CVE Monitoring
New advisory published. Your sandboxes are already rescanned.
We monitor vulnerability databases continuously. When a new advisory drops, our DLP scanner updates automatically, every active sandbox is rescanned, and affected servers are quarantined — before your agents reach them.
How It Works
Four stages. Fully automated.
From advisory disclosure to sandbox quarantine, the entire pipeline runs without human intervention.
Monitor
We poll GHSA, CVE, and PYSEC advisory databases on a continuous cycle. Every new disclosure is ingested, normalised, and matched against known MCP server dependency trees.
Update DLP Rules
Matched advisories are compiled into DLP scanner rules automatically. The scanner binary is rebuilt and deployed — no manual intervention. New vulnerability patterns are enforceable within the same scan cycle.
Rescan Active Sandboxes
Every active sandbox is rescanned against the updated rule set. Servers that were clean yesterday may now carry a known advisory. The rescan catches them before your next agent call does.
Quarantine
Sandboxes with critical or high-severity findings are quarantined automatically. Routing to affected servers is blocked. You see the advisory details in your dashboard — and your agents never touch the vulnerable server.
On Creation
Every new sandbox is scanned before it goes live.
When you create a sandbox — whether from a public registry server or your own custom MCP server — we scan its full dependency tree against every known advisory before making it available to your agents.
If the scan finds critical-severity advisories, the sandbox is created in quarantined state. You can see exactly which packages are affected and decide whether to proceed, pin a different version, or choose a different server. Nothing reaches your agents without passing the scan first.
// Sandbox creation flow
Enforcement Policy
Severity Tiers
Enforcement is automatic and tiered by severity. Both new and existing sandboxes are held to the same standard.
Sandbox quarantined immediately. Routing to affected servers returns 451 with advisory details. No grace period.
14-day grace period with warning headers injected into responses. Sandbox quarantined on day 15 if the advisory remains unpatched.
Warning surfaced in your dashboard and injected as a response header. Routing continues. The affected package and version range appear in your exposure report.
Why This Matters
We audited 27,664 MCP servers. Over half had known vulnerabilities.
Our research scanned every major public MCP registry for known security advisories. 9,527 servers carried confirmed vulnerabilities. 2,863 had no dependency manifest at all. The full findings — methodology, severity breakdown, and what we found — are published on our blog.
Read the full reportOpen Data
Full CVE Index. Public API. No API Key.
Every MCP server we've scanned is queryable through our public API. Search by name, filter by severity, sort by advisory count. The data updates on every scan cycle.
Build your own dashboards, integrate it into your CI pipeline, or look up a server before you add it to your agent config. No API key required.
// Query the public CVE index
GET https://api.mistaike.ai/api/v1/public/cve-index
// Response
{
"total": 17433,
"page": 1,
"page_size": 50,
"results": [{
"name": "user/server-name",
"title": "Server Display Name",
"repository_url": "https://github.com/...",
"cve_count": 92,
"worst_severity": "critical",
"status": "blocked",
"packages_scanned": 47,
"scanned_at": "2026-03-30T06:00:00Z"
}]
}?search= — filter by name or repo
?severity= — critical, high, medium, none
?sort= — cve_count, severity, scanned_at
?page=&page_size= — paginated results
This API includes publicly known vulnerability data only. It does not include behavioral analysis, telemetry findings, or unverified security concerns, which are handled separately and may be subject to validation and responsible disclosure processes.
This data is intended to support risk awareness and prioritization, not to label projects as insecure or malicious. Users should review context, validate findings, and consider their own threat model before making decisions.
Connect in Under 2 Minutes
CVE protection is on the free tier.
Route your agents through mistaike and get automatic CVE monitoring, sandbox scanning, and quarantine enforcement. No credit card. No configuration.