Unstable preview. Pages, data and API fields can change or break without notice, so please don't rely on this for anything critical yet. See what has changed.
Agent Service Directory
Menu

VulnTracker

MCP server · api.vulntracker.io · found in a public list · checked since 2026-11-10

Live, handshake completed · latest check

As JSON

Checks dependency versions against vulnerability records, with affected and fixed versions.

Our summary of what its own text says it does: automated, not reviewed by a person (placement-ai/7). What this means

Placed in Scan code and dependencies: Scan packages, dependency lists, repositories and config files for vulnerabilities, malware and leaked secrets.

https://api.vulntracker.io/mcp MCP endpoint (Streamable HTTP)

The name is the registry's label, not ours. Not reviewed by a person.

Our checks

An unpaid request daily, from eastern North America

Last 1 checks, oldest to newest; room for 29 more

1 passed, 0 failed, 29 not run.

Passed, 30 daysshort history1 of 1 run
Checks missed0in 30 days
Response, latest833 mswhole handshake
Scheduledailyset by usage; rule below
Checked since2026-11-10under 1 day
Freshnessfreshagainst its schedule

Checked daily. Daily: 5 to 99 payers, and every new service until it has been probed 3 times.

Details

Tools listed by the server

add_to_boardcheck_dependenciescheck_versionlist_board_cardslist_trackingslookup_cveproduct_cvesproduct_versionsremediation_guidesearch_cvessearch_productstrackuntrackupdate_board_card

Tools
14
This list since
2026-11-10
First listed to us
2026-11-10
List changes, 90 days
0

Names as the server reported them at our latest completed handshake (mcp-handshake/2); a listed tool is not a tested one. Definitions

Access

Our latest check
Nothing asked
Stated
Credentials needed, by its MCP Registry entry (a secret header)
Payment model
not known
Currency
not known

"Nothing asked" describes one plain request, not every operation. Statements are claims, not our measurements. Definitions

Interface it declares

Protocol
MCP 2025-06-18
Capabilities
loggingpromptstools
Transports
streamable-http

As its initialize reply stated it at our check on (mcp-handshake/2): a claim, not tested. Definitions

Calls it declares

  • add_to_board cve_ids* notes status
  • check_dependencies items*
  • check_version limit product* role version*
  • list_board_cards archived exploited kev limit page query remediation severity status
  • list_trackings
  • lookup_cve cve_id*
  • product_cves entry_kind limit offset product*
  • product_versions limit product* search
  • remediation_guide cve_id*
  • search_cves exploited limit product published_after published_before query remediation severity tracked_only vendor
  • search_products limit query* vendor
  • track exploited_only min_severity notes target* type version_filter

From the tool list it returned to our check (request-shape/2). * marks a required parameter; after → the fields it says it returns. What it declares, not that a call works.

Listing

In the capability tree: Identity, security and compliance / Security / Scan code and dependencies (primary); Identity, security and compliance / Security / Look up vulnerabilities and advisories. Placed by three checks by a small AI model: placed, found blind from its tasks, and verified against its own text (placement-ai/7, tree/3) on 2026-11-10. Wrong place? Tell us.

In the directory: meets our listing criteria (listing-criteria/6): ✓ says what it does; ✓ its latest check passed.

Recent probes

WhenResultTime to headers

cloudflare:MIA		 Live, handshake completed HTTP 200 833 ms

What these figures do not show

  • A passing check means the server completed the MCP handshake with us (initialize, then tools/list, with no credentials; mcp-handshake/2) or asked for credentials first (HTTP 401). It does not show that the server's tools work or what they return. Tool names are as the server listed them.
  • Listed in the Official MCP Registry; this data comes from the Official MCP Registry. Its listing's description is not republished.
  • Limited evidence: monitored for under 1 day (less than 30).

Something wrong here?

Operate this service and want it reviewed, corrected or removed? Email hello@agentservicedirectory.com or use the opt-out page. A wrong place in the tree? Tell us.

Machine-readable: /api/v1/services/cand_2ab082527a5fbae8