Skip to content
MCPSTAMP
MCP server report

ContrastAPI MCP server

com.contrastcyber/api

We checked this server on 2 November 2026 with McpStamp Check engine 1.2.0. It scored 80 of 100 (grade B), higher than 25.9% of the 33,003 registry servers that responded over HTTPS that day. Ready for MCP Registry. Not ready for Claude, ChatGPT and Gemini.

Measured facts

Score
80B
Sign-in
OAuth
Tools listed
55
Protocol version
2025-11-25
Stores

Store readiness

StoreStatusReason
Claude Connectors Directory Not ready Blocked by Protected resource metadata (RFC 9728), Resource metadata "resource" equals the server URL and Authorization server metadata (RFC 8414 / OIDC).
ChatGPT app directory Not ready Blocked by Protected resource metadata (RFC 9728) and Authorization server metadata (RFC 8414 / OIDC).
Gemini Connected Apps Not ready Blocked by Authorization server metadata (RFC 8414 / OIDC).
Official MCP Registry Ready No blocking check failed.

MCP Registry ready means a valid public remote for the registry, not that the server is listed in a store.

Fixes

5 checks to fix

  1. Fails

    Protected resource metadata (RFC 9728)

    auth_prm

    Blocks Claude and ChatGPT.

    Measured https://api.contrastcyber.com/.well-known/oauth-protected-resource/mcp has no authorization_servers

    List your issuer URL in "authorization_servers" in the protected resource metadata.

  2. Fails

    Authorization server metadata (RFC 8414 / OIDC)

    auth_as_metadata

    Blocks Claude, ChatGPT and Gemini.

    Measured No authorization server to probe

    Serve RFC 8414 metadata at <issuer>/.well-known/oauth-authorization-server with authorization_endpoint, token_endpoint and response_types_supported ["code"].

  3. Fails

    Resource metadata "resource" equals the server URL

    auth_resource

    Blocks Claude.

    Measured resource https://api.contrastcyber.com is not the server URL https://api.contrastcyber.com/mcp/

    Serve metadata whose "resource" is exactly https://api.contrastcyber.com/mcp/ (Claude requires an exact match, path included), e.g. at /.well-known/oauth-protected-resource/mcp.

  4. Fails

    Server instructions

    instructions

    Measured No instructions in the initialize result

    Add an "instructions" string to the initialize result: what the server covers, for whom, and its limits.

  5. Warning

    Tool descriptions

    tool_descriptions

    Measured 1 over 2000 chars: cve_lookup

    Keep each tool description between 60 and 2000 characters: when to use it, what it returns, key limits.

16 checks passed, 6 did not run

Passed. Served over HTTPS, initialize over Streamable HTTP, Supported protocol version negotiated, JSON or SSE response Content-Type, JSON-RPC error for unknown method, GET answers SSE or 405, initialize latency, serverInfo name and version, tools capability declared, Sign-in method the store supports (OAuth or none), tools/list returns tools, inputSchema is an object schema, Tool names are valid and portable, readOnlyHint or destructiveHint on every tool, Explicit readOnlyHint, destructiveHint and openWorldHint (ChatGPT), Human-readable title on every tool.

Not run. 401 carries WWW-Authenticate resource_metadata, First metadata URL Gemini tries answers 200 with the required fields, issuer equals the authorization_servers entry; token_endpoint_auth_methods_supported (ChatGPT), PKCE S256 advertised, Client registration (DCR or Client ID Metadata Documents), refresh_token grant advertised. These need an OAuth sign-in flow the check could not reach.

Run a fresh check

This page is the 2 November 2026 snapshot. If you maintain this server and have shipped fixes since then, re-check it. The live check and the badge show the current result, and the next snapshot will pick up the change.

Re-check now

Badge

README badge

The badge shows the latest score for this URL and links to this report.

McpStamp score for ContrastAPI

Markdown

[![McpStamp score](https://www.mcpstamp.com/badge?url=https%3A%2F%2Fapi.contrastcyber.com%2Fmcp%2F)](https://www.mcpstamp.com/r/com-contrastcyber-api/)

HTML

<a href="https://www.mcpstamp.com/r/com-contrastcyber-api/"><img src="https://www.mcpstamp.com/badge?url=https%3A%2F%2Fapi.contrastcyber.com%2Fmcp%2F" alt="McpStamp score" height="20"></a>
Registry entry

About this server

55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.
Registry name
com.contrastcyber/api
Remote URL
https://api.contrastcyber.com/mcp/
Version
1.36.4
Source
github.com/UPinar/contrastapi
Website
api.contrastcyber.com
Checked
2 November 2026, engine 1.2.0, no credentials

The description above is the server's own text from the official MCP Registry. If a result looks wrong, run a fresh check and email support@zovo.one with the report link.

More grade B servers

All grade B servers · All server reports · State of MCP readiness, November 2026