api.contrastcyber.com

Item: api.contrastcyber.com
Rating: 45
Author: wmcp.sh

https://api.contrastcyber.com/mcp/

45/100 · MCP Trust Grade · checked 12h ago · MCP 2025-06-18

✓ Watched since 2026-06-03 — behavioral baseline locked, no drift for 2 days. We re-check this server's tool surface on a schedule; if it adds, removes, or silently rewrites a tool (rug-pull), we record it.

What it offers — 53 tools · Developer Tools

domain_report

Query DNS, WHOIS, SSL, subdomains, and threat intel for a domain in one call. By default dns.txt is filtered to security-relevant entries (SPF, DMARC,

audit_domain

Perform comprehensive domain audit: combines domain_report + live HTTP security headers + technology fingerprinting. By default report.dns.txt is filt

tech_stack_cve_audit

Composite tech-stack + CVE audit (MCP-only, no REST endpoint). Detects technologies on the target domain, queries CVE database for known vulnerabiliti

threat_report

Query comprehensive threat profile for an IP: Shodan host data, AbuseIPDB reputation, ASN/geolocation, and open ports. Use for IP investigation and SO

dns_lookup

Query all DNS record types (A, AAAA, MX, NS, TXT, CNAME, SOA) for a domain. Use for mail routing inspection, nameserver verification, or SPF/DMARC che

whois_lookup

Retrieve WHOIS registration data: registrar, creation/expiry dates, nameservers, status. Use to verify domain ownership, age, expiration; for full aud

ssl_check

Analyze SSL/TLS certificate: grade (A/B/C/D/F), protocol version, cipher suite, chain, expiry, Subject Alternative Names, and structured validation fi

subdomain_enum

Discover subdomains using passive methods: Certificate Transparency logs + DNS brute-force (no active probing). Use to map organization's attack surfa

tech_fingerprint

Detect website technology stack: CMS, frameworks, CDN, analytics tools, web servers, languages (via HTTP headers + HTML analysis). Use for passive rec

threat_intel

Check domain against abuse.ch URLhaus for known malware-distribution URLs (single source — for multi-feed correlation use ioc_lookup which adds Threat

wayback_lookup

Retrieve Wayback Machine snapshots for a domain: first capture, latest, total count, snapshot list. Use to investigate domain history and age; for ful

scan_headers

Perform live HTTP GET and analyze security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Permissions-Policy, Referrer-Policy. Use to au

email_mx

Analyze email security: MX records, SPF policy, DMARC policy, DKIM probe across common+date-based selectors, mail provider, grade. Use to verify email

email_security_posture

Analyze domain email authentication posture: SPF, DMARC, DKIM with numeric score and findings. Dual-use: red-team (spoofing feasibility) + blue-team (

email_disposable

Check if email address uses a known disposable/temporary provider (Guerrilla Mail, Temp Mail, Mailinator, etc.). Use for input validation to detect th

email_verify

One-call email validation combining syntax + MX records + disposable check + role-address detection (admin@/info@/...) + free-provider classification

robots_txt

Fetch + parse the target domain's robots.txt — sitemaps, per-User-agent allow/disallow rules, crawl-delay, Host directive. Use BEFORE crawling/scrapin

redirect_chain

Walk an HTTP redirect chain hop-by-hop, returning per-hop {url, status_code, location, latency_ms}. Use to deobfuscate URL shorteners (bit.ly / t.co /

+35 more tools

Spec conformance20%80

✓ initialize → protocolVersion 2025-06-18
✓ initialize HTTP 200
✗ unknown method → -32602
✓ tools/list → 53 tools
✓ every tool has name + inputSchema

Security (OWASP MCP)30%10

53 tools scanned
no injection markup
1 secret-path refs

Reliability / performance20%92

single-probe latency 460ms (PRELIMINARY — continuous uptime/p95 from proxy telemetry lands in v2)

Tool hygiene15%100

100% of tools have typed inputSchema
53/53 declare outputSchema
no unannotated destructive tools

Transparency / provenance15%90

HTTPS ✓
RFC 9728 oauth-protected-resource metadata ✓
advertises protocol 2025-06-18

Observed behavior

No proxied traffic observed for this host yet. Connect it at /connect and its grade gains a measured Reliability score + per-tool behavioral evidence — the half a static scan can't produce.

Findings

FAILMCP08 Tool "check_secrets" references sensitive file paths / secrets (exfiltration surface).

Grade another server

We re-grade api.contrastcyber.com on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.

Share this report card

A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.

MCP Trust report card — api.contrastcyber.com grade F

Share on X Open card image

https://www.wmcp.sh/mcp/grade/api.contrastcyber.com

Embed this grade

A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.

Markdown (for your README)

[![MCP Trust Grade F](https://www.wmcp.sh/mcp/grade/api.contrastcyber.com/badge.svg)](https://www.wmcp.sh/mcp/grade/api.contrastcyber.com)

HTML

<a href="https://www.wmcp.sh/mcp/grade/api.contrastcyber.com"><img src="https://www.wmcp.sh/mcp/grade/api.contrastcyber.com/badge.svg" alt="MCP Trust Grade F · wmcp.sh"></a>

Agents: check this before connecting

Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:

https://www.wmcp.sh/mcp/trust

How this grade is computed. An open, independent rubric — Spec conformance (20%), Security mapped to the OWASP MCP Top 10 (30%), Reliability (20%), Tool hygiene (15%), Transparency (15%) — run by connecting to the server and inspecting its real MCP surface. The grade is free and identical whether or not the operator pays. v1 uses static + spec signals from a single connection; continuous uptime, real latency, and annotation-truthing (declared readOnly vs observed behavior) layer on via the wmcp.sh proxy.