# Distributed Risk desk (remote · www.distributedrisk.com)

Read the Distributed Risk desk notes and the official US record they cite.

- Trust score: 73/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `www.distributedrisk.com`: 73/100 (this document), [markdown](https://verifymcp.io/servers/com-distributedrisk-desk/www.md), [page](https://verifymcp.io/servers/com-distributedrisk-desk/www)

## Channel facts

- Endpoint: `https://www.distributedrisk.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.5.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 80/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 60/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 3367 tokens (~210/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 20/100
  - Stability observed for 6 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 94/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 81% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 16 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the Distributed Risk desk MCP server?

Distributed Risk desk is a hosted endpoint at https://www.distributedrisk.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-distributedrisk-desk 'https://www.distributedrisk.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-distributedrisk-desk": {
      "url": "https://www.distributedrisk.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-distributedrisk-desk": {
      "type": "http",
      "url": "https://www.distributedrisk.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-distributedrisk-desk]
url = "https://www.distributedrisk.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-distributedrisk-desk": {
      "type": "remote",
      "url": "https://www.distributedrisk.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-distributedrisk-desk --url 'https://www.distributedrisk.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-distributedrisk-desk:
    url: "https://www.distributedrisk.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-distributedrisk-desk": {
      "Transport": "http",
      "Url": "https://www.distributedrisk.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-distributedrisk-desk -t streamable-http -u 'https://www.distributedrisk.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-distributedrisk-desk": {
      "type": "http",
      "url": "https://www.distributedrisk.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-02 (score 72, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [functional regression] Schema quality: 177 → 210
- [functional] Server version: 1.5.0 → 1.6.0
- [functional] New tool “check_dependencies”
- [functional] New tool “list_new_vulnerabilities”

### 2026-11-01 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 71, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-10-30 (score 71)

First indexed and scored.

## MCP tools (16)

### `list_notes` (~231 tokens)

List desk notes

Published desk notes, newest first: entry number, date, title, status, topic (cyber or sanctions), readers, source class, a one-line summary, and the note's URL. Pages with limit and offset; total is the count that matches, next_offset the offset of the next page. Filter by topic or reader as on the desk page.

Input parameters:

- `limit` (integer): How many notes to return.
- `offset` (integer): How many matching notes to skip, for the next page.
- `reader` (string): Only notes written for this reader: sanctions-trade-finance-committee (Sanctions or trade-finance committee), owner-operating-executive (Owner or operating executive), platform-ai-stack-owner (Platfo…
- `since` (string): Only notes dated on or after this day (YYYY-MM-DD).
- `topic` (string): cyber (exploited vulnerabilities, advisories, incident filings, the AI stack) or sanctions (everything else).

### `search_notes` (~70 tokens)

Search desk notes

Find published notes that mention every word of the query (a name, a list, a country, a program, a date) in the title, summary, sources or body.

Input parameters:

- `limit` (integer)
- `query` (string, required): Words to find, for example "Venezuela general license".

### `get_note` (~45 tokens)

Read a desk note

One published note in full (Markdown), with its numbered sources and links to the official record.

Input parameters:

- `slug` (string, required): The note's slug, from list_notes or search_notes.

### `search_screening_lists` (~204 tokens)

Search the US screening lists

Search the Consolidated Screening List (OFAC SDN and other Treasury lists; BIS Entity, Denied Persons, Unverified and Military End User lists; State ITAR-debarred and nonproliferation lists) by name, alias or identifier (IMO, SWIFT/BIC, registration number). Close spellings match. Each result gives the list, programs, addresses, IDs, remarks and the official list link; the answer says when each list last changed.

Input parameters:

- `country` (string): Only entries with an address in this country (two-letter code).
- `limit` (integer)
- `lists` (array): Only these lists, for example ["SDN", "EL"].
- `min_score` (number): How close a name must be. 1 is exact; lower allows more spelling variation.
- `query` (string, required): A name (person, company, vessel, aircraft) or an identifier.
- `type` (string)

### `list_ofac_actions` (~107 tokens)

OFAC recent actions

OFAC's recent actions, newest first: designations and removals, general licenses, FAQs, regulations and settlements, each with its date, categories and the official page. Filter by date or words in the title.

Input parameters:

- `limit` (integer)
- `query` (string): Words in the title or category, for example "Iran general license".
- `since` (string): Only actions on or after this day (YYYY-MM-DD). Reaches back about 30 actions.

### `search_kev` (~221 tokens)

Search CISA's KEV catalog

CISA's Known Exploited Vulnerabilities catalog, newest first: CVE, vendor, product, date added, federal due date, known ransomware use, the required action, FIRST's EPSS estimate, and whether it sits in the AI and agent software stack. Look up one CVE, search vendor or product words, list what was added since a date, or only the AI stack. For one CVE in full, use get_cve.

Input parameters:

- `ai_stack` (boolean): true: only AI and agent software (agent frameworks, MCP, model serving, ML platforms, GPU infrastructure, AI assistants).
- `cve` (string): One CVE, for example CVE-2025-62593.
- `limit` (integer)
- `query` (string): Vendor, product or vulnerability words, for example "fortinet fortios".
- `ransomware` (boolean): true: only entries CISA marks as used in ransomware campaigns.
- `since` (string): Only entries added on or after this day (YYYY-MM-DD).

### `search_federal_register` (~182 tokens)

Search the Federal Register

Search Federal Register rules, proposed rules, notices and presidential documents: title, type, agencies, publication and effective dates, citation, abstract and the official document link. Narrow by agency (for example foreign-assets-control-office, industry-and-security-bureau, state-department), type or date.

Input parameters:

- `agency` (string): Federal Register agency slug, for example foreign-assets-control-office, treasury-department, industry-and-security-bureau, state-department, homeland-security-department.
- `limit` (integer)
- `order` (string)
- `since` (string): Only documents published on or after this day (YYYY-MM-DD).
- `term` (string, required): Words to find, for example "entity list additions".
- `type` (string): RULE, PRORULE (proposed rule), NOTICE or PRESDOCU (presidential document).

### `list_travel_advisories` (~118 tokens)

State travel advisories

US State Department travel advisories, most recently updated first: country, level (1 to 4), the advisory's summary and the official page. Filter by country, minimum level or update date.

Input parameters:

- `country` (string): A country name, or State's two-letter code.
- `limit` (integer)
- `min_level` (integer): Only advisories at this level or higher (4 is Do Not Travel).
- `since` (string): Only advisories updated on or after this day (YYYY-MM-DD).

### `get_reference_rates` (~124 tokens)

New York Fed reference rates

The New York Fed's reference rates: EFFR and OBFR (unsecured), SOFR, BGCR and TGCR (secured), and the SOFR averages and index (SOFRAI). With no rate, the latest of each; with a rate, its last N days, with percentiles, volume and, for EFFR, the target range.

Input parameters:

- `last` (integer): How many days of history, when a rate is given.
- `rate` (string): One rate, for its history. Omit for the latest of all.

### `get_treasury_yields` (~116 tokens)

Treasury par yield curve

Treasury's daily par yield curve, newest first: yields by tenor from 1 month to 30 years. Ask for the last N days, and optionally only some tenors (for example ["2 Yr", "10 Yr"]).

Input parameters:

- `last` (integer): How many business days.
- `tenors` (array): Tenors as Treasury names them: 1 Mo, 3 Mo, 6 Mo, 1 Yr, 2 Yr, 5 Yr, 10 Yr, 30 Yr…

### `get_cve` (~95 tokens)

One CVE, in full

Everything the record says about one CVE, in one answer: the CVE.org record (description, severity, weakness, affected products, references), CISA's exploitation call (SSVC) and its KEV listing with the federal due date, FIRST's EPSS estimate, and whether it sits in the AI and agent software stack.

Input parameters:

- `cve` (string, required): For example CVE-2025-62593.

### `list_cyber_advisories` (~181 tokens)

CISA cybersecurity advisories

CISA's advisories, newest first: alerts, joint cybersecurity advisories (#StopRansomware, state-sponsored activity), ICS and ICS-medical advisories, and analysis reports. Each with its kind, date, summary, the CVEs it names and the official page. Filter by kind, date, words, or the AI stack.

Input parameters:

- `ai_stack` (boolean): true: only advisories that name AI or agent software.
- `kind` (string): One kind. Asking for one kind reads that kind's own feed, which reaches further back.
- `limit` (integer)
- `query` (string): Words in the title, summary or CVEs, for example "ransomware" or "Siemens".
- `since` (string): Only advisories published on or after this day (YYYY-MM-DD).

### `list_cyber_incident_filings` (~175 tokens)

Cyber incidents reported to the SEC

Cybersecurity incidents public companies report on Form 8-K, newest first: Item 1.05 (the company judged it material) and, unless excluded, Item 8.01 reports made without that judgment. Each with the company, tickers, filing and event dates, items, state, industry code and the EDGAR filing.

Input parameters:

- `limit` (integer)
- `material_only` (boolean): true: only Item 1.05 filings.
- `query` (string): Company name, ticker, CIK or state.
- `since` (string): Filed on or after this day (YYYY-MM-DD). Default 90 days ago; Item 1.05 began 2023-12-18.
- `until` (string): Filed on or before this day. Default today.

### `list_ai_stack_vulnerabilities` (~241 tokens)

AI and agent stack: new advisories

New advisories against the software AI agents run on, newest and most severe first: agent frameworks (LangChain, LlamaIndex, CrewAI, n8n, Langflow), LLM gateways (LiteLLM), MCP servers and SDKs, model serving (vLLM, Ollama), ML platforms (MLflow, Ray, Jupyter), model libraries, AI apps and coding agents. Malicious-package reports (a compromised or lookalike release) come first. CISA KEV entries in the same stack are included. Each with package, severity, fixed versions, CVEs, EPSS and the advisory.

