TGCR (secured), and the SOFR averages and index (SOFRAI). With no rate, the latest of each; with a rate, its last N days, with percentiles, volume and, for EFFR, the target range.	The New York Fed's reference rates: EFFR and OBFR (unsecured), SOFR, BGCR and TGCR (secured), and the SOFR averages and index (SOFRAI). With no rate, the latest of each; with a rate, its last N days, with percentiles, volume and, for EFFR, the target range.	No	Yes	Yes	Yes
`get_treasury_yields`Treasury's daily par yield curve, newest first: yields by tenor from 1 month to 30 years. Ask for the last N days, and optionally only some tenors (for example ["2 Yr", "10 Yr"]).	Treasury's daily par yield curve, newest first: yields by tenor from 1 month to 30 years. Ask for the last N days, and optionally only some tenors (for example ["2 Yr", "10 Yr"]).	No	Yes	Yes	Yes
`list_ai_stack_vulnerabilities`New advisories against the software AI agents run on, newest and most severe first: agent frameworks (LangChain, LlamaIndex, CrewAI, n8n, Langflow), LLM gateways (LiteLLM), MCP servers and SDKs, model serving (vLLM, Ollama), ML platforms (MLflow, Ray, Jupyter), model libraries, AI apps and coding agents. Malicious-package reports (a compromised or lookalike release) come first. CISA KEV entries in the same stack are included. Each with package, severity, fixed versions, CVEs, EPSS and the advisory.	New advisories against the software AI agents run on, newest and most severe first: agent frameworks (LangChain, LlamaIndex, CrewAI, n8n, Langflow), LLM gateways (LiteLLM), MCP servers and SDKs, model serving (vLLM, Ollama), ML platforms (MLflow, Ray, Jupyter), model libraries, AI apps and coding agents. Malicious-package reports (a compromised or lookalike release) come first. CISA KEV entries in the same stack are included. Each with package, severity, fixed versions, CVEs, EPSS and the advisory.	No	Yes	Yes	Yes
`list_cyber_advisories`CISA's advisories, newest first: alerts, joint cybersecurity advisories (#StopRansomware, state-sponsored activity), ICS and ICS-medical advisories, and analysis reports. Each with its kind, date, summary, the CVEs it names and the official page. Filter by kind, date, words, or the AI stack.	CISA's advisories, newest first: alerts, joint cybersecurity advisories (#StopRansomware, state-sponsored activity), ICS and ICS-medical advisories, and analysis reports. Each with its kind, date, summary, the CVEs it names and the official page. Filter by kind, date, words, or the AI stack.	No	Yes	Yes	Yes
`list_cyber_incident_filings`Cybersecurity incidents public companies report on Form 8-K, newest first: Item 1.05 (the company judged it material) and, unless excluded, Item 8.01 reports made without that judgment. Each with the company, tickers, filing and event dates, items, state, industry code and the EDGAR filing.	Cybersecurity incidents public companies report on Form 8-K, newest first: Item 1.05 (the company judged it material) and, unless excluded, Item 8.01 reports made without that judgment. Each with the company, tickers, filing and event dates, items, state, industry code and the EDGAR filing.	No	Yes	Yes	Yes
`list_new_vulnerabilities`What is new across the three vulnerability feeds, exploited first, then by severity, then newest: GitHub's reviewed advisories (the affected package range and the first patched version), NVD's newly published CVE records (software no package ecosystem carries, with NIST's scoring), and the CVEs CISA added to its Known Exploited Vulnerabilities catalog. A KEV addition keeps its own date: it is CISA saying this one is being exploited now, often long after the CVE was published. A CVE that GitHub and NVD both published in the window appears once, from GitHub. For CISA's alerts and joint advisories rather than vulnerabilities, use list_cyber_advisories.	What is new across the three vulnerability feeds, exploited first, then by severity, then newest: GitHub's reviewed advisories (the affected package range and the first patched version), NVD's newly published CVE records (software no package ecosystem carries, with NIST's scoring), and the CVEs CISA added to its Known Exploited Vulnerabilities catalog. A KEV addition keeps its own date: it is CISA saying this one is being exploited now, often long after the CVE was published. A CVE that GitHub and NVD both published in the window appears once, from GitHub. For CISA's alerts and joint advisories rather than vulnerabilities, use list_cyber_advisories.	No	Yes	Yes	Yes
