agentmods.dev

api

api is an MCP server for Cursor from UPinar/contrastapi. Its token cost is not measured, scanned A, original, MIT.

A remote security service with 31 tools for checking software vulnerabilities, threat information, exposed intelligence, dependency risks, and code security. It uses the Model Context Protocol (MCP), a standard way for AI assistants to call tools.

In plain words
What is it for?
Looking up CVEs, checking known exploited vulnerabilities, reviewing dependencies, gathering threat intelligence, and examining code-security risks.
Why use it?
It lets a coding assistant investigate security issues and dependencies without requiring a separate API key in the provided setup.

MCP server for Cursor

Written for Cursor: shipped in a Cursor plugin.

Part of the contrastapi plugin — 1 MCP server shipped together

not rated 34repo +1 today A scan tokens not measured original MIT

Good fit Looking up CVEs, checking known exploited vulnerabilities, reviewing dependencies, gathering threat intelligence, and examining code-security risks.

Compare 6 mcp servers from other repositories ↓
Install with agentmods
npx agentmods add mcp/upinar/contrastapi/api
View source ↗ UPinar/contrastapi api.contrastcyber.com
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo
git clone --depth 1 https://github.com/UPinar/contrastapi

Made for: Cursor.

Or install contrastapi, the plugin that ships this one along with the rest of its 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for api

README.md
[![agentmods](https://agentmods.dev/badge/mcp/upinar/contrastapi/api/github.svg)](https://agentmods.dev/mcp/upinar/contrastapi/api)
Your own site
<a href="https://agentmods.dev/mcp/upinar/contrastapi/api"><img src="https://agentmods.dev/badge/mcp/upinar/contrastapi/api/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for api

Your own site · 80×15
<a href="https://agentmods.dev/mcp/upinar/contrastapi/api"><img src="https://agentmods.dev/badge/mcp/upinar/contrastapi/api.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session not measured What this adds to a session before it is invoked.
When invoked not measured Not applicable: nothing here is loaded into a session.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Security

Grade A, and why

api scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

listed in the official MCP registry · 6 lines

What it actually says

{ "api": { "url": "https://api.contrastcyber.com/mcp/", "type": "streamable-http" } }

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 6 lines scan A 757ac012dc13

Subscribe to this mod's changes

api is an MCP server published in the GitHub repository UPinar/contrastapi (34 stars, last pushed today), licensed MIT. Its token cost is not measured: an MCP server costs its tool schemas, not its config file. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIsCVESecurityapicybersecuritymcposint
Related

Other mcp servers, from other repositories

openosint

AI-powered OSINT agent, MCP server, and CLI. Interactive REPL + 19 tools. Anthropic Claude or local Ollama. For authorized security research use only. Runs locally from the openosint Python package. Needs 5 environment variables to run.

OpenOSINT/OpenOSINT · not measured

developers-mcp

Access Mastercard Developers APIs, documentation, and API specifications through MCP. Runs locally from the @mastercard/developers-mcp npm package.

Mastercard/developers-agent-toolkit · not measured

stitchapi-docs

StitchAPI documentation search, running locally over MCP stdio. Bundled docs, no network calls per query — the offline/air-gapped counterpart to the hosted stitchapi.dev/api/mcp server. Runs locally from the @stitchapi/docs-mcp npm package.

rejifald/StitchAPI · not measured

bankapi-v1-azurecontainerapps

MCP server "bankapi-v1-azurecontainerapps", hosted remotely at app.bravestone-75bd2261.germanywestcentral.azurecontainerapps.io, as configured in erwinkramer/bank-api.

erwinkramer/bank-api · not measured

bankapi-v1-local

MCP server "bankapi-v1-local", hosted remotely at localhost, as configured in erwinkramer/bank-api.

erwinkramer/bank-api · not measured

mcp-server

350+ production-ready APIs through one MCP server — weather, geocoding, validation, financial data. Remote server at api.apiverve.com.

apiverve/mcp-server · not measured