Input parameters:

- `include_kev` (boolean): Include CISA KEV entries for AI-stack products added in the window.
- `kind` (string)
- `layer` (string): One layer of the stack.
- `limit` (integer)
- `package` (string): One package name, for example litellm or @modelcontextprotocol/sdk.
- `since` (string): Advisories dated on or after this day (YYYY-MM-DD). Default 14 days ago; reaches back 30 days.

### `check_dependencies` (~407 tokens)

Check dependencies against the vulnerability record

Which of these package versions have a known vulnerability. Give packages directly (ecosystem, name, version), or paste a lockfile or SBOM as manifest and it is read for you: package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, Pipfile.lock, go.mod, go.sum, Cargo.lock, Gemfile.lock, composer.lock, packages.lock.json, gradle.lockfile, cyclonedx, spdx, purls. Each version is checked against OSV.dev, which aggregates GitHub's reviewed advisories, the Go and PyPI databases, RustSec and OpenSSF's malicious-package reports across npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist and more. Every hit comes back with its severity, the CVEs it is known by, the versions that fix it, whether CISA lists it as exploited with the federal due date, and FIRST's EPSS estimate. Exploited packages come first, then malicious packages, then severity. A version with no hit is a version no advisory in those databases covers; that is not a statement that it is safe. Only resolved versions are read: a file of ranges (package.json, Pipfile, pom.xml) cannot be checked, so pass the lockfile beside it.

Input parameters:

- `filename` (string): The manifest's filename, when you have it. Without it the format is read from the content.
- `kev_only` (boolean): true: only advisories CISA lists as exploited.
- `limit` (integer): How many affected packages to return. The counts cover all of them.
- `manifest` (string): The contents of a lockfile or SBOM. Use this or packages.
- `packages` (array): The packages to check, as installed. Use this or manifest.
- `severity_min` (string): Only this severity and above. Malicious packages and anything CISA lists as exploited are always returned.

### `list_new_vulnerabilities` (~360 tokens)

New vulnerabilities: GitHub, NVD and CISA KEV

What is new across the three vulnerability feeds, exploited first, then by severity, then newest: GitHub's reviewed advisories (the affected package range and the first patched version), NVD's newly published CVE records (software no package ecosystem carries, with NIST's scoring), and the CVEs CISA added to its Known Exploited Vulnerabilities catalog. A KEV addition keeps its own date: it is CISA saying this one is being exploited now, often long after the CVE was published. A CVE that GitHub and NVD both published in the window appears once, from GitHub. For CISA's alerts and joint advisories rather than vulnerabilities, use list_cyber_advisories.

Input parameters:

- `ai_stack` (boolean): true: only entries that name AI or agent software. false: only entries that do not.
- `ecosystem` (string): One package ecosystem, as GitHub names it. GitHub only; NVD and KEV are skipped when it is set.
- `limit` (integer)
- `query` (string): Words to find: NVD searches its records, GitHub and KEV entries are matched on summary, package, vendor and product.
- `severity` (string): This severity band only. GitHub and NVD; KEV, which does not rate severity, is skipped when it is set.
- `since` (string): Dated on or after this day (YYYY-MM-DD). Default 7 days ago.
- `source` (array): Which feeds to read. Default all three. A source that cannot honour a filter is skipped and named in the answer.
- `until` (string): Dated on or before this day. Default today.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-distributedrisk-desk/www#diagnostics

## Score history

- 2026-11-05: 73
- 2026-11-04: 73
- 2026-11-03: 72
- 2026-11-02: 72
- 2026-11-01: 72
- 2026-10-31: 71
- 2026-10-30: 71

## Common questions

### What is the Distributed Risk desk MCP server?

Distributed Risk desk is an MCP server listed in the public MCP registry as com.distributedrisk/desk. Read the Distributed Risk desk notes and the official US record they cite. This page covers its hosted endpoint (https://www.distributedrisk.com/mcp).

### Is the Distributed Risk desk MCP server safe to use?

Distributed Risk desk scores 73 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Distributed Risk desk MCP server expose?

Distributed Risk desk exposes 16 tools: list_notes, search_notes, get_note, search_screening_lists, list_ofac_actions, and 11 more. Their descriptions and schemas cost roughly 2,877 tokens of context every time the server is loaded.

### Does the Distributed Risk desk MCP server require authentication?

No. We connected to Distributed Risk desk without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Distributed Risk desk MCP server still maintained?

Distributed Risk desk is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://www.distributedrisk.com/mcp
- Website: https://www.distributedrisk.com/agents
- Changelog RSS feed: https://verifymcp.io/servers/com-distributedrisk-desk/www.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-distributedrisk-desk/www.json
- HTML version of this page: https://verifymcp.io/servers/com-distributedrisk-desk/www