CyberSPF

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/cyberspf-com-mcp

About

Use cases: security-scanning

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

5 read · 5 write · 1 delete · 3 not yet classified

Secrets

1 (API keys, tokens or passwords)

Install scripts

None found

Runs as

Python package

Tools (14)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• cyberspf_add_to_threat_list

  Add hosts, IP addresses or CIDR blocks to a threat list. CHANGES THE ACCOUNT. Up to 100 per call, and entries per list are capped by the plan. Entries are normalised the way the rest of the product normalises them, so the same host added two ways is one entry. One bad entry does not fail the batch: the reply names what was added, what was already there, and what was rejected with why. Read `rejected` rather than assuming everything landed.

• cyberspf_alerts

  What changed on the monitored items, newest first. This is how you answer "has anything happened" without looking everything up one at a time. Each alert carries `monitor_id`, the `term` it concerns, a `severity`, a `summary` and `changes` -- the fields that moved. Feed `term` into cyberspf_lookup to see the current state behind an alert. To page back, take the `id` of the last alert you got and pass it as `before`. To poll for new ones, keep the newest `created_at` you have seen and pass it as `since`; it is strictly greater, so the same alert is not handed to you twice.

• cyberspf_bulk_lookup

  Look up many things in one request. Use this for anything past a handful: checking fifty domains one at a time is fifty round trips, and it buries the answer in your own context. Returns a `job_id` immediately -- the work happens in the background. Call cyberspf_bulk_result with that id to collect it; results fill in as they finish, so a first call may show some still pending. Charged one unit PER TERM, not per request, so this is not a way around the allowance -- it is a way to spend it without fifty round trips. Up to 100 terms; over that is refused for free, with nothing charged. Terms a…

• cyberspf_bulk_result

  Collect a bulk lookup. Polling is FREE -- it does not touch the daily allowance -- so call it again rather than guessing at results that are still pending. Check `status` before reading `results`: a job still running has partial results, and reporting those as the whole answer is how a host that had not been checked yet gets described as clean.

• cyberspf_create_threat_list

  Create a new, empty threat list. CHANGES THE ACCOUNT, and the number of lists is capped by the plan. Before inventing tags, call cyberspf_tag_suggestions and reuse what is there -- a list tagged `phising` beside one tagged `phishing` is how the markings on results stop meaning anything.

• cyberspf_investigate

  ASK THIS FIRST about a domain or address. It looks the thing up AND follows what the result points at -- a domain to the addresses it resolves to, an address to the network announcing it -- and returns the lot in one call. This is the chain you would otherwise walk yourself with repeated cyberspf_lookup calls. Doing it here is fewer round trips and costs the same: one unit for the subject plus one per related thing looked up. Summarised by default -- `notable` carries only findings rated bad or warn, and `counts` says how many of each severity were seen, so a short answer is not a shallow on…

• cyberspf_list_monitors

  List what this account monitors, with when each was last checked. `last_checked_at` is null for a monitor that has not run yet — that is different from one checked long ago, and should not be reported as a stale check. Use this to find out what is being watched before looking things up one at a time.

• cyberspf_lookup

  Assess one IP address, domain or ASN. Returns ordered sections of findings: who announces an address, what a domain publishes for mail and DNS, certificates seen, threat-list membership, routing anomalies. Findings carry a `severity`. Values that are themselves lookupable carry a `type` (ip, domain, asn, cidr) — feed those back into this tool to follow a result rather than stopping at one answer. That is the intended way to investigate: look up a domain, then its addresses, then the ASN announcing them. Counts one call against the daily API allowance.

• cyberspf_remove_from_threat_list

  Remove entries from a threat list. CHANGES THE ACCOUNT, and it makes the account stop treating those hosts as a threat -- confirm with the person before calling it. An entry that is also in another of their lists stays in that one.

• cyberspf_report_card

  The graded assessment of every monitored domain: a letter grade and a score, with findings grouped by area (mail, DNS, website, registration, certificates, routing, reputation, lookalikes). Each finding has a status and, where there is something to do, a recommendation. Built from stored data — nothing is probed when you call this, so it is safe to call repeatedly. A finding that could not be checked is reported as `unknown` and never lowers the grade: "we could not look" is not "there is nothing there", and should not be reported as a pass or a failure. Requires a plan that includes the rep…

• cyberspf_start_monitoring

  Start watching a domain, IP or ASN, so future changes to it raise alerts. Use this after a lookup turns up something worth keeping an eye on. CHANGES THE ACCOUNT, and the number of monitored items is capped by the plan. Already monitoring the term? The existing monitor comes back rather than a second one, so calling again is safe. A CIDR block cannot be monitored: there is no stored baseline to compare later runs against. Monitor the addresses in it instead.

• cyberspf_stop_monitoring

  Stop watching a monitored item. Takes the `id` from cyberspf_list_monitors, or the `monitor_id` on an alert. CHANGES THE ACCOUNT. Confirm with the person first: stopping a monitor is how a real change goes unnoticed later. Alerts already raised are kept.

• cyberspf_tag_suggestions

  The tags already in use, with how many lists carry each, most used first. The same set the web interface offers. Call this before tagging anything new, and prefer an existing tag to a near-miss of your own.

• cyberspf_threat_lists

  The threat lists this account owns, with their tags and how many entries each holds. A threat list is what decides whether a looked-up host is reported as a threat, and its tags are the markings shown against a match. Call this before adding anything, to find the right list id and to see what already exists.

Compare and alternatives

Featured in

• Best MCP servers for domains and DNS

Signals

Weekly downloads

280

Last release

Oct 18, 2026 (10 days ago)

Last package publish

Oct 18, 2026 (10 days ago)

From the package registry.

Details

Registry name

com.cyberspf/mcp

Version

0.2.2

Auth

API key

Packages

pypi cyberspf-mcp

License

LicenseRef-Proprietary

Website

cyberspf.com

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registry