Skip to main content

Cybersecurity Threat Intelligence MCP

by io.github.FoundryNet

Server Details

CVE search, vulnerability database, EPSS exploit prediction, KEV, IP reputation & threat feed.

If you are the author of this connector, you can claim ownership with GitHub, an HTTP challenge, or a DNS record. Claimed connector authors can inspect health checks, view analytics, and manage their listing.

Status: Unhealthy
Last Tested: 2026-09-06 06:41
Transport: Streamable HTTP
URL
Repository: FoundryNet/cyber-intel-mcp
GitHub Stars: 0
Server Listing: Cybersecurity Threat Intelligence MCP

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

7 tool updatesJul 16, 2026

Changedbrief_summary1 field changed

changedInput schema / properties / payment_tx / description

Previous value: -"Solana tx signature, when re-calling after a 402."New value: +"payment transaction reference, when re-calling after a 402."

Changedcheck_domain1 field changed

changedInput schema / properties / payment_tx / description

Previous value: -"Solana tx signature, when re-calling after a 402."New value: +"payment transaction reference, when re-calling after a 402."

Changedcheck_ip1 field changed

changedInput schema / properties / payment_tx / description

Previous value: -"Solana tx signature, when re-calling after a 402."New value: +"payment transaction reference, when re-calling after a 402."

Changeddaily_brief2 fields changed

changedInput schema / properties / payment_tx / description

Previous value: -"Solana tx signature, when re-calling after a 402."New value: +"payment transaction reference, when re-calling after a 402."

changedInput schema / properties / stripe_token / description

Previous value: -"Stripe Checkout Session id (cs_…), when re-calling after\npaying the Stripe payment link (alternative to x402). Can also be\nsupplied via the X-Stripe-Token header."New value: +"Stripe Checkout Session id (cs_…), when re-calling after\npaying the Stripe payment link (alternative to the metered rail). Can\nalso be supplied via the X-Stripe-Token header."

Changedsearch_cve1 field changed

changedInput schema / properties / payment_tx / description

Previous value: -"Solana tx signature, when re-calling after a 402."New value: +"payment transaction reference, when re-calling after a 402."

Changedthreat_feed1 field changed

changedInput schema / properties / payment_tx / description

Previous value: -"Solana tx signature, when re-calling after a 402."New value: +"payment transaction reference, when re-calling after a 402."

Changedvulnerability_scan1 field changed

changedInput schema / properties / payment_tx / description

Previous value: -"Solana tx signature, when re-calling after a 402."New value: +"payment transaction reference, when re-calling after a 402."

1 tool updateJun 22, 2026
- Addedbrief_summary

1 tool updateJun 21, 2026

Changeddaily_brief1 field changed

addedInput schema / properties / stripe_token

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Stripe Checkout Session id (cs_…), when re-calling after\npaying the Stripe payment link (alternative to x402). Can also be\nsupplied via the X-Stripe-Token header."
+}

1 tool updateJun 19, 2026
- Addeddaily_brief
7 tool updatesJun 18, 2026
- First observedcheck_domain
- First observedcheck_ip
- First observedcve_detail
- First observedmint_info
- First observedsearch_cve
- First observedthreat_feed
- First observedvulnerability_scan

Frequently Asked Questions

Claiming proves that you control a remote MCP connector. It does not move, proxy, or interrupt the server.

Open the connector listing, choose Claim ownership, and sign in to Glama.
Complete one verification method:
- GitHub identity — fastest for official registry listings. For a namespace such as io.github.alice/server, link the matching GitHub user, then choose Claim with GitHub. An organization namespace such as io.github.acme/server also needs that organization to have installed the Glama AI GitHub App and approved its permissions, because GitHub discloses organization membership only to apps it has installed. Use HTTP or DNS when it has not.
- HTTP challenge — works when you can deploy a public file. Generate a token, publish the exact JSON Glama shows at /.well-known/glama.json on the same origin as the connector, then choose Check HTTP challenge.
- DNS challenge — works when you control DNS but cannot change the server. Generate a token, create the exact TXT record Glama shows, wait for it to propagate, then choose Check DNS challenge.
After verification, Glama sends a confirmation email and gives you access to listing details, thumbnails, health checks, and analytics. Keep the HTTP file or DNS record in place: Glama periodically checks it and ownership remains verified while the token is discoverable.

