vulnrable

com.vulnrable/vulnrableVersion 1.0.0

Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS.

Status

Responds283 msNov 14, 2026, 14:22 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:22 UTC
Latency: 283 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://vulnrable.com/api/mcpResponds283 msNov 14, 2026, 14:22 UTC

No sign-in

Claude Code

claude mcp add --transport http vulnrable https://vulnrable.com/api/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: vulnrable
Remote MCP server URL: https://vulnrable.com/api/mcp

Cursor

{
  "mcpServers": {
    "vulnrable": {
      "url": "https://vulnrable.com/api/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"vulnrable","type":"http","url":"https://vulnrable.com/api/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

4 tools

Tools of vulnrable
	Description		Read-only	Idempotent	Open world
`check_cve`Details for one CVE or GHSA identifier, including whether CISA lists it as actively exploited (KEV) and its EPSS exploitation probability. Use to judge real-world urgency.	Details for one CVE or GHSA identifier, including whether CISA lists it as actively exploited (KEV) and its EPSS exploitation probability. Use to judge real-world urgency.	Not declared	Not declared	Not declared	Not declared
`check_package`Security assessment of one npm or PyPI package: letter grade, findings, known vulnerabilities, deprecation status, and — for MCP servers in our directory — the real resolved dependency count. Use before recommending or installing a package.	Security assessment of one npm or PyPI package: letter grade, findings, known vulnerabilities, deprecation status, and — for MCP servers in our directory — the real resolved dependency count. Use before recommending or installing a package.	Not declared	Not declared	Not declared	Not declared
`latest_vulns`Recently published vulnerabilities from the tracked pool, ranked KEV-first then by EPSS. Use for "what should I worry about this week".	Recently published vulnerabilities from the tracked pool, ranked KEV-first then by EPSS. Use for "what should I worry about this week".	Not declared	Not declared	Not declared	Not declared
`list_mcp_servers`The MCP server directory with real resolved dependency counts. Use when recommending an MCP server, or to compare how much third-party code candidates pull into the agent. For a graded security assessment of one server, call check_package.	The MCP server directory with real resolved dependency counts. Use when recommending an MCP server, or to compare how much third-party code candidates pull into the agent. For a graded security assessment of one server, call check_package.	Not declared	Not declared	Not declared	Not declared

Details

Registry status: Active
Published: Oct 7, 2026
Updated: Oct 7, 2026
Website: https://vulnrable.com/⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing