Open source · zero keys needed

Is this site secure? Just ask.

security-mcp gives your AI three security tools: grade any website's HTTPS setup from A+ to F, check if a CVE is actively exploited, and get MITRE ATT&CK defenses explained like a human. No API keys. No signup. It just works.

Install from PyPI GitHub

0API keys required

3tools

53tests passing

Three tools. Zero keys.

Every data source is free and public. That's the whole trick.

// audit_site

Grade any website A+ to F

Point it at a domain. Get a plain-English report on its TLS, headers, and certificate.

Checks protocols, ciphers, HSTS, cert validity
Explains what's wrong and why it matters
Great for "is this checkout page safe?" questions

// check_cve

Is this CVE actually dangerous?

Cross-references CISA's Known Exploited Vulnerabilities list and EPSS scores.

"Exploited in the wild" vs "theoretical" — instantly
Plain-English severity, no CVSS decoder ring needed

// lookup_attack

MITRE ATT&CK, translated

Look up any attack technique and get its defenses explained without the jargon.

Real technique IDs, real mitigations
Written for humans, not SOC analysts

How it works

No keys means no step two.

Install

pip install security-mcp

Plug in

Add it to Claude Desktop's config. That's it — there's no step 3.

Ask

"Audit example.com" or "is CVE-2024-1234 exploited?" Done.