The HTTP ownership file has this structure:

{
  "$schema": "https://glama.ai/mcp/schemas/connector.json",
  "claim": "glama_claim_..."
}

Claim tokens are opaque, stable, and bound to the signed-in Glama account. They contain no email address or other personal information. If Glama can no longer discover a verified HTTP or DNS token, it starts a seven-day grace period before removing claim-based access. Restore the same token during that period to keep ownership verified. Never publish an email address, Glama session token, GitHub token, or connector credential as ownership proof.

If verification fails, confirm that you copied the current token exactly. The HTTP file must be public, return valid JSON with a successful HTTP response, and stay on the connector's origin. DNS changes may need more time to propagate. A claim cannot transfer to a different origin or hostname: if the connector target changes, Glama starts the grace period and the new target must be claimed separately after the previous claim is released.

For a connector linked to the official MCP Registry, registry updates continue to replace its name, description, and URL by default. After claiming, open Manage connector and enable Use Glama listing details as the source of truth if edits made on Glama should be preserved. Categories and thumbnails are always managed on Glama; registry linkage and technical connection settings continue to sync.

Discussions

No comments yet. Be the first to start the discussion!

Login with GitHub to comment

Related MCP Connectors

NotCVE — CVE & Vulnerability IntelligenceOAuth
org.notcve
CVE & vulnerability search: 365k+ CVEs/NotCVEs, CVSS, EPSS, CISA KEV, exploits, patches, versions.
Security Penetration Testing Search
2
sectora A
io.github.megabrainee
Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.
Security Monitoring AI & Machine Learning
142
cve-intelligence A
com.cve-security
CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions. All tools keyless.
Security Monitoring Observability
61
Vulnerability Intel MCP
net.nexlab
Defensive vulnerability intelligence search across public CVE/NVD and GitHub advisory APIs with CVSS
1

Related MCP Servers

CVE Intelligence MCP Server
Penetration Testing Security
gopichand458
A
license
Not graded
quality
D
maintenance
Provides multi-source vulnerability intelligence for AI-powered security operations, combining NVD CVSS, CISA KEV, and EPSS scores without requiring an API key.
Updated 7 months ago (2026-02-15 15:08 UTC)
1
MIT
vuln-intel-mcp
Security Penetration Testing
rohanrajnist
A
license
Not graded
quality
C
maintenance
Provides CVE lookup, search, and exploit intelligence from public vulnerability sources (NVD, CISA KEV, EPSS) for AI agents to produce remediation guidance without consuming LLM tokens for data fetching.
Updated 2 months ago (2026-07-06 06:18 UTC)
1
MIT
nist-nvd-mcp-server
Security Government Data Research & Data
cyanheads
A
license
Not graded
quality
A
maintenance
Search and audit CVEs by keyword, severity, CWE, CISA KEV status, and CPE via the NIST National Vulnerability Database.
Updated 12 days ago (2026-08-25 05:56 UTC)
501
1
Apache 2.0
MCP CVE Intelligence Server
Penetration Testing Research & Data
gnlds
A
license
Not graded
quality
F
maintenance
Provides unified access to vulnerability data from NVD, MITRE, and GitHub Security Advisories for cybersecurity intelligence.
Updated a year ago (2025-08-06 17:55 UTC)
53
19
MIT

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.3/5.0

Disambiguation5/5

Each tool targets a distinct resource: domain, IP, CVE, threat feed, daily brief, product scan, and meta-info. The only closely related pair (brief_summary vs daily_brief) is explicitly differentiated as a cheap sample vs full brief, so no real ambiguity exists.

Naming Consistency4/5

All tool names use lowercase snake_case, but the grammatical pattern is mixed: some are verb_noun (check_domain, check_ip, search_cve) while others are noun_noun or adjective_noun (cve_detail, daily_brief, threat_feed, vulnerability_scan, mint_info, brief_summary). The style is consistent, but the verb-first convention is not uniform.

Tool Count5/5

Nine tools cover the core threat-intelligence workflows without bloat: reputation lookups, CVE search/details, vulnerability scanning, briefs, and a live feed. This is a well-scoped count for the domain.

Completeness4/5

The server covers IP and domain reputation, CVE research, product scanning, and daily briefs, but lacks a single-tool lookup for hash or URL reputation (only available via the generic threat_feed). This is a workable minor gap since the feed can filter by those types, but a dedicated check_hash or check_url tool would make the surface fully complete.

Resources