Contrastapi

What UPinar/contrastapi MCP server does

UPinar/contrastapi MCP server gives AI agents access to security intelligence through the Model Context Protocol. Its 55 tools cover several investigation areas: vulnerability and weakness lookups for CVE, CWE, EPSS, and CISA KEV; attack-technique and defensive-knowledge catalogs from MITRE ATLAS and D3FEND; domain and IP research; IOC enrichment; email, phone, and username OSINT; web intelligence; and code-security checks for issues such as exposed secrets and injection risks.

The service is intended for security research, triage, attack-surface investigation, and evidence-based answers. Responses can include verdict metadata such as queried sources, unavailable sources, data age, completeness, and fields that can be independently checked. CVE results may also provide suggested follow-up calls, helping an agent continue from a finding to related KEV or CWE data.

How it works

The hosted MCP endpoint is available at https://api.contrastcyber.com/mcp/. An MCP client starts npx -y mcp-remote and passes that endpoint as its target. The server then exposes the available tools, Resources, and Prompts to the connected agent. The project also provides Python and Node.js SDKs for applications that need direct access to its HTTP endpoints rather than MCP.

Seven MCP Resources support browsing the ATLAS, D3FEND, and CWE catalogs. Three Prompts are available, including a conditional triage Prompt. The underlying service documents more than 60 REST endpoints and publishes an OpenAPI specification.

Setup and configuration

For a general MCP client, add a server entry like this:

{
  "mcpServers": {
    "contrastapi": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://api.contrastcyber.com/mcp/"]
    }
  }
}

Restart the client after saving the configuration. Claude Desktop users can instead download the .mcpb file from the latest GitHub release and install it through the Extensions settings. The provided setup instructions state that no signup or API key is needed. The service is described as free with a limit of 100 requests per hour.

Tools and capabilities

UPinar/contrastapi MCP server includes tools for:

• Looking up CVEs, CWEs, KEV membership, and EPSS-based exploit probability.
• Investigating domains and IPs through DNS, WHOIS, SSL, subdomains, and certificate-transparency data.
• Enriching indicators of compromise and querying threat intelligence.
• Checking email, phone, and username information for OSINT research.
• Running code-security checks for secrets and injection-related problems.
• Querying web intelligence such as robots_txt, redirect chains, email verification, brand assets, SEO audits, and geo audits.

The web-intelligence functions apply per-target throttling, respect robots.txt, and do not perform SMTP probing. SDK packages are available for Python 3.10+ and Node 14+, with synchronous and asynchronous Python support and typed responses.

Limitations and notes

The server depends on the hosted ContrastAPI endpoint, so client access requires network connectivity to that service. The documented free usage limit is 100 requests per hour. Results are tied to the availability and age of upstream sources; response metadata identifies sources queried or unavailable when provided.

The repository describes the project as MIT licensed. It does not claim that every result is complete or current, so agents should inspect source and age metadata before relying on findings. Web-intelligence features have the stated ethical restrictions, including robots.txt compliance, target throttling, and no SMTP probing.