PAGES

Model Context Protocol

Put Cyber Toolchain in your assistant

Connect your AI assistant and ask it about the market directly, instead of reading pages and relaying what you found. Ask it to search every past issue, or pull up a tool's release history, command-line flags, usage examples, SBOM, or the data behind any analytics chart. Ask what no single page can show you: how a project scores against its peers, how several tools compare side by side, what practitioners really say about a tool, and what has shipped since you last checked. You can also send things back through it: ask us to track a tool you use, or tell us what one is like to live with. We store your feedback with nothing that identifies you. Included with Researcher and Business.

Endpoint 
https://mcp.cybertoolchain.io/mcp

Streamable HTTP, JSON-RPC 2.0. Not the same host as the REST API — that one is a different distribution and answers 403 here. The same ctk_… key authenticates both.

Use Cases

These 17 questions are called against this endpoint on a schedule with a real subscriber key, and graded on the answer rather than on the HTTP status. Anything else the server can do may still work — it is just not promised. Each one prints the coverage it depends on, because "tested" is not the same as "complete". Coverage measured 2026-11-04.

  1. Which tools can do X?

    e.g. “Which tools detect SSH host key reuse?”

    find_tools_by_capability

    we checkEach tool comes back with what it does, the source that says so (a vendor blog post or a documented feature) and its link, and a blog claim carries the vendor's own sentence.

    coverage 946 of 1291 tracked tools

  2. Which flag or command in <tool> does X?

    e.g. “Which trufflehog flag scans an S3 bucket?”

    search_tool_surface

    we checkAt least one flag comes back with its name, its help text, and whether a recorded run confirmed it.

  3. Show me a command for <tool> that actually ran, and what it printed.

    e.g. “Give me a working nuclei command and its output.”

    get_tool_surface

    we checkThe reply carries the command, its exit code, and the first lines of what it printed — or says plainly that no run was recorded for this tool.

    coverage 111 of 1291 tracked tools

  4. What is in <tool>'s supply chain, and how much of it is AI-authored?

    e.g. “What does semgrep depend on, and what share of its commits are AI-written?”

    get_tool_surface

    we checkThe sbom and code facets return a dependency count, a language mix and an AI-authorship attribution, each naming its own coverage.

    coverage 793 of 1291 tracked tools

  5. What changed across the tools I run since <date>?

    e.g. “What shipped in trivy, falco and semgrep since the first of the month?”

    get_tool_history

    we checkEvery release returned falls on or after the requested date, and any entry reconstructed from older history is marked as a backfill rather than presented as news.

    coverage 999 of 1291 tracked tools

  6. What did vendor V change in its documentation without announcing it? Researcher and above

    e.g. “Did Wiz change what its docs say about agentless scanning last month?”

    list_issuesget_issue

    we checkThe Diff index lists which entries carry a full diff, and asking for one by its entry id returns the diff itself.

    coverage 17 Diff issues published

  7. Who is shipping fastest in category C, and on what sample?

    e.g. “Which SBOM tools shipped most this quarter, and how is that measured?”

    list_analyticsget_analytics

    we checkThe chart names its sources and sample sizes, and a named series returns its rows with the count it held back.

    coverage 45 published charts

  8. How does <tool> compare with its peers, and on what?

    e.g. “Is Trivy keeping up with the rest of container security?”

    get_scorecard

    we checkEach dimension comes back with a score or a named reason it was not measured, plus the tool's rank among measured peers in its category.

    coverage 1075 of 1291 tracked tools

  9. Which of these tools is the healthier project?

    e.g. “Compare trivy, grype and syft across everything you hold.”

    compare_tools

    we checkOne table covering every tool named, where an unmeasured cell reads as unmeasured and never as a zero, and untracked names are listed rather than dropped.

    coverage 1075 of 1291 tracked tools

  10. What do practitioners say about <tool>?

    e.g. “What do people report about running Trivy in CI?”

    get_practitioner_signal

    we checkPassages come back quoted with their platform, date and link, evaluative ones first — or the reply says the corpus holds no linked discussion for this tool, which is not the same as no opinion existing.

  11. How does <model> score on <benchmark>, and when was that measured?

    e.g. “Who leads Cybench, and against what market median?”

    get_benchmarks

    we checkEvery row carries its evaluator, source URL and date basis, and a standings table states the whole market's median and max beside the rows this roster tracks.

    coverage 21 models and agents scored

  12. What has shipped since I last checked?

    e.g. “Anything new across my toolchain since Tuesday?”

    get_changes_since

    we checkThe reply returns a cursor, and calling again with it returns nothing the first call already showed.

    coverage 999 of 1291 tracked tools

  13. This tool is not tracked — can you ask for it?

    e.g. “Request coverage for a scanner the roster is missing.”

    request_coverage

    we checkThe request is validated before it is queued and comes back with a receipt that states plainly it is proof of the send and not of the filing; a malformed URL is refused while the caller is still listening.

    coverage 1291 tracked tools

  14. Can I tell you what a tool is actually like to run?

    e.g. “Share what running Trivy in CI is really like.”

    submit_feedback

    we checkA rating-length submission is refused in favour of a sentence, and an accepted one comes back saying nothing identifying was stored, that it cannot be withdrawn, and that it is not published back to other readers.

    coverage 1291 tracked tools

  15. What newsletters do I receive, and can you change my preferences? Researcher and above

    e.g. “Show my newsletter settings and switch my email theme to sepia.”

    get_account_settingsupdate_account_settings

    we checkA preference saved through MCP survives an account-page reload, and a website save is reflected by MCP.

  16. How many Greps do I have, what do they monitor, and can you manage them? Researcher and above

    e.g. “Create a Grep for Trivy, show its criteria, then pause or remove it.”

    list_grepscreate_grepupdate_grepdelete_grep

    we checkOwned Greps report counts and criteria; creation, edits, pause and deletion persist across MCP and the account page.

  17. Which subscriber issues can I read, and where are their content and links? Researcher and above

    e.g. “Show my latest subscriber issue and its available download links.”

    list_subscriber_issuesget_subscriber_issue

    we checkThe index and detail agree on an entitled issue; available private links open successfully and missing content is stated explicitly.

also The server ships its own prompts, so the multi-call workflows are one command in your client rather than something to reconstruct each session: a brief on one tool, a review of a whole toolchain, a category survey, alternatives to an incumbent, and what has shipped since last time. It also exposes the recent issues, the list of tracked tools and the chart list as attachable resources.

writes Two of these send rather than read, and this endpoint is built so it can only ever send: it holds permission to put a message on one queue and no permission to read anything back, so it never touches subscriber records. Feedback carries no subscriber id and no timestamp finer than the date — which also means a submission cannot be withdrawn later, and the tool says so before it accepts one.

Tested does not mean complete. Coverage is per tool: one whose help output has never been parsed has no flags here even though it has them, and a facet with nothing recorded says so rather than returning an error. A flag found in documentation is not proof it exists in the version you have installed — a recorded run is, and those are marked.

1 Get a key

Generate one on your account page. It is shown once, so store it when you make it. Then export it — every snippet below reads it from the environment rather than embedding it, so nothing you paste into a config file carries a credential.

shell 
export TOOLCHAIN_API_KEY="ctk_…"

Keys come with Researcher and Business, and the server checks your plan on every request. There is no free tier here. Your key reads Diff issues and the full analytics, including which tools and vendors each ranking names. If a reply leaves something out, it says so.

2 Add the server

Pick your client. Each registers the server as cybertoolchain.

Claude Code

One command. Streamable HTTP, no bridge process.

Run this

claude code 
claude mcp add --transport http cybertoolchain https://mcp.cybertoolchain.io/mcp \
  --header "Authorization: Bearer $TOOLCHAIN_API_KEY"

Or write this

.mcp.json 
{
  "mcpServers": {
    "cybertoolchain": {
      "type": "http",
      "url": "https://mcp.cybertoolchain.io/mcp",
      "headers": {
        "Authorization": "Bearer ${TOOLCHAIN_API_KEY}"
      }
    }
  }
}

watch outYour shell expands $TOOLCHAIN_API_KEY before Claude Code ever sees it, so the command above writes the KEY ITSELF into ~/.claude.json. The .mcp.json form keeps ${TOOLCHAIN_API_KEY} as a placeholder and resolves it at launch — prefer it if the file is anywhere near a git repo. Add --scope user to the command to register the server for every project rather than the current one.

Codex

One command, or the equivalent block in ~/.codex/config.toml.

Run this

codex 
codex mcp add cybertoolchain \
  --url https://mcp.cybertoolchain.io/mcp \
  --bearer-token-env-var TOOLCHAIN_API_KEY

Or write this

~/.codex/config.toml 
[mcp_servers.cybertoolchain]
url = "https://mcp.cybertoolchain.io/mcp"
bearer_token_env_var = "TOOLCHAIN_API_KEY"

watch outCodex sends a bearer token and nothing else — it has no arbitrary-header option. That is why this server accepts Authorization: Bearer alongside x-api-key; a config that tries to set x-api-key here will not work.

Claude Desktop

Config file only — Settings → Developer → Edit Config.

claude_desktop_config.json 
{
  "mcpServers": {
    "cybertoolchain": {
      "url": "https://mcp.cybertoolchain.io/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY_HERE"
      }
    }
  }
}

watch outClaude Desktop does not expand environment variables in this file, which is why the placeholder is spelled out rather than written as a variable. The key is stored in plain text on disk — revoke and reissue it at /account if the machine is shared.

opencode

Config file only — opencode has no add command.

opencode.json 
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cybertoolchain": {
      "type": "remote",
      "url": "https://mcp.cybertoolchain.io/mcp",
      "enabled": true,
      "headers": {
        "Authorization": "Bearer {env:TOOLCHAIN_API_KEY}"
      }
    }
  }
}

Cursor, Windsurf, Zed, Kiro, Continue

Clients that speak stdio only. mcp-remote bridges them to the HTTP endpoint; the config shape is the same in all of them.

mcp.json 
{
  "mcpServers": {
    "cybertoolchain": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.cybertoolchain.io/mcp",
        "--header",
        "Authorization:Bearer ${TOOLCHAIN_API_KEY}"
      ]
    }
  }
}

watch outExport TOOLCHAIN_API_KEY in the environment the editor launches from — deliberately not an "env" block, because these files are workspace-scoped and a key inside a repo is the most common way one reaches a git history. On a shared host, treat a bridged key as visible to other users: the bridge takes its header as a command-line argument, and ps shows every process’s full argv.

3 Check it worked

To check that it's connected, ask your assistant which tools it has. You can also call the endpoint directly. If something is wrong, the error message tells you whether it's the URL or the header.

shell 
curl -s https://mcp.cybertoolchain.io/mcp \
  -H "content-type: application/json" \
  -H "Authorization: Bearer $TOOLCHAIN_API_KEY" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Subscribe to Researcher Already a subscriber? Generate a key →
compare.md

    Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

    my-toolchain — 0 tools

      Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
      browse all tools → score card for your toolchain →
      cyber-toolchain / feedback

      Send us feedback