MCP server

SecLookup has a Model Context Protocol server, so AI assistants can search the same data as this site. It is free, read-only and needs no API key.

https://seclookup.onefirewall.com/mcp

The server uses the Streamable HTTP transport. Add the URL above to your MCP client:

Claude Code

claude mcp add --transport http seclookup https://seclookup.onefirewall.com/mcp

Claude (web and desktop app)

Open Settings → Connectors → Add custom connector, enter SecLookup as the name and paste the URL above.

Cursor, Windsurf and other clients

Add this to the client's MCP configuration file, for example ~/.cursor/mcp.json:

{
  "mcpServers": {
    "seclookup": {
      "url": "https://seclookup.onefirewall.com/mcp"
    }
  }
}

VS Code

Add this to .vscode/mcp.json:

{
  "servers": {
    "seclookup": {
      "type": "http",
      "url": "https://seclookup.onefirewall.com/mcp"
    }
  }
}

Clients that only run local servers

Use mcp-remote (needs Node.js) as a bridge, for example in claude_desktop_config.json:

{
  "mcpServers": {
    "seclookup": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://seclookup.onefirewall.com/mcp"]
    }
  }
}

Tools

Tool	What it does
`search`	Full-text search with the same ranking as the website. Parameters: `query`, optional `source` (`cve`, `kev`, `cwe`, `capec`, `attack`, `owasp`, `compliance`, `ghsa`, `d3fend`, `atlas`), `sort` (`relevance`, `new` or `epss`), `limit` and `page`.
`get_entry`	The full record for an `id`: description, severity, CISA KEV data, references and related entries. A missing ATT&CK sub-technique returns its parent technique.
`latest`	The newest CVEs (`source`: `cve`) or the newest known exploited vulnerabilities (`kev`), with an optional `limit`.

Try asking your assistant: "Which ATT&CK techniques does Volt Typhoon use?" or "Summarise CVE-2021-44228 and whether it is exploited in the wild."

Test it with curl

curl -s https://seclookup.onefirewall.com/mcp \
  -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_entry","arguments":{"id":"CWE-79"}}}'

Results come from the same data as the website, so the data sources and their terms apply. For plain JSON over HTTP, see the search API.