See what's exploitable, fix what matters. Spektion identifies real exploitable vulnerabilities in your environment, reducing critical backlogs by 50-80%.
This listing identifies a third-party MCP server. MCPBundles is not affiliated with, sponsored by, or endorsed by the service or its operator unless stated on this page.
This server may ask you to sign in when your AI client connects.
Last probed Nov 3, 2026 · mcp.spektion.com
24tools discovered
For AI agents — MCPBundles Directory API
For MCP client apps (human connect):
MCP connect URL: https://mcp.spektion.com/mcp
Skill page: https://www.mcpbundles.com/skills/spektion-mcp-2b6bcee7ee
Explore capabilities (24)
read 24
Get
12
Search
9
Count
2
Other capabilities
1
Count Ai Session Detections
read
count_ai_session_detections
Census of AI detections across the customer's AI agent sessions: every AI detection rule that has fired, by human-readable name, with the number of DISTINCT SESSIONS each fired in. Use this for "which AI detections have fired", "what AI detections do we have", "most common AI detection", or any question about how widespread a detection is — it answers in one call. Do NOT answer those by paging search_ai_sessions and counting: that can be hundreds of thousands of rows and will not give the right
Count Ai Session Detections — Census of AI detections across the customer's AI agent sessions: every AI detection rule that has fired, by human-readable name, with the number of DISTINCT SESSIONS each fired in. Use this for "which AI detections have fired", "what AI detections do we have", "most common AI detection", or any question about how widespread a detection is — it answers in one call. Do NOT answer those by paging search_ai_sessions and counting: that can be hundreds of thousands of rows and will not give the right
Count Secrets By Detector — Census of secret detectors in the customer's environment: every kind of secret the Spektion scanner has found, with how many findings and how many DISTINCT ASSETS each appears on. Use this for "what kinds of secret do we have", "which secrets are most widespread", "break down our secrets by type", or any question about the shape of the secret population — it answers in one call. Do NOT answer those by paging search_secrets and counting: it returns at most 100 findings per page and a tenant can h
Get Ai Session Artifacts — List the compiled artifacts (binaries) an AI agent session produced, one entry per (binary, path) the session wrote. NOTE this is not a count of distinct binaries: the same binary written to two paths is two entries and counts twice in total_count, which on real data inflates the number by up to 2.6x (one dev session reports 226 entries over 86 distinct binaries). Say "wrote N build outputs", or count the distinct hash values yourself, rather than reporting total_count as the number of programs
Get Asset Details — Get a single asset's full profile by hostname: the asset summary (same fields as search_assets — exposure score/severity, Business Impact tier, online status, counts, and runtime risks), plus the list of installed software (name, publisher, used/unused, versions, grade, score) and observed network activity (software_name, destination, activity, observation_count, is_internal). Also returns secret_count — how many secret findings (hardcoded credentials, API keys, tokens) the Spektion scanner reco
Get Asset Executables — List the executables currently present on a specific asset by hostname, most recently seen first. Returns, per executable: hash, hash_md5 (empty when unknown or metadata is not yet available), the path it was last observed at on this asset, the canonical software it is linked to (software_id, software_name; absent when unlinked), first_seen and last_seen on this asset, execution_count on this asset, signing status (is_signed, is_trusted), detection_count and detection_categories, and detail_url.
Get your MCP into directories
A working endpoint is step one. Directory coverage is the coordinated launch across ChatGPT, Claude, Cursor, the MCP Registry, and community indexes.
See what's exploitable, fix what matters. Spektion identifies real exploitable vulnerabilities in your environment, reducing critical backlogs by 50-80%.
How do I connect Spektion to my AI agent?
Use the MCP endpoint listed on this page in your MCP client configuration. One-click install pills support Claude, Cursor, VS Code, and other hosts. Copy the remote MCP URL if your client needs a manual entry.
How many tools does Spektion provide?
Operate this server?
Request removal if you do not want Spektion listed here, or claim the listing if you want to manage it on MCPBundles.
Operate Spektion?
This server appears in the MCPBundles directory. Verify you operate it to take over the listing — name, description, logo, contact email, and skill content. We email a 6-digit code to a maintainer address your server publishes in /.well-known/security.txt or /.well-known/mcpbundles.json. Free, takes about a minute.
MCPBundles publishes this directory for MCP discovery. Except where we host or operate an offering, third-party services run under their own terms. Product and company names on this page are used in a descriptive, identifying way (including under nominative fair use where applicable); they remain the property of their owners. Nothing here grants you rights in those marks, and nothing here is an offer to sell a third party's services. Terms · Request removal
More in security
Other MCP servers in this category from the directory index
Get Detection Controls — Get the Spektion-specific preventative and detective controls associated with a runtime detection (runtime weakness / risk) — the hardening and monitoring guidance shown on the /risks detail page's Controls tabs. Call this BEFORE offering any hardening or monitoring advice for a runtime weakness. Identify the detection by detection_id (the id/risk_id from search_detections or get_detection_events). Returns preventive_controls (each with title, description, effectiveness, effort), vendor_fix_only
Get Detection Events — Get evidence summaries behind a runtime detection (runtime weakness). Use this tool when asked to show the evidence, events, or logs for a runtime weakness or risk; never route those requests to search_ai_security_risks, which covers the separate AI-security surface. Identify the detection by detection_id when available, or name to resolve it; ambiguous names return candidates so you can retry with a specific ID. Returns software-product groups, not individual events: one row per affected produc
Get Executable Details — Get detailed information about a specific executable by hash. Returns the executable summary (hash_md5 — empty when unknown or metadata is not yet available, filenames, signing/trust status, platform, asset count, detection count) plus observed file paths with full code-signing certificate details (subject, issuer, fingerprint, validity dates, self-signed flag), associated runtime detections (name, category, severity, asset count), and endpoints where the executable is present (hostname, importa
Get Remediation Metrics — Get vulnerability remediation performance metrics: mean, median, P10, and P90 days to remediate, plus KEV-specific metrics and SLA compliance data.
Get Security Posture — Get a high-level security posture overview from internal analytics routes: total assets, an active/stale/disabled asset breakdown (active = enabled and seen within the last 30 days (seen = any sensor check-in, not proof of live monitoring); stale = enabled but not seen in 30 days; disabled = not enabled, at the sensor level — per-asset scan enablement is a separate state this tool does not report — these three are disjoint and sum to total assets), assets by platform, total canonical software, s
Get Software Details — Get details about specific software products matching a name: a risk summary plus the assets (endpoints) where each is installed. Returns, per matched product, a software summary (name, publisher, platform, score, severity, grade, present versions, CVE/detection counts, risk flags, network activity) and an assets array (hostname, ip_address, importance = Business Impact tier, usage_tracked, used, installed versions). CRITICAL for used/unused questions: usage_tracked=false means usage is not trac
Get Tenant Settings — Get tenant configuration including SLA remediation policy, asset importance defaults, and KEV override settings.
Get Vulnerability Details — Look up a specific CVE via internal analytics routes. Always returns CVE ID, severity, CVSS score (score), Spektion risk score (risk_score, risk_severity, plus risk_score_min/risk_score_max for the spread across observed instances) when computed, KEV flag, platforms, first_seen, endpoint_count, detail_url, and impacted assets (hostname/platform). score is the industry CVSS rating; risk_score is Spektion's per-tenant runtime risk score — use risk_score (not score) for 'how risky is this CVE in ou
Get Vulnerability Trends — Get vulnerability trend data: daily delta (new vs resolved), distribution by age and severity, blindspot counts, and preemptive CVE exposure.
Query Sensors — Query sensors/endpoints with server-side pagination, sorting, and filtering via ClickHouse. Returns sensor ID, hostname, OS, agent version, importance, grade, and score. Supports large datasets efficiently.
