xyz MCP by CyberXYZ

io.cyberxyz/xyz-mcpVersion 1.0.0

Package verdicts for AI coding agents: check npm, PyPI, Go and NuGet installs before they run.

Status

Responds234 msNov 14, 2026, 14:34 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:34 UTC
Latency: 234 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://mcp.cyberxyz.io/mcpResponds234 msNov 14, 2026, 14:34 UTC

No sign-in

Claude Code

claude mcp add --transport http xyz-mcp https://mcp.cyberxyz.io/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: xyz-mcp
Remote MCP server URL: https://mcp.cyberxyz.io/mcp

Cursor

{
  "mcpServers": {
    "xyz-mcp": {
      "url": "https://mcp.cyberxyz.io/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"xyz-mcp","type":"http","url":"https://mcp.cyberxyz.io/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

5 tools

Tools of xyz MCP by CyberXYZ
	Description		Read-only	Idempotent	Open world
`check_package`Public safety verdict for ONE package (optionally one version) from CyberXYZ's global threat data: known-malicious releases (always shown in full), advisories, commit-level analysis and version anomalies. Call it BEFORE adding or installing an npm, PyPI, Go or NuGet dependency. `decision`: block or quarantine = do not install; alert = installable but flagged; allow = ok; unknown = no record, not vetted: ask the user; unverified = the check did not complete: retry, then ask the user. Signing in adds the full install-time verdict (see `sign_in_adds`).	Public safety verdict for ONE package (optionally one version) from CyberXYZ's global threat data: known-malicious releases (always shown in full), advisories, commit-level analysis and version anomalies. Call it BEFORE adding or installing an npm, PyPI, Go or NuGet dependency. `decision`: block or quarantine = do not install; alert = installable but flagged; allow = ok; unknown = no record, not vetted: ask the user; unverified = the check did not complete: retry, then ask the user. Signing in adds the full install-time verdict (see `sign_in_adds`).	No	Yes	Not declared	Yes
`get_vulnerability`Full detail for one advisory id (CVE-..., GHSA-..., or an OSV id such as PYSEC-...): every affected package (`affected_packages`: package, ecosystem, ranges, fixed), the primary one's version ranges and fixed version, severity, CVSS, EPSS (probability of exploitation in 30 days), CISA KEV (exploited in the wild), references and how many packages depend on the affected one. Pass `package` / `ecosystem` to describe a specific affected package. Use it to explain an advisory to the user.	Full detail for one advisory id (CVE-..., GHSA-..., or an OSV id such as PYSEC-...): every affected package (`affected_packages`: package, ecosystem, ranges, fixed), the primary one's version ranges and fixed version, severity, CVSS, EPSS (probability of exploitation in 30 days), CISA KEV (exploited in the wild), references and how many packages depend on the affected one. Pass `package` / `ecosystem` to describe a specific affected package. Use it to explain an advisory to the user.	No	Yes	Not declared	Yes
`model_risk`CyberXYZ's public report on a Hugging Face model's install risk: risk level, XYZ score, the driving reason, the worst dependencies and recent risk events. verdict UNKNOWN (not watched, pending, gated) is not safe: ask the user. Signing in adds every reason, all flagged dependencies and per-file load safety.	CyberXYZ's public report on a Hugging Face model's install risk: risk level, XYZ score, the driving reason, the worst dependencies and recent risk events. verdict UNKNOWN (not watched, pending, gated) is not safe: ask the user. Signing in adds every reason, all flagged dependencies and per-file load safety.	No	Yes	Not declared	Yes
`package_info`CyberXYZ's public report for a package: every published advisory (CVE/GHSA ids, severity, CVSS, EPSS, KEV, affected ranges, fixed version), malicious-package records in full, how many packages depend on it, what it pulls in (counts and worst severity) and AI-model usage. Package-level; for a verdict on a specific version call check_package.	CyberXYZ's public report for a package: every published advisory (CVE/GHSA ids, severity, CVSS, EPSS, KEV, affected ranges, fixed version), malicious-package records in full, how many packages depend on it, what it pulls in (counts and worst severity) and AI-model usage. Package-level; for a verdict on a specific version call check_package.	No	Yes	Not declared	Yes
`search`Find a package by name across every ecosystem (exact match first, then prefix, then most advisories), with its advisory count and worst severity. Use it when you do not know a package's ecosystem or exact spelling; then call package_info or check_package.	Find a package by name across every ecosystem (exact match first, then prefix, then most advisories), with its advisory count and worst severity. Use it when you do not know a package's ecosystem or exact spelling; then call package_info or check_package.	No	Yes	Not declared	Yes

Details

Registry status: Active
Published: Nov 13, 2026
Updated: Nov 13, 2026
Website: Not given
Repository: Not given
Categories (suggested): Developer tools SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing