ZEN SecDB

connects

secdb.nttzen.cloud

ZEN SecDB MCP server for CVE intelligence, CVSS/EPSS scoring, advisories, SSVC, and package audits.

https://secdb.nttzen.cloud/mcpWebsiteOAuthMCP 2025-11-25v26.8.2last checked 8 Oct 2026spoke MCP on 92.1% of 89 checks (30 days)initialize in 338 ms

Will my client connect?

Decided from what the probe found at the endpoint, and from what each client's own documentation says it can complete. Every row carries the day that documentation was read.

✓Claude CodeConnects

The authorization server advertises RFC 7591 registration, so Claude Code can register itself and sign you in through the browser.

claude mcp add --transport http zen-secdb https://secdb.nttzen.cloud/mcp

Claude Code docs · read on 2026-08-30

✓Claude (claude.ai & Desktop)Connects

The authorization server advertises RFC 7591 registration, so Claude (claude.ai & Desktop) can register itself and sign you in through the browser.

Settings → Connectors → Add custom connector, then paste https://secdb.nttzen.cloud/mcp.

Claude (claude.ai & Desktop) docs · read on 2026-08-30

✓ChatGPTConnects

The authorization server advertises RFC 7591 registration, so ChatGPT can register itself and sign you in through the browser.

Settings → Apps → Advanced settings → Developer mode, then create a connector pointing at https://secdb.nttzen.cloud/mcp.

ChatGPT docs · read on 2026-08-30

✓CursorConnects

The authorization server advertises RFC 7591 registration, so Cursor can register itself and sign you in through the browser.

{
  "mcpServers": {
    "zen-secdb": {
      "url": "https://secdb.nttzen.cloud/mcp"
    }
  }
}

Cursor docs · read on 2026-08-30

✓VS Code (Copilot)Connects

The authorization server advertises RFC 7591 registration, so VS Code (Copilot) can register itself and sign you in through the browser.

{
  "servers": {
    "zen-secdb": {
      "type": "http",
      "url": "https://secdb.nttzen.cloud/mcp"
    }
  }
}

VS Code (Copilot) docs · read on 2026-08-30

How to authenticate

Checked against the endpoint by our probe on 8 Oct 2026. These are the capabilities the server advertises, not a prediction about any particular client.

Scheme	OAuth
Issuer	https://secdb.nttzen.cloud/
Dynamic client registration	✓Advertised (RFC 7591)
Client ID Metadata Document	✕Not advertised
PKCE	✓S256
Grant types	authorization_code, refresh_token, client_credentials
Scopes	read, audit, report, viewer
Protected-resource metadata	✓Published (RFC 9728)
Anonymous access	Handshake succeeds; 11 tools listable
Documentation	https://secdb.nttzen.cloud/docs

What the probe found

No CORS headers for browser-based clients

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

11 tools usable without signing in

The server exposes a public surface before authorization: epss_timeseries, linux_audit, linux_os, sightings_search, ssvc_calculator, vulnerability_info, vulnerability_score, vulnerability_search, feed_report_catalog, feed_report, purl_audit.

Tools

epss_timeseriesfeed_reportfeed_report_cataloglinux_auditlinux_ospurl_auditsightings_searchssvc_calculatorvulnerability_infovulnerability_scorevulnerability_search

Contract history

3 Oct 2026v26.8.211 cosmetic

26 Sep 2026v26.8.21 cosmeticinstructions rewritten

Instructions rewritten: vulnerability_search. The description an agent follows changed; the callable contract may not have.

22 Sep 2026v26.8.21 cosmetic

13 Sep 2026v26.8.2no contract changes

25 Aug 2026v26.8.1no contract changes

24 Aug 2026v26.8.0first recorded contract

Watch this server

Save its public contract as a baseline and manage breaking-change email alerts.

Set up a watch

Own this server?

Status badge

Status for a README, from the last probe — cached an hour, so up to seven hours behind the endpoint. Links back to this page.

[![MCP status](https://mcpi.app/servers/zen-secdb/badge.svg)](https://mcpi.app/servers/zen-secdb)