MCP server intelligence profile
Defense MCP Server
Provides Claude Desktop access to Defense.com threat intelligence data for risk assessment, threat analysis, and workload management. It also features interactive security training tools and supports over 200 source type aliases for simplified querying
1Distribution channel
16Independently observed tools
0Linked remote endpoints
AvailableVersion intelligence
Install and connect
Installation and connection instructions are shown only when supported by retained package, repository, or endpoint evidence.
No verified installation or connection method is available in the retained evidence yet.
Identity
| Canonical slug | defense-mcp-2112d495 | Deployment | Local Only |
|---|---|---|---|
| Canonical package | — | Repository | defensedotcom/defense-mcp-claude-extension |
| First published | — | Latest release | — |
| Last security verification | Aug 25, 2026 | Classification confidence | 90% |
| Publication | Published | Official distribution | Yes |
Distributions
| Channel | Identifier | Current version | Versions | Source |
|---|---|---|---|---|
| source_git | defensedotcom/defense-mcp-claude-extension | 27b0db488d8c0a5363a4c4ad7900ad2f0bad8462 | 1 | Repository |
Current release
| Package | Version | Published / observed | Inventory | Security scan |
|---|---|---|---|---|
| source_gitdefensedotcom/defense-mcp-claude-extension | 27b0db488d8c0a5363a4c4ad7900ad2f0bad8462Current | Aug 25, 2026 | 16 toolsSucceeded · 0 resources · 0 prompts | Verified clean |
Enterprise protection
Continuously monitor this MCP for security risk
Independently scan the exact version your agents use, receive alerts when its risk changes, and investigate every finding with retained version evidence.
- Independent exact-version security scans
- Continuous release and vulnerability monitoring
- Risk-change alerts with capability context
- Historical evidence and API exports
Custom pricingContact salesTailored to your organization, integrations, data needs, and support requirements.
Current version evidence
| Provenance | immutable_git_commit | Signature | — |
|---|---|---|---|
| MCP SDK | — | Artifact SHA-256 | 75fd06356728ccbfb9b8f75cacb5125a294b61f0aa1f36c0bd48be77608106ab |
| Scanner | mcp-proof-engine 0.1.0 | Scan completed | Aug 25, 2026 |
| Security rating | — | Methodology | — |
0Proven
510Clean
0Inconclusive
0Flaky
1Errors
Current protocol inventory
2025-06-18Negotiated protocol
Defense MCPServer-reported name
1Capability groups
Aug 25, 2026Observed
Tools 16
| Tool | Category | Annotations | Risk |
|---|---|---|---|
generate_training_questionsGenerate training questions based on current threats or specific threat typesInput schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"threat_id": {
"description": "Specific threat ID to base questions on",
"type": "string"
},
"threat_type": {
"description": "Threat category (ransomware, malware, phishing, vulnerability_management, network_security, general)",
"type": "string"
},
"difficulty": {
"default": "intermediate",
"description": "Difficulty level",
"type": "string",
"enum": [
"beginner",
"intermediate",
"advanced",
"all"
]
},
"count": {
"default": 3,
"description": "Number of questions (1-10)",
"type": "number",
"minimum": 1,
"maximum": 10
}
}
} | — | — | |
get_biggest_risksGet the biggest security risks based on risk score and other factorsInput schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {}
} | — | — | |
get_latest_detectionsGet the latest detection events from the last N days, optionally filtered by threat IDInput schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"days": {
"default": 1,
"description": "Number of days to look back (1-365)",
"type": "number",
"minimum": 1,
"maximum": 365
},
"threat_id": {
"description": "Specific threat ID to filter detections for",
"type": "string"
}
}
} | — | — | |
get_new_threatsGet new security threats from the last N daysInput schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"days": {
"default": 1,
"description": "Number of days to look back (1-365)",
"type": "number",
"minimum": 1,
"maximum": 365
}
}
} | — | — | |
get_security_awareness_briefGenerate a security awareness briefing based on current threat landscapeInput schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {}
} | — | — | |
get_threat_details_with_contextGet comprehensive threat details including assets, users, and detectionsInput schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"threat_id": {
"type": "string",
"description": "Threat ID to get details for"
}
},
"required": [
"threat_id"
]
} | — | — | |
get_threat_to_remediate_firstDetermine which threat should be remediated firstInput schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"days": {
