# Cork (oci · ghcr.io/wyre-ai/cork-mcp:v1.0.0)

MCP server for Cork's cyber-insurance API for MSPs.

- Trust score: 38/100 (low)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- oci · `ghcr.io/wyre-ai/cork-mcp:v1.0.0`: 38/100 (this document), [markdown](https://verifymcp.io/servers/wyre-ai-cork-mcp/ghcr-io-wyre-ai-cork-mcp-v1-0-0.md), [page](https://verifymcp.io/servers/wyre-ai-cork-mcp/ghcr-io-wyre-ai-cork-mcp-v1-0-0)

## Channel facts

- Registry: `oci`
- Package: `ghcr.io/wyre-ai/cork-mcp:v1.0.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Supply Chain Security**: 0/100
  - Malware scan not yet available for this package.
  - Known CVEs could not be checked: this artifact ships no SBOM, so there is no dependency list to read. Publishing one would let us assess it.
  - Install-script risk not yet assessed.
  - Dependency health could not be checked: this artifact ships no SBOM, so there is no dependency list to read. Publishing one would let us assess it.
- **Provenance & Transparency**: 32/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: the license (NOASSERTION) isn't a recognized OSI-approved license.
  - Actively maintained (last published 0 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 76/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3068 tokens (~133/item across 23 items; 23 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 95/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 86% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 23 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 2 categories.** Categories scored 0 because we could not verify them: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the Cork MCP server?

Cork runs locally as a container image, launched with docker run --rm -i ghcr.io/wyre-ai/cork-mcp:v1.0.0. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add wyre-ai-cork-mcp -- docker run --rm -i ghcr.io/wyre-ai/cork-mcp:v1.0.0
```

### Cursor

```json
{
  "mcpServers": {
    "wyre-ai-cork-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-ai/cork-mcp:v1.0.0"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "wyre-ai-cork-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-ai/cork-mcp:v1.0.0"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add wyre-ai-cork-mcp -- docker run --rm -i ghcr.io/wyre-ai/cork-mcp:v1.0.0
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "wyre-ai-cork-mcp": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-ai/cork-mcp:v1.0.0"
      ],
      "enabled": true
    }
  }
}
```

### Hermes

```yaml
mcp_servers:
  wyre-ai-cork-mcp:
    command: "docker"
    args: ["run", "--rm", "-i", "ghcr.io/wyre-ai/cork-mcp:v1.0.0"]
```

### Netclaw

```json
{
  "McpServers": {
    "wyre-ai-cork-mcp": {
      "Transport": "stdio",
      "Command": "docker",
      "Arguments": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-ai/cork-mcp:v1.0.0"
      ]
    }
  }
}
```

### Other

```json
{
  "mcpServers": {
    "wyre-ai-cork-mcp": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/wyre-ai/cork-mcp:v1.0.0"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-20 (score 38)

First indexed and scored.

## MCP tools (23)

### `cork_get_clients` (~191 tokens)

List clients with their financial protection status (warranty_status), associated integration tenants, and the 10 most recent Cork Cyber Scores (newest first). For older scores or a bounded date range, use cork_get_client_score_history. Client UUIDs from this response are required by cork_get_client_devices, cork_get_client_inboxes, cork_get_client_domains, cork_get_compliance_events, and the vulnerability tools. If the API user is a distributor, pass partner_uuid to scope results to a specific partner.

Input parameters:

- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.
- `partner_uuid` (string): Filter by partner UUID (distributor users only). Obtain from cork_get_partners.
- `show_hidden` (boolean): Include hidden/archived clients when true. Defaults to false.

### `cork_get_client_devices` (~139 tokens)

List devices observed for a client across all connected integrations - hostnames, IP addresses, the integration each device was seen in, whether the device can receive a future install dispatch (can_install_software), normalized OS details, resolved device type, and hardware model. Device UUIDs can be used to filter cork_get_software_vulnerabilities. Requires a client UUID from cork_get_clients.

Input parameters:

- `client_uuid` (string, required): Client UUID, from cork_get_clients.
- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.

### `cork_get_client_domains` (~93 tokens)

List email domains observed for a client. Domain UUIDs can be used to filter cork_get_compliance_events. Requires a client UUID from cork_get_clients.

Input parameters:

- `client_uuid` (string, required): Client UUID, from cork_get_clients.
- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.

### `cork_get_client_inboxes` (~104 tokens)

List email inboxes (users and shared mailboxes) observed for a client, with inbox type, associated domains, and the integration each inbox was sourced from. Requires a client UUID from cork_get_clients.

Input parameters:

- `client_uuid` (string, required): Client UUID, from cork_get_clients.
- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.

### `cork_get_client_score_history` (~156 tokens)

List a client's full Cork Cyber Score history, newest first, with the risk points each category (coverage, compliance, vulnerabilities, claims) deducted from that score. Use created_after/created_before to bound a period (both inclusive) for trend reporting - cork_get_clients only carries the 10 most recent scores. Requires a client UUID from cork_get_clients.

Input parameters:

- `client_uuid` (string, required): Client UUID, from cork_get_clients.
- `created_after` (string): Inclusive lower bound.
- `created_before` (string): Inclusive upper bound.
- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.

### `cork_get_compliance_events` (~327 tokens)

List policy violations and risk events detected for a client's assets. Filter by event_type (use cork_get_compliance_event_types for valid values), device, inbox