ContrastAPI Security Tools

Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.

Canonical URL

https://heyclau.de/entry/mcp/contrastapi-mcp-server

Source URLs

https://api.contrastcyber.com, https://github.com/UPinar/contrastapi

Brand

ContrastAPI

Brand domain

contrastcyber.com

Brand asset source

brandfetch

Safety notes

Treat CVE, EPSS, KEV, IOC, and OSINT enrichment as advisory input that still needs security review before acting on it.

Privacy notes

Queried domains, IPs, dependencies, vulnerabilities, and indicators can reveal investigation targets and may enter model context.

Author

UPinar

Submitted by

UPinar

Original submission

https://github.com/JSONbored/awesome-claude/issues/304

Import PR

https://github.com/JSONbored/awesome-claude/pull/311

Reviewed by

JSONbored

Claim status

unclaimed

Last verified

2026-04-20

• Queried domains, IPs, dependencies, vulnerabilities, and indicators can reveal investigation targets and may enter model context.

Show that ContrastAPI Security Tools is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

[![Listed on HeyClaude](https://heyclau.de/badge/mcp/contrastapi-mcp-server.svg)](https://heyclau.de/entry/mcp/contrastapi-mcp-server)

ContrastAPI Security Tools side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

Field	ContrastAPI Security Tools 49 remote MCP security tools for CVE/KEV/CWE/EPSS lookup, composite CVSS+EPSS+KEV+PoC risk scoring, CVSS v3.x vector parsing, domain/IP/IOC enrichment, dependency and web intelligence checks, MITRE ATLAS AI/ML attacks, and MITRE D3FEND defenses. Anonymous tier available; Pro tier uses an API key. Open dossier	CVE MCP Server Security intelligence MCP server that lets Claude look up CVEs, EPSS scores, CISA KEV status, OSV package vulnerabilities, exploit indicators, MITRE mappings, IP reputation, passive DNS, Shodan host data, malware intelligence, URL safety, and risk reports across optional third-party APIs. Open dossier	Burp Suite MCP Server PortSwigger's Burp Suite MCP Server extension connects Burp Suite to MCP clients through an SSE server or packaged stdio proxy for request, Repeater, Intruder, history, scanner, Collaborator, and configuration workflows. Open dossier	ENScan_GO MCP Server Go-based enterprise-information gathering MCP server for authorized security research, exposing local SSE tools for company search, ICP records, apps, Weibo, WeChat public accounts, mini programs, recruiting data, copyright records, suppliers, investments, branches, and paginated data-source queries. Open dossier
Trust	Review first	Review first	Review first	Review first
Install risk	Review first	Review first	Review first	Review first
Notes	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓
Brand	ContrastAPI	—	Burp Suite MCP Server	—
Category	mcp	mcp	mcp	mcp
Source	source-backed	source-backed	source-backed	source-backed
Author	UPinar	Mahipal Jangra	PortSwigger	WgpSec
Added	2026-04-20	2026-06-06	2026-06-06	2026-06-06
Platforms	Claude CodeCodexCursorClaude Desktop	Claude CodeClaude Desktop	Claude CodeClaude Desktop	Claude CodeClaude Desktop
Source repo	—	—	—	—
Safety notes	✓Treat CVE, EPSS, KEV, IOC, and OSINT enrichment as advisory input that still needs security review before acting on it.	✓CVE, CVSS, EPSS, KEV, exploit, PoC, MITRE, package-advisory, malware, and IP-reputation data can be stale, incomplete, provider-specific, or false positive. Treat generated risk scores and vulnerability reports as triage aids, not patch policy, incident-response authority, or compliance evidence by themselves. Some tools can submit or query URLs, IP addresses, domains, file hashes, package names, repository search terms, and exploit indicators against third-party services. Shodan, URLScan, VirusTotal, AbuseIPDB, GreyNoise, CIRCL, GitHub, VulnCheck, NVD, OSV, and other providers may apply rate limits, visibility rules, account terms, and retention policies. Review provider defaults before scanning URLs or infrastructure because some services can expose submitted targets or scan metadata publicly. The project documentation says the server uses outbound HTTPS only and blocks private/internal IP lookups, but users should still avoid unauthorized reconnaissance or sensitive internal target submission.	