How do I install vulnrable?

Pick a client above and copy the generated config. Cursor and VS Code also have a deep link when the server can run locally or remotely.

Is vulnrable official?

No. Registry-listed is not the same as vendor-official. Read the methodology for the difference.

This listing scores 52 (Fair). The formula is published on the methodology page.

vulnrable MCP Server — Install for Claude, Cursor & VS Code | MCPpedia

Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS.

RegistryRemote

52Fair

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "vulnrable-vulnrable": {
      "url": "https://vulnrable.com/api/mcp"
    }
  }
}

This server does not declare environment variables.

Tools show up when the registry metadata or the repository README lists them. GitHub enrichment fills this in when a token is configured.

68Good

Real-time data-breach lookup and analytics for emails and domains from XposedOrNot.

RegistryRemotexposedornot99 stars