What this MCP does
Supports DORA-oriented ICT risk and compliance work with vulnerability, breach, threat, cloud-provider, incident-timeline, third-party-risk, and TLPT information.
Capabilities
Tools
15
tools
breach_check
HaveIBeenPwned breach database — check domain/company breach exposure. DORA Art. 18 incident assessment.
Input schema
{'type': 'object', 'properties': {'limit': {'type': 'integer', 'default': 20, 'maximum': 50, 'minimum': 1, 'description': 'Max results 1-50 (default: 20)'}, 'domain': {'type': 'string', 'description': "Company domain e.g. 'meinbank.de' (optional — omit for latest breaches)"}}, 'additionalProperties': False}
cert_advisories
CERT-Bund security advisories — authoritative DE source for ICT threats. DORA Art. 17 threat monitoring.
Input schema
{'type': 'object', 'properties': {'limit': {'type': 'integer', 'default': 15, 'maximum': 30, 'minimum': 1, 'description': 'Max results 1-30 (default: 15)'}, 'keyword': {'type': 'string', 'description': "Filter by keyword e.g. 'Windows', 'Apache', 'Cisco'"}}, 'additionalProperties': False}
cloud_status
Live status of AWS, GCP, Azure cloud providers. DORA Art. 28 third-party ICT risk monitoring.
Input schema
{'type': 'object', 'properties': {'limit': {'type': 'integer', 'default': 10, 'description': 'Max incidents per provider (default: 10)'}, 'provider': {'type': 'string', 'description': 'Provider: aws, gcp, azure, all (default: all)'}}, 'additionalProperties': False}
cve_latest
Latest critical CVEs — daily DORA ICT risk briefing. Filter by severity and banking relevance.
Input schema
{'type': 'object', 'properties': {'days': {'type': 'integer', 'default': 7, 'description': 'Last N days (default: 7)'}, 'limit': {'type': 'integer', 'default': 10, 'maximum': 20, 'minimum': 1, 'description': 'Max results 1-20 (default: 10)'}, 'severity': {'type': 'string', 'description': 'CRITICAL, HIGH, MEDIUM (default: CRITICAL)'}, 'banking_only': {'type': 'boolean', 'description': 'Filter to banking-relevant vendors only (default: false)'}}, 'additionalProperties': False}
cve_search
Search CVEs by keyword, vendor or product. Returns CVSS scores, attack vectors, DORA pillar mapping.
Input schema
{'type': 'object', 'properties': {'days': {'type': 'integer', 'default': 30, 'description': 'Published within last N days (default: 30)'}, 'limit': {'type': 'integer', 'default': 10, 'maximum': 20, 'minimum': 1, 'description': 'Max results 1-20 (default: 10)'}, 'vendor': {'type': 'string', 'description': "Vendor/product e.g. 'SAP', 'Cisco', 'Microsoft Exchange'"}, 'keyword': {'type': 'string', 'description': "Search keyword e.g. 'authentication bypass', 'remote code execution'"}, 'severity': {'enum': ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW'], 'type': 'string', 'description': 'CVSS severity: CRITICAL, HIGH, MEDIUM, LOW'}}, 'additionalProperties': False}
dora_calendar
DORA compliance milestones and upcoming deadlines for financial institutions. All Art. references included.
Input schema
{'type': 'object', 'properties': {}, 'additionalProperties': False}
dora_news
EBA/DORA regulatory news for banks. Topics: general, eba, incident, third_party, testing, guidelines, bafin, swift.
Input schema
{'type': 'object', 'properties': {'lang': {'type': 'string', 'description': 'Language: en or de (default: en)'}, 'limit': {'type': 'integer', 'default': 10, 'maximum': 20, 'minimum': 1, 'description': 'Max articles 1-20 (default: 10)'}, 'topic': {'type': 'string', 'description': 'Topic: general, eba, incident, third_party, testing, guidelines, bafin, swift, fintech'}}, 'additionalProperties': False}
health_check
DORAOracle server status and all backend connectivity checks.
Input schema
{'type': 'object', 'properties': {}, 'additionalProperties': False}
incident_timeline
Generate a DORA Art. 19-aligned ICT incident reporting timeline with the regulatory deadline structure. Supports - does not constitute - compliant reporting.
Input schema
{'type': 'object', 'properties': {'sector': {'type': 'string', 'description': 'Sector: banking, insurance, payment (default: banking)'}, 'incident_time': {'type': 'string', 'description': "ISO timestamp of incident e.g. '2026-03-19T14:00:00Z' (default: now)"}, 'classification': {'type': 'string', 'description': 'Incident class: major, significant, minor (default: major)'}}, 'additionalProperties': False}
kev_check
Check if a specific CVE is in CISA KEV (actively exploited in the wild). Returns DORA incident classification guidance.
Input schema
{'type': 'object', 'properties': {'cve_id': {'type': 'string', 'description': "CVE ID to check e.g. 'CVE-2021-44228' (Log4Shell)"}}, 'additionalProperties': False}
kev_list
CISA Known Exploited Vulnerabilities — actively exploited CVEs with patch deadlines. DORA Art. 9 patch compliance.
Input schema
{'type': 'object', 'properties': {'days': {'type': 'integer', 'default': 30, 'description': 'Added to KEV within last N days (default: 30)'}, 'limit': {'type': 'integer', 'default': 15, 'maximum': 50, 'minimum': 1, 'description': 'Max results 1-50 (default: 15)'}, 'vendor': {'type': 'string', 'description': "Filter by vendor e.g. 'Cisco', 'Microsoft', 'SAP'"}, 'overdue': {'type': 'boolean', 'description': 'Show only overdue patches (default: false)'}}, 'additionalProperties': False}
mitre_techniques
MITRE ATT&CK techniques for DORA TLPT / TIBER-EU penetration testing. Maps to DORA Art. 26.
Input schema
{'type': 'object', 'properties': {'limit': {'type': 'integer', 'default': 10, 'maximum': 20, 'minimum': 1, 'description': 'Max results 1-20 (default: 10)'}, 'tactic': {'type': 'string', 'description': 'Filter by tactic: Initial Access, Lateral Movement, Impact, Persistence, etc.'}, 'keyword': {'type': 'string', 'description': "Search keyword e.g. 'ransomware', 'phishing', 'credential'"}}, 'additionalProperties': False}
provider_risk
DORA Art. 28 ICT third-party risk assessment: CVE history, news, GLEIF registration, contractual checklist.
Input schema
{'type': 'object', 'properties': {'provider': {'type': 'string', 'description': "Provider name e.g. 'SAP', 'Salesforce', 'AWS', 'Temenos'"}}, 'additionalProperties': False}
threat_actors
Feodo Tracker: live C2 botnet servers (Emotet, QakBot, etc.). Actionable IP blocklist for DORA Art. 9.
Input schema
{'type': 'object', 'properties': {'limit': {'type': 'integer', 'default': 20, 'maximum': 100, 'minimum': 1, 'description': 'Max results 1-100 (default: 20)'}, 'status': {'type': 'string', 'description': 'Filter by status: online, offline'}, 'malware': {'type': 'string', 'description': 'Filter by malware family: Emotet, QakBot, Dridex, TrickBot'}}, 'additionalProperties': False}
tlpt_scenarios
TIBER-EU threat scenarios for DORA resilience testing planning. Banking-specific attack simulations.
Input schema
{'type': 'object', 'properties': {'focus': {'type': 'string', 'description': 'Focus area: swift, ransomware, insider, ddos, cloud (default: all)'}, 'sector': {'type': 'string', 'description': 'Sector: banking (default: banking)'}}, 'additionalProperties': False}
History
Recent tool changes
Added
health_check
Sept. 17, 2026, 12:53 p.m.
Added
dora_calendar
Sept. 17, 2026, 12:53 p.m.
Added
dora_news
Sept. 17, 2026, 12:53 p.m.
Added
provider_risk
Sept. 17, 2026, 12:53 p.m.
Added
cloud_status
Sept. 17, 2026, 12:53 p.m.
Added
tlpt_scenarios
Sept. 17, 2026, 12:53 p.m.
Added
mitre_techniques
Sept. 17, 2026, 12:53 p.m.
Added
incident_timeline
Sept. 17, 2026, 12:53 p.m.
Added
threat_actors
Sept. 17, 2026, 12:53 p.m.
Added
breach_check
Sept. 17, 2026, 12:53 p.m.
Added
cert_advisories
Sept. 17, 2026, 12:53 p.m.
Added
kev_check
Sept. 17, 2026, 12:53 p.m.
Added
kev_list
Sept. 17, 2026, 12:53 p.m.
Added
cve_latest
Sept. 17, 2026, 12:53 p.m.
Added
cve_search
Sept. 17, 2026, 12:53 p.m.
Discover
Similar MCP servers
DataNexus MCP
com.datanexusmcp/mcp-server
Enables public-data research across domains, patents, government contracts, nonprofits, compliance registries, and software secur…
ampel
io.tooloracle/ampel
Assesses regulated entities and providers against DORA and related ESG, MiCA, and AML requirements, with contract analysis, evide…
predictionguard
io.tooloracle/predictionguard
Analyzes Polymarket and Kalshi markets for insider-trading signals, market integrity risks, sanctions and PEP exposure, conflicts…
Nist Standards
io.github.pipeworx-io/nist-standards
Searches and retrieves NIST SP 800-53 security controls and SP 800-171 CUI requirements, including requirements, guidance, and co…
Sanctions Screening
io.github.pipeworx-io/sanctions-screening
Screens names against US sanctions and export-control lists and retrieves detailed sanctions records.
Dilisense
io.github.pipeworx-io/dilisense
Screens individuals and organizations against sanctions, PEP, criminal, and adverse-watchlist data for AML and KYC checks.
Open Sanctions
io.github.pipeworx-io/open-sanctions
Looks up sanctioned and politically exposed entities, including identifiers, aliases, addresses, sanctions programs, and relation…
Sanctions Io
io.github.pipeworx-io/sanctions-io
Screens individuals and organizations in bulk against sanctions, politically exposed person, and watchlists.