Contrast API MCP Server

Security intelligence, built for AI agents. Give your agent grounded answers about vulnerabilities, threats, and attack surface - backed by authoritative sources (NVD, CISA KEV, FIRST EPSS, MITRE ATLAS & D3FEND), never guesswork. CVE/KEV/CWE lookup with EPSS exploit-probability and composite risk scoring, domain & IP investigation, IOC enrichment, code-security checks, and live web intelligence. 55 tools, 7…. It is available as a remote MCP endpoint.

Teams that want a hosted security endpoint instead of running a local process. The project is written in Python.

VERIFIED ACTIVE

LAST COMMIT 2026-08-17 · ★ 33 · #115 OF 182 MAINTAINED SECURITY · VERIFIED 2026-08-25

MIT · Python servers · how we verify → /methodology

01 · Install Contrast API

before you install - you'll need

The README does not document required environment variables for a basic install.

Claude Code

claude mcp add upinar-contrastapi --transport http https://api.contrastcyber.com/mcp/

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "upinar-contrastapi": {
      "url": "https://api.contrastcyber.com/mcp/"
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

https://api.contrastcyber.com/mcp/

transport: streamable-http

endpoint alive - responded to MCP initialize · probed 2026-08-25

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as remote - your agent's requests go to api.contrastcyber.com

endpoint auth accepted our unauthenticated MCP initialize - no credentials needed to connect

license MIT - declared in the repository

registry vendor namespace com.contrastcyber - domain-verified with the official MCP registry

03 · What Contrast API can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Latest releases

v1.36.2 · 2026-08-24

Dependency pin: starlette 1.3.1 → 1.6.0. Verified against the full suite and · an MCP transport smoke covering both protocol eras - modern tools/list keeps · its resultType, the legacy header-less fast-path is…

v1.36.1 · 2026-08-24

Fixes a bare 500 on /mcp/. The gate buffers a request body to read the · JSON-RPC method, then hands the downstream app a replay callable. That callable · returned a synthetic http.disconnect on every call after the…

v1.36.0 · 2026-08-02

mcp SDK 1.28.1 → 2.0.0 (stable) + new mcp-types pin · Same /mcp endpoint now speaks both protocol eras: · - legacy 2025-11-25 clients - behavior unchanged (wire-compatible, no action needed) · - 2026-07-28 clients…

04 · Who maintains Contrast API

ContrastAPI is maintained by upinar. It's the only MCP server we track from this author; the repo dates to Mar 2026.

05 · Facts

repository: github.com/upinar/contrastapi
website: https://api.contrastcyber.com/
category: security - ranked #115 of 182 actively-maintained security servers as of 2026-08-25.
release cadence: 10+ releases in the last 90 days (latest 2026-08-24)
registry: com.contrastcyber/api (active, first published 2026-04-11 · 63 versions)

06 · Contrast API FAQ

What is Contrast API?

Is Contrast API still maintained?

Yes - as of 2026-08-25, its last commit was 2026-08-17 and it shipped 10+ releases in the last 90 days. We re-verify nightly.

How do I install Contrast API?

Run `claude mcp add upinar-contrastapi --transport http https://api.contrastcyber.com/mcp/`. The README does not document required environment variables for a basic install. You can also paste the ready-made client config above.

Does Contrast API require authentication?

No - the endpoint accepted our unauthenticated MCP initialize when probed on 2026-08-25; you can connect without credentials.

07 · Alternatives to Contrast API

Alternatives to Contrast API

Maintained security servers if Contrast API isn't the fit.

Pairs well with

Servers that cover what Contrast API doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Siteaudit MCP · Evernote · Pincer · Vuln Check · Cortex Gateway

More Python MCP servers · Release Gate · Vap E · Bastion (vaquarkhan) · Vaquill · Async Parallel Antigravity for Codex & Claude Code · see all