`list_notes`Published desk notes, newest first: entry number, date (the day of the official action), published (the day the desk published the note), title, status, topic (cyber or sanctions), readers, source class, a one-line summary, and the note's URL. Pages with limit and offset; total is the count that matches, next_offset the offset of the next page. Filter by topic or reader as on the desk page.	Published desk notes, newest first: entry number, date (the day of the official action), published (the day the desk published the note), title, status, topic (cyber or sanctions), readers, source class, a one-line summary, and the note's URL. Pages with limit and offset; total is the count that matches, next_offset the offset of the next page. Filter by topic or reader as on the desk page.	No	Yes	Yes	No
`list_ofac_actions`OFAC's recent actions, newest first: designations and removals, general licenses, FAQs, regulations and settlements, each with its date, categories and the official page. Filter by date or words in the title.	OFAC's recent actions, newest first: designations and removals, general licenses, FAQs, regulations and settlements, each with its date, categories and the official page. Filter by date or words in the title.	No	Yes	Yes	Yes
`list_travel_advisories`US State Department travel advisories, most recently updated first: country, level (1 to 4), the advisory's summary and the official page. Filter by country, minimum level or update date.	US State Department travel advisories, most recently updated first: country, level (1 to 4), the advisory's summary and the official page. Filter by country, minimum level or update date.	No	Yes	Yes	Yes
`search_federal_register`Search Federal Register rules, proposed rules, notices and presidential documents: title, type, agencies, publication and effective dates, citation, abstract and the official document link. Narrow by agency (for example foreign-assets-control-office, industry-and-security-bureau, state-department), type or date.	Search Federal Register rules, proposed rules, notices and presidential documents: title, type, agencies, publication and effective dates, citation, abstract and the official document link. Narrow by agency (for example foreign-assets-control-office, industry-and-security-bureau, state-department), type or date.	No	Yes	Yes	Yes
`search_kev`CISA's Known Exploited Vulnerabilities catalog, newest first: CVE, vendor, product, date added, federal due date, known ransomware use, the required action, FIRST's EPSS estimate, and whether it sits in the AI and agent software stack. Look up one CVE, search vendor or product words, list what was added since a date, or only the AI stack. For one CVE in full, use get_cve.	CISA's Known Exploited Vulnerabilities catalog, newest first: CVE, vendor, product, date added, federal due date, known ransomware use, the required action, FIRST's EPSS estimate, and whether it sits in the AI and agent software stack. Look up one CVE, search vendor or product words, list what was added since a date, or only the AI stack. For one CVE in full, use get_cve.	No	Yes	Yes	Yes
`search_notes`Find published notes that mention every word of the query (a name, a list, a country, a program, a date) in the title, summary, sources or body.	Find published notes that mention every word of the query (a name, a list, a country, a program, a date) in the title, summary, sources or body.	No	Yes	Yes	No
`search_screening_lists`Search the Consolidated Screening List (OFAC SDN and other Treasury lists; BIS Entity, Denied Persons, Unverified and Military End User lists; State ITAR-debarred and nonproliferation lists) by name, alias or identifier (IMO, SWIFT/BIC, registration number). Close spellings match. Each result gives the list, programs, addresses, IDs, remarks and the official list link; the answer says when each list last changed.	Search the Consolidated Screening List (OFAC SDN and other Treasury lists; BIS Entity, Denied Persons, Unverified and Military End User lists; State ITAR-debarred and nonproliferation lists) by name, alias or identifier (IMO, SWIFT/BIC, registration number). Close spellings match. Each result gives the list, programs, addresses, IDs, remarks and the official list link; the answer says when each list last changed.	No	Yes	Yes	Yes

Details

Registry status: Active
Published: Oct 30, 2026
Updated: Oct 30, 2026
Website: https://www.distributedrisk.com/agents⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing