{
  "slug": "io-github-stanfrbd-mcp-cyberbro",
  "name": "io.github.stanfrbd/mcp-cyberbro",
  "title": "Cyberbro MCP Server",
  "description": "MCP server for Cyberbro IOC extraction, enrichment and reputation analysis.",
  "version": "0.0.6",
  "publishedAt": "2026-10-18T17:07:19.754772Z",
  "updatedAt": "2026-10-18T17:07:19.754772Z",
  "repoUrl": "https://github.com/stanfrbd/mcp-cyberbro",
  "websiteUrl": null,
  "namespace": {
    "type": "github",
    "owner": "stanfrbd"
  },
  "kind": "local",
  "packages": [
    {
      "registryType": "pypi",
      "identifier": "mcp-cyberbro",
      "version": "0.0.6",
      "transport": "stdio",
      "runtimeHint": null
    }
  ],
  "remotes": [],
  "envVars": [
    {
      "name": "CYBERBRO_URL",
      "isSecret": false,
      "isRequired": true,
      "description": "Base URL of Cyberbro (for example http://localhost:5000)"
    },
    {
      "name": "API_PREFIX",
      "isSecret": false,
      "isRequired": false,
      "description": "Cyberbro API prefix (default: api)"
    },
    {
      "name": "SSL_VERIFY",
      "isSecret": false,
      "isRequired": false,
      "description": "Enable/disable SSL verification for Cyberbro API calls (true/false)"
    },
    {
      "name": "MCP_TRANSPORT",
      "isSecret": false,
      "isRequired": false,
      "description": "Transport override: stdio, sse or streamable-http"
    },
    {
      "name": "MCP_HOST",
      "isSecret": false,
      "isRequired": false,
      "description": "Host for HTTP transports"
    },
    {
      "name": "MCP_PORT",
      "isSecret": false,
      "isRequired": false,
      "description": "Port for HTTP transports"
    },
    {
      "name": "MCP_MOUNT_PATH",
      "isSecret": false,
      "isRequired": false,
      "description": "Mount path for SSE transport"
    },
    {
      "name": "MCP_SSE_PATH",
      "isSecret": false,
      "isRequired": false,
      "description": "SSE endpoint path"
    },
    {
      "name": "MCP_STREAMABLE_HTTP_PATH",
      "isSecret": false,
      "isRequired": false,
      "description": "Streamable HTTP endpoint path"
    }
  ],
  "category": "security",
  "subcategory": "threat-intel",
  "company": "",
  "categoryAuto": true,
  "checks": [
    {
      "id": "source-linked",
      "label": "Source repository linked",
      "result": "pass",
      "detail": "https://github.com/stanfrbd/mcp-cyberbro"
    },
    {
      "id": "version-pinned",
      "label": "Version pinned",
      "result": "pass",
      "detail": "Every package has an explicit version"
    },
    {
      "id": "secrets-requested",
      "label": "Secrets requested",
      "result": "info",
      "detail": "Asks for no secrets"
    },
    {
      "id": "known-registry",
      "label": "Known package registry",
      "result": "pass",
      "detail": "All packages come from npm, PyPI, OCI, NuGet or MCPB"
    },
    {
      "id": "namespace",
      "label": "Namespace ownership",
      "result": "info",
      "detail": "Name verified via GitHub account stanfrbd"
    },
    {
      "id": "meta-text",
      "label": "Registry text aimed at the AI",
      "result": "pass",
      "detail": "Description and settings contain no hidden characters or instructions to the AI"
    },
    {
      "id": "install-scripts",
      "label": "Install scripts",
      "result": "pass",
      "detail": "mcp-cyberbro 0.0.6 has no setup.py; nothing runs at install"
    },
    {
      "id": "code-flags",
      "label": "Code red flags",
      "result": "pass",
      "detail": "Read 22 files in mcp-cyberbro 0.0.6: no obfuscation, encoded execution, credential reads or data-collection endpoints found"
    },
    {
      "id": "ai-text",
      "label": "Text aimed at the AI",
      "result": "pass",
      "detail": "No hidden characters or instructions to the AI in 22 files, including comments and the README"
    }
  ],
  "scannedAt": "2026-10-29",
  "level": "Scanned",
  "install": [
    {
      "label": "Claude Desktop (pypi)",
      "kind": "claude_desktop_json",
      "text": "{\n  \"mcpServers\": {\n    \"mcp-cyberbro\": {\n      \"command\": \"uvx\",\n      \"args\": [\n        \"mcp-cyberbro==0.0.6\"\n      ],\n      \"env\": {\n        \"CYBERBRO_URL\": \"<your value>\"\n      }\n    }\n  }\n}"
    }
  ],
  "curated": true,
  "stars": 19,
  "archived": false,
  "pushedAt": "2026-10-18T16:10:33Z",
  "review": {
    "package": "mcp-cyberbro",
    "version": "0.0.6",
    "at": "2026-10-31",
    "files": 11,
    "lines": 490,
    "verdict": "pass-with-notes",
    "summary": "Cyberbro MCP lets the AI send suspicious IPs, domains, URLs or file hashes to your own Cyberbro server and read back the threat-intel results. It talks only to the Cyberbro address you configure, but that server may forward the indicators to services like VirusTotal or Shodan, depending on the engines the AI picks. It reads no files and runs no commands; an opt-in flag can turn off HTTPS certificate checks.",
    "hosts": [
      {
        "host": "CYBERBRO_URL (user's own Cyberbro instance)",
        "when": "analyze_observable, is_analysis_complete, get_analysis_results tool calls",
        "sends": "observables (IPs, domains, URLs, hashes, extension ids) and selected engine names; analysis ids. The Cyberbro server then queries the chosen third-party engines (VirusTotal, Shodan, AbuseIPDB, Google, etc.)"
      }
    ],
    "env": [
      {
        "name": "CYBERBRO_URL",
        "sent_to": "destination of all requests"
      },
      {
        "name": "SSL_VERIFY (and --no_ssl_verify)",
        "sent_to": "local; false disables TLS certificate verification"
      },
      {
        "name": "API_PREFIX, MCP_TRANSPORT, MCP_HOST, MCP_PORT, MCP_SSE_PATH, MCP_STREAMABLE_HTTP_PATH",
        "sent_to": "local configuration only"
      }
    ],
    "local": "None. No file reads or writes.",
    "exec": "None.",
    "telemetry": "None.",
    "tools": [
      "analyze_observable",
      "is_analysis_complete",
      "get_analysis_results",
      "get_engines",
      "get_web_url"
    ],
    "toolText": "clean. No hidden text. get_engines says 'This is the first tool to be called' (tools/engines.py:201), ordinary workflow guidance.",
    "deps": [
      "mcp",
      "httpx"
    ],
    "findings": [
      {
        "severity": "note",
        "at": "mcp_cyberbro/utils/config.py:39-41; mcp_cyberbro/cli.py:60-65",
        "what": "TLS certificate verification can be turned off with --no_ssl_verify or SSL_VERIFY=false. It is on by default; opt-in only."
      },
      {
        "severity": "note",
        "at": "mcp_cyberbro/tools/analysis.py:24-27; mcp_cyberbro/tools/engines.py:7-193",
        "what": "Observables are handed to the user's Cyberbro server, which forwards them to whichever third-party intel engines the model picks (VirusTotal, Shodan, Google, urlscan, etc.). Indicators from an investigation can leave the organisation that way."
      },
      {
        "severity": "info",
        "at": "mcp_cyberbro/tools/analysis.py:42,59; mcp_cyberbro/tools/web.py:20",
        "what": "analysis_id is put into the URL path without encoding, so model input could alter the path (e.g. '../') on the user's own Cyberbro server. Low impact: same host, read-only GETs."
      },
      {
        "severity": "info",
        "at": "mcp_cyberbro/server.py:21-34",
        "what": "SSE/streamable-http transports add no authentication of their own; stdio is the default."
      },
      {
        "severity": "info",
        "at": "package.json/pyproject",
        "what": "The manifest file was not in the reviewed tree; dependencies listed are inferred from import statements. None look unusual or typosquatted for the job."
      }
    ]
  },
  "health": {
    "score": 54,
    "parts": {
      "popularity": 0.29916031813339156,
      "activity": 0.6,
      "issues": null,
      "security": 1
    },
    "fail": 0,
    "warn": 0,
    "raw": {
      "stars": 19,
      "forks": 10,
      "downloads": 36,
      "hn": null,
      "issuesOpen": 4,
      "issuesClosed": 2,
      "prsMerged": 5,
      "commits90": 0,
      "release": "2026-10-18T16:10:34Z",
      "pushed": "2026-10-18T16:10:33Z",
      "growth": null,
      "growthDays": null,
      "archived": false
    },
    "at": "2026-10-31T07:35:52.424Z"
  }
}