mcpbeat

Cybershield MCP Server

io.tooloracle/cybershield
not responding

Cybershield is listed as active in the registry but did not answer our last check. It exposes 12 tools. Last commit 1 Apr 2026.

CyberShield - 12 cybersecurity tools: NIS2 mapping, MITRE ATT&CK, vulns, threat intel.

The author archived this repository on GitHub, meaning it is no longer maintained.

Uptime history 40 hours of history · worst hour 0%
40 hours agonow
0.0%
Uptime 24h
0 of 91 checks
12
Tools
read from the server
38 ms
Response time
average over 24h
0
Stars
last commit 1 Apr 2026

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 14 min ago.

run in your terminal
claude mcp add cybershield --transport http https://tooloracle.io/cybershield/mcp/
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "cybershield": {
      "url": "https://tooloracle.io/cybershield/mcp/"
    }
  }
}
~/.codex/config.toml
[mcp_servers.cybershield]
url = "https://tooloracle.io/cybershield/mcp/"
.cursor/mcp.json
{
  "mcpServers": {
    "cybershield": {
      "url": "https://tooloracle.io/cybershield/mcp/"
    }
  }
}
.vscode/mcp.json
{
  "mcpServers": {
    "cybershield": {
      "url": "https://tooloracle.io/cybershield/mcp/"
    }
  }
}

Available tools 12

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

nis2
nis2_compliance
NIS2 Directive (EU 2022/2555) compliance assessment. All 10 Art. 21 measures, entity classification, penalties, incident reporting.
nis2_incident_report
NIS2 incident notification template. 24h early warning, 72h notification, 1-month final report templates.
attack
attack_surface_check
Attack surface assessment checklist. Web apps, remote access, cloud, IoT, email. Prioritized security checks.
cve
cve_risk_score
CVE risk prioritization combining CVSS, EPSS, KEV catalog, exploit availability. Returns weighted priority score with patching SLA.
dora
dora_ict_risk
DORA Art. 5-12 ICT risk management compliance check. 8 articles assessed with specific requirements per article.
incident
incident_playbook
Incident response playbook for ransomware, data breach, phishing compromise. Phase-by-phase actions with legal obligations.
iso27001
iso27001_gap
ISO 27001:2022 Annex A gap analysis. All 93 controls across 4 themes, new 2022 controls highlighted, certification process.
password
password_policy
Generate password policy per NIST SP 800-63B (2024) and BSI recommendations. Modern best practices — no forced rotation.
phishing
phishing_indicators
Analyze email/URL for phishing indicators. Scores sender, urgency, attachments, URL patterns. Returns verdict and recommended actions.
risk
risk_matrix
Risk assessment matrix (likelihood × impact). ISO 31000/27005 methodology. Provide risks for assessment or get template.
security
security_metrics
Security KPI/metrics dashboard template. MTTD, MTTR, patch compliance, phishing rate. Board-ready reporting guidance.
threat
threat_landscape
Current cyber threat landscape overview per ENISA categories. Top 8 threats with sector relevance and mitigations.

Endpoints

URLTransportStateLatencyChecked
https://tooloracle.io/cybershield/mcp/ streamable-http answering 38 ms 14 min ago

Cybershield — questions

Answers built from our own checks of this server.

What can Cybershield do?
It exposes 12 tools, read directly from the server on our last check. Among them: attack_surface_check, cve_risk_score, dora_ict_risk, incident_playbook, iso27001_gap, nis2_compliance and 6 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →
Is Cybershield working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 0 of 91 checks got a reply (0.0%), average response time 38 ms. The bar chart above shows every period we have measured.
Is Cybershield still maintained?
The author archived this repository on GitHub, meaning it is no longer maintained. We show this because it changes what you can expect: an unmaintained server may keep answering for months and then stop without warning.
The registry lists Cybershield as active — why does it not respond?
The official MCP registry stores what the author submitted; it does not verify that the server still runs. We check the endpoint ourselves, and this one does not answer. Catalogues that copy the registry without checking will show it as working.
How do I connect Cybershield?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does Cybershield need an API key?
No. Cybershield completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 12 of them are readable on this page. This is what we observed, not what the docs claim.
Is Cybershield open source?
Yes — written in Python and 0 stars on GitHub. The source link is on this page, so you can read exactly what it does with your data before you connect it.