Sectora

Name: Sectora
Author: BraineeTech

BraineeTech/sectora

BraineeTech/sectora

Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.

About

Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST. Exposes 14 MCP tools including io.github.megabrainee/sectora. Covers setup, configuration, and when-to-use guidance from upstream documentation for Sectora. Install via Claude Desktop, Cursor, or any MCP-compatible client using the upstream server manifest.

Threat intel + your scans/findings/Shield posture.
Configuration patterns for Sectora.
Evidence-backed steps from upstream documentation.
When-to-use criteria for Sectora versus alternatives.

Sectora by the numbers

Exposes 14 verified tools (MCP introspection)
Data as of Jul 9, 2026 (Skillselion catalog sync)

terminal

claude mcp add --transport http sectora https://mcp.sectora.io/mcp

Add your badge

Show developers this MCP server is listed on Skillselion. Paste this into your README.

[![Listed on Skillselion](https://skillselion.com/badge/mcp/tool/io.github.megabrainee/sectora.svg)](https://skillselion.com/mcp/tool/io.github.megabrainee/sectora)

Transport	HTTP
Auth	None
Tools	14
Repository	BraineeTech/sectora ↗

How do I connect Sectora to my MCP client?

Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.

Who is it for?

Teams wiring Sectora into Claude, Cursor, or custom agents for security & pentesting.

Skip if: Skip when you need a non-MCP SDK or hosted API without stdio/SSE transport.

What you get

Working Sectora MCP server with verified tool registration and client config.

Agent-grounded CVE/EPSS/KEV and package vuln answers
Context that references your findings and Shield posture
Faster security triage prompts during ship and operate

By the numbers

[object Object]

At a glance

Sectora capabilities & compatibility

Capabilities: sectora mcp tool registration · sectora client configuration · sectora agent workflow integration
Use cases: orchestration
Runs: Remote server

From the docs

What Sectora says it does

Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.

README.md

Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.

README.md

Tools 14

Public tool metadata - what this server can do for an agent.

lookup_cve1 param

Get full threat intelligence enrichment for a CVE including EPSS score, CISA KEV status, public exploits, Nuclei templates, risk level, and risk factors. Input must be a valid CVE ID.

cve_idstringrequiredCVE identifier in format CVE-YYYY-NNNNN (e.g., CVE-2024-3400)

assess_tech_risk1 param

Assess security risk for a list of technologies. Returns known CVEs affecting each technology with severity breakdown. Input: comma-separated technology names only.

technologiesstringrequiredComma-separated list of technology names (e.g., "Apache HTTP Server, OpenSSL, nginx"). Max 50 technologies.

search_cves4 params

Search for CVEs by keyword, severity, or other filters. Query must be alphanumeric text.

querystringrequiredSearch keyword (CVE ID, technology name, or description)
severitystringFilter by severity
is_kevstringOnly show CVEs in CISA KEV catalog
has_exploitstringOnly show CVEs with public exploits

get_kev_recent1 param

Get recently added entries to the CISA Known Exploited Vulnerabilities (KEV) catalog.

daysstringNumber of days to look back (1-365, default: 30)

get_trending_cves1 param

Get currently trending CVEs based on recent KEV additions, high EPSS scores, and exploit availability.

limitstringMaximum results to return (1-100, default: 20)

get_weaponization_score1 param

Get the weaponization score (0-100) for a CVE. Factors in EPSS, KEV status, exploit availability, Nuclei templates, and CVSS. Input must be a valid CVE ID.

cve_idstringrequiredCVE identifier in format CVE-YYYY-NNNNN (e.g., CVE-2024-3400)

lookup_ip_reputation1 param

Look up community IP reputation from Sectora Shield WAF network. Shows if an IP has been reported for attacks. Accepts IPv4 or IPv6 (the Shield network sees both).

ipstringrequiredIPv4 (e.g., 1.2.3.4) or IPv6 (e.g., 2606:4700::1) address to look up

get_threat_stats

Get statistics about the Sectora threat intelligence database including counts of EPSS scores, KEV entries, Nuclei templates, and exploits. No input required.

list_my_findings4 params

List the API key owner's open security findings across all scans. Use this to answer "what's my current exposure?" Filter by severity, status, or domain. Returns finding summaries; call get_scan for full detail. Requires API key.

severitystringComma-separated severities to include: critical, high, medium, low, info
statusstringFilter by confirmation status
domainstringLimit to a single domain (e.g., app.example.com)
limitstringMax findings (1-100, default: 25)

list_my_scans2 params

List the API key owner's recent scans with summary counts. Requires API key.

limitstringMax scans (1-100, default: 25)
statusstringFilter by status (queued, running, completed, failed)

get_scan1 param

Get a scan with all its findings (full detail: title, description, evidence, remediation, CVSS). Requires API key.

scan_idstringrequiredScan UUID

scan_url3 params

Kick off a DAST security scan against a public URL the API key owner controls. Two-step flow: first call returns a preview (target, profile, ETA, quota remaining); confirm by calling again with confirm:true to actually start the scan. Returns scan_id; poll status with get_scan. Domain must be verified in the Sectora account. Daily quota: 25 scans/24h per user. Requires API key.

urlstringrequiredFull URL to scan (must start with http:// or https://)
profilestringScan profile: quick (~2 min), standard (~10 min), deep (~30 min)
confirmstringSet to "true" to actually execute the scan. Without this, the call returns a preview only.

get_my_posture1 param

Get Shield WAF posture score and breakdown for a domain registered under this account. Returns 0-100 score, letter grade, per-component breakdown (origin lock, virtual patching, TLS, etc.), and edge_health (whether Shield is actually intercepting traffic). Requires API key.

domainstringrequiredDomain registered under your Sectora account

assess_dependency3 params

Check a single package@version for known vulnerabilities via OSV.dev (npm, PyPI, Go, Maven, NuGet, RubyGems, Packagist, crates.io, etc.). Returns advisories with CVE IDs, severity, fixed versions, and references. Free tier eligible.

namestringrequiredPackage name (e.g., "lodash", "django", "github.com/gorilla/mux")
versionstringrequiredExact version (e.g., "4.17.20")
ecosystemstringrequiredPackage ecosystem: npm, PyPI, Go, Maven, NuGet, RubyGems, Packagist, crates.io