✓Burp Suite MCP Server can send HTTP/1.1 and HTTP/2 requests, create Repeater tabs, send requests to Intruder, toggle Proxy Intercept, pause or resume Burp's task execution engine, and update the active message editor. In Burp Suite Professional it can also expose scanner issues and generate or poll Collaborator payloads for out-of-band testing. The extension includes approval flows for outbound HTTP requests and sensitive data access, but users can configure always-allow targets and disable some approval requirements. Configuration editing tools can import project-level or user-level Burp options when enabled in the extension, which can change proxy, scanner, target, and other Burp behavior. Use only on systems and applications where testing is authorized; active requests, Intruder traffic, scanner workflows, and Collaborator payloads can affect third-party services. Keep the MCP server bound to trusted local interfaces and avoid exposing the SSE server to untrusted networks.	✓ENScan_GO is security-research tooling intended for authorized HW/SRC and red-team-style enterprise information gathering. Use only public data sources and authorized accounts; the upstream README says it does not provide cracking or protection-bypass capabilities. Configure request delays, narrow fields, and scoped targets to reduce load on upstream data platforms and avoid account anomalies. Do not use the tool for harassment, doxxing, unauthorized profiling, commercial scraping outside provider terms, or unlawful intelligence gathering. The local SSE MCP server can expose configured data-source access to any MCP client that can reach the endpoint; bind it locally and avoid exposing the port on shared networks.
Privacy notes	✓Queried domains, IPs, dependencies, vulnerabilities, and indicators can reveal investigation targets and may enter model context.	✓Security queries can reveal vulnerable products, internal triage priorities, asset names, IP addresses, domains, URLs, file hashes, package versions, malware interests, and investigation targets to upstream APIs. API keys are loaded from environment variables; keep them scoped, rotated, and out of model transcripts, shell history, and shared configuration files. The implementation initializes a local SQLite cache and rotating audit log, which can retain query parameters, statuses, timings, source results, and security-investigation context. Audit logging redacts fields whose names include key or token, but other query values can still be sensitive and should be protected as security data. The repository license file is Apache-2.0 while the README badge and pyproject classifier currently mention MIT, so verify current licensing before redistribution or commercial reuse.	✓Proxy HTTP history, WebSocket history, Organizer items, scanner issues, request and response bodies, headers, cookies, tokens, session identifiers, and Collaborator interaction data may be returned to the MCP client. The extension can read project-level and user-level Burp configuration; upstream code filters some configuration credentials when configured, but users should still treat exported options as sensitive. MCP prompts, responses, Burp logs, and client transcripts can retain target URLs, credentials, payloads, vulnerability details, and proprietary application behavior. The stdio proxy and SSE server bridge Burp traffic into the MCP client process; keep client configs, proxy paths, and Burp project files protected.	✓Queries, company names, PIDs, ICP records, apps, Weibo accounts, WeChat public accounts, mini programs, recruiting data, copyright records, suppliers, investments, branches, and exported results can be sent to the MCP client and model. ENScan_GO configuration can contain cookies, Tianyancha IDs, auth tokens, API tokens, RiskBird cookies, Qimai cookies, MIIT API endpoints, proxy settings, and user-agent strings. Generated JSON, XLSX, cache files, logs, prompts, and transcripts can reveal target organizations, subsidiaries, suppliers, public accounts, and investigation scope. Keep cookies and API tokens out of prompts, restrict file permissions on the generated config, and clean up exports or `enscan.gob` cache files according to engagement rules.
Prerequisites	— none listed	Python 3.10 or newer for the source project, or a Python version supported by the currently published package. pip, uv, or another supported Python package installer. Network access to the selected vulnerability, threat-intelligence, and package-advisory APIs. Optional API keys for NVD, GitHub, VulnCheck, AbuseIPDB, VirusTotal, URLScan, Shodan, GreyNoise, or CIRCL Passive DNS when those integrations are needed.	Burp Suite Community or Professional with Java extension support. Java and the `jar` command available for building and loading the extension. Gradle wrapper execution allowed for building `build/libs/burp-mcp-all.jar` from source. An MCP client that can connect to the Burp SSE server or run the packaged stdio proxy.	Downloaded ENScan_GO release binary for your operating system, or Go 1.23-compatible tooling to build from source. First-run configuration generated with `./enscan -v`. Valid, authorized cookies or API credentials for the selected enterprise-data sources. Local MCP client support for SSE transport, or a trusted stdio-to-SSE bridge if your client does not connect to SSE endpoints directly.
Install	claude mcp add --transport http contrastapi https://api.contrastcyber.com/mcp/ Copy install	pip install cve-mcp-server Copy install	./gradlew embedProxyJar Copy install	Download an ENScan_GO release archive, configure credentials with ./enscan -v, then run ./enscan --mcp Copy install
Config	{ "mcpServers": { "contrastapi": { "url": "https://api.contrastcyber.com/mcp/", "type": "http" } } } Copy config	{ "mcpServers": { "cve-mcp": { "command": "cve-mcp", "env": { "NVD_API_KEY": "", "GITHUB_TOKEN": "", "VULNCHECK_TOKEN": "", "ABUSEIPDB_KEY": "", "VIRUSTOTAL_KEY": "", "URLSCAN_KEY": "", "SHODAN_KEY": "", "GREYNOISE_API_KEY": "", "CIRCL_PDNS_USER": "", "CIRCL_PDNS_PASS": "", "CACHE_DB_PATH": "", "AUDIT_LOG_PATH": "" } } } } Copy config	Manual-only setup: ./gradlew embedProxyJar Copy config	{ "mcpServers": { "enscan-go": { "url": "<loopback-sse-url>" } } } Copy config
Citations	Source repositorygithub.com 2026-04-30T11:16:21.000Z Documentationapi.contrastcyber.com Reviewed by JSONbored2026-04-30T11:16:21.000Z Submitted by UPinar2026-04-20T15:29:10.000Z Source methodology →	Source repositorygithub.com 2026-07-04T21:34:14+00:00 Documentationgithub.com Submitted by oktofeesh12026-06-06 Source methodology →	Source repositorygithub.com 2026-07-04T21:34:14+00:00 Documentationraw.githubusercontent.com Submitted by oktofeesh12026-06-06 Source methodology →	Source repositorygithub.com 2026-07-04T21:34:14+00:00 Documentationgithub.com Submitted by oktofeesh12026-06-06 Source methodology →
Claim	Unclaimed	Unclaimed	Unclaimed	Unclaimed

Source-backed guides for putting this to work.

guides

Microsoft MCP for Beginners

Learn MCP through Microsoft's hands-on curriculum for servers, clients, security, transports, auth, deployment, Azure, VS Code, and cross-language examples.

Review firstSource-backedReview firstAdded 17d ago

Safety ✓ Privacy ✓by Microsoft

Copy install

guides

Auditing MCP Client Configuration Before Team Rollout

Audit MCP client configuration before sharing it with a team.

Review firstSource-backedReview firstAdded 25d ago

Safety ✓ Privacy ✓by YB0y

Copy install

guides

Auto Mode Hard-Deny Policies For Safe Automation

Set autoMode.hard_deny rules to block risky actions in auto mode.

Review firstSource-backedReview firstAdded 22d ago

Safety ✓ Privacy ✓by kiannidev

Copy install

• Best list: Security-reviewed MCP servers and agent tools