"default": 1,
"description": "Number of days to look back (1-365). Note: Not currently used, included for API consistency.",
"type": "number",
"minimum": 1,
"maximum": 365
}
}
} | — | — | |
get_threats_by_assigneeGet all threats assigned to a specific personInput schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"assignee_email": {
"type": "string",
"description": "Email address of the assignee"
}
},
"required": [
"assignee_email"
]
} | — | — | |
get_threats_by_sourceGet threats filtered by source type from the last N days. Supports aliases (e.g., 'pentest', 'm365', 'vuln scan')Input schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"source_type": {
"type": "string",
"description": "Source type to filter by (supports aliases like 'pentest', 'm365', 'vuln scan')"
},
"days": {
"default": 7,
"description": "Number of days to look back (1-365, default: 7)",
"type": "number",
"minimum": 1,
"maximum": 365
},
"state": {
"default": "detected",
"description": "Threat state filter - 'detected' (open), 'remediated' (closed), null for all (default: 'detected')",
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
]
}
},
"required": [
"source_type"
]
} | — | — | |
get_training_for_threatGet specific training content for a particular threatInput schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"threat_id": {
"type": "string",
"description": "Threat ID to get training for"
}
},
"required": [
"threat_id"
]
} | — | — | |
get_training_hintGet a hint for the current training questionInput schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"session_id": {
"type": "string",
"description": "Training session ID"
}
},
"required": [
"session_id"
]
} | — | — | |
get_training_session_statusGet the current status of a training sessionInput schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"session_id": {
"type": "string",
"description": "Training session ID"
}
},
"required": [
"session_id"
]
} | — | — | |
get_workload_analysisAnalyze current threat workload and assignments with dashboard-like overviewInput schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"days": {
"description": "Days to analyze (1-365, omit for all time)",
"type": "number",
"minimum": 1,
"maximum": 365
}
}
} | — | — | |
search_threats_by_keywordSearch for threats containing specific keywords in title or descriptionInput schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"keyword": {
"type": "string",
"description": "Search keyword"
},
"include_description": {
"default": true,
"description": "Whether to search in description too",
"type": "boolean"
}
},
"required": [
"keyword"
]
} | — | — | |
start_training_sessionStart an interactive training sessionInput schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"threat_id": {
"description": "Threat ID for context",
"type": "string"
},
"difficulty": {
"default": "intermediate",
"description": "Difficulty level",
"type": "string",
"enum": [
"beginner",
"intermediate",
"advanced",
"all"
]
},
"session_type": {
"default": "general",
"description": "Session type / threat category",
"type": "string"
}
}
} | — | — | |
submit_training_answerSubmit an answer to a training question and optionally get the next questionInput schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"session_id": {
"type": "string",
"description": "Training session ID"
},
"answer": {
"type": "string",
"description": "Your answer to the question"
},
"request_next": {
"default": true,
"description": "Whether to return the next question",
"type": "boolean"
}
},
"required": [
"session_id",
"answer"
]
} | — | — |
Resources 0
- None observed.
Resource templates 0
- None observed.
Prompts 0
- None observed.
Remote endpoints
| Endpoint | Transport | Authentication | Health | Observed |
|---|---|---|---|---|
| No verified remote endpoint is linked. | ||||
Defense MCP Server questions
How do I install Defense MCP Server?
No verified package installation command is available in the retained catalog evidence.
What tools does Defense MCP Server provide?
Defense MCP Server exposed 16 tools during independent protocol observation, including generate_training_questions, get_biggest_risks, get_latest_detections, get_new_threats, get_security_awareness_brief, get_threat_details_with_context, get_threat_to_remediate_first, get_threats_by_assignee, and others.
Is Defense MCP Server secure?
Our scanner tested version 27b0db488d8c0a5363a4c4ad7900ad2f0bad8462 without proving a finding in the methods exercised. This is not a guarantee that every deployment is secure.
Explore related MCP server guides
Curated product and capability guides containing this catalog record.