Search Ai Security Risks — Search AI security detections for the /ai-security surface only, paginated and ordered most-recent-first (last 90 days). Results combine runtime sensor detections (source=runtime) with scanner risk findings (source=scan) for AI/agent activity. Filters (hostname, asset_id, severity, rule_name, source) are applied server-side. Returns items plus total_count (total matches before paging), returned (this page's size), and offset — page through large result sets with limit + offset. Each item has eve
Search Ai Sessions — Search AI agent session summaries across the customer's environment, paginated and ordered most-recent-first. Returns session_id, hostname, platform, asset_id, agent, classification, severity_max, started_at, duration, is_interim, metric_processes, metric_connections, metric_detections, metric_risk_flags, metric_file_writes, detections (when present; each with id and human-readable name — report the names, not the DET-AI-#### codes), risk_flags (when present), and detail_url, plus total_count (t
Search Assets — Search assets (systems with a Spektion sensor). Returns hostname, IP, OS, domain, platform (windows/macos/linux), online status, enabled (sensor-level; per-asset scan enablement is a separate state not reported here), exposure score (0-100, higher = more exposed), exposure severity (CRITICAL/HIGH/MEDIUM/LOW), Business Impact tier (importance: 1=critical … 5=minimal, null=unassigned), first/last seen, last logged-on user, software/unused-software/detection/CVE/network-destination/executable count
Search Detections — Search runtime detections (risks) in the customer's environment. These are Spektion-unique telemetry, distinct from CVEs. Categories: Runtime Weaknesses (likely to become a CVE), Exploit Impact/Blast Radius (increases exposure if exploited), Remotely Exploitable (binds to sockets/accepts connections). Returns name, impact level, category, subcategory, platform, CVE likelihood, affected asset count, affected software count, and detail_url for direct navigation. Filter by name, category, impact, o
Search Executables — Search observed executables across the customer's environment via ClickHouse. Returns hash, hash_md5 (empty when unknown or metadata is not yet available), filenames, asset count, platform, signing status (is_signed, is_trusted), whether the executable is linked to canonical software, detection count, first/last seen, and detail_url. Also returns detection_categories (unique list of detection types such as runtime_weakness, exploit_impact, remotely_exploitable) and a detections array with per-de
Search Network Activity — List the actual outbound network connections (destinations) and inbound port bindings (listeners) observed for a software product — the records behind the software detail page's Network Destinations tab, NOT the aggregate network_destination_count / network_listener_count that search_software reports. This is the right tool whenever the user asks which/what destinations, domains, or IPs a product talks to, or which ports it listens on. Per destination: software_name, hostname (the asset that mad
Search Secrets — Search secret detections (credentials, API keys, tokens, and other sensitive data) found in the customer's environment by the Spektion scanner. Returns event_id, event_time, detector_id, detector_name, detector_tags, hostname, platform, asset_id, matched_params (when present), outputs (when present), and detail_url. detector_name is the REAL detector that fired -- "SSH Private Key", "JWT Token", "AWS Secret Access Key", "Credentials in URL" and ~60 others -- and is the ONLY field that distinguis
Search Software — Search canonical installed software products across all assets using internal analytics routes (legacy software is excluded). Returns name, publisher, platform, endpoint count, unused endpoint count, present version count, CVE count, detection count, elevated detection count, has_elevated_risk, network activity (network destination/listener counts, makes_network_connection), and detail_url, all from internal analytics. score/severity are the software rollup score (higher = riskier) and its sever
Search Vulnerabilities — Search CVE vulnerabilities across the customer's environment using internal analytics routes. Always returns CVE ID, severity, CVSS score (score), Spektion risk score (risk_score) and risk_severity when computed, KEV flag, platforms, first_seen, affected asset count, and detail_url. score is the industry CVSS rating; risk_score is Spektion's per-tenant runtime risk score and is the right field for 'riskiest CVE in our environment' questions. Additional fields (EPSS score, exploit status, remote
MCPBundles probed 24 tools on the live server. The tool list on this page reflects what was discovered at the last refresh — connect your client to see the full set available to your session.
What authentication does Spektion require?
Spektion may require signing in to the provider before tools can run. Connect through MCPBundles or your MCP client and complete any provider login when prompted.
Don't want this listed?
Request removal from the MCPBundles directory. We stop publishing this listing on mcpbundles.com.
MCPBundles is an independent platform built on the open Model Context Protocol standard. MCPBundles is not affiliated with, sponsored by, or endorsed by Anthropic PBC.