Next free-source huntWe check for new free data every weekday.
Cyber ThreatMCP serverFirst audited Nov 13, 2026

Vigía

What breaks between versions, vulnerabilities, compatible versions, EOL dates: npm, PyPI, Rust, PHP.The vendor's description, from its MCP Registry listing.

Passed public checksAudited Nov 13, 2026

Every public check ran and passed. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit

Does it work?
YesConnected in 500 ms.
Sign-up?
None neededIt answered without any account or key.
Can it change things?
No, read-onlyAll 12 tools say they only read.
Endpointhttps://vigia.coredls.cloud/mcp

Source code Website Streamable HTTP · protocol 2025-11-25 · server version 0.6.0

What we checked, the evidence, and the tools it offers.

What we checked

Security

  • Passed: Connections are encrypted (HTTPS).

  • Passed: No hidden instructions found in tool text.

Safety labels

  • Passed: Every tool says whether it only reads or can change things.

Tools

  • Passed: 12 tools listed.

  • Passed: Every tool describes its inputs with a valid schema.

Protocol

  • Passed: The MCP handshake works (Streamable HTTP).

  • Passed: Protocol version 2025-11-25 (latest).

  • Passed: Unknown requests are refused.

Connection

  • Passed: The server responds.

Tools (12)

As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.

  • package_statusReturns the current state of one package: latest stable version and its publish date, status (active / deprecated / yanked / not_found_in_registry), the deprecation message if any, runtime requiremen…Read-only
  • list_versionsLists the published versions of one package, newest first, each with its publish date, a prerelease flag and whether it is withdrawn (npm: deprecated; PyPI and crates.io: yanked; Packagist: abandoned…Read-only
  • upgrade_impactReports what changes between two versions of an npm package by diffing the public TypeScript API of both releases (only the type declarations are analyzed; package code is never executed): removed ex…Read-only
  • symbol_statusChecks whether an exported function, class, type or constant (or a Class.member) exists in a specific version of an npm package, using the package's TypeScript declarations. Returns whether it was fo…Read-only
  • find_compatible_versionFinds the newest stable, non-withdrawn version of a package whose own declared requirements admit the runtimes you give it: npm engines and peerDependencies, PyPI Requires-Python, Rust rust-version (…Read-only
  • version_statusReports on one exact version of an npm, PyPI, crates.io or Packagist package: whether that version exists, when it was published, whether it is withdrawn (npm deprecated, PyPI and crates.io yanked, P…Read-only
  • check_dependenciesAudits a whole manifest in one call. For every dependency in a package.json (dependencies and devDependencies) or a requirements.txt it returns the latest version, whether the declared range includes…Read-only
  • recent_changesLists the changes Vigia detected recently, newest first: new package releases (with old and new version), deprecations, yanks and removals, runtime-requirement changes, AI model price changes and mod…Read-only
  • model_statusLooks up AI models in the OpenRouter catalog: price per million input and output tokens in USD, context window, maximum output tokens, knowledge cutoff, supported modalities and announced retirement…Read-only
  • eol_statusTells whether a language, runtime, framework, database or operating-system version is still supported and when it reaches end of life. Covers about 480 products (Python, Node.js, PHP, Java, Ruby, Go,…Read-only
  • changes_since_cutoffReturns what happened in software after a given date, so an agent can patch the gap between its training data and today: packages among the most popular on npm, PyPI, crates.io and Packagist that shi…Read-only
  • find_packageSearches the catalog of tracked packages and AI models by case-insensitive name prefix and returns up to 15 matches ordered by popularity, each with its ecosystem, name and popularity rank. Read-only…Read-only

Audit history

  1. Nov 13Passed

What we sent

Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.

RequestAnswerTime
initializeHTTP 200500 ms
initializedHTTP 202731 ms
tools/listHTTP 200270 ms
unknown-methodHTTP 200134 ms

Run this server, or disagree with the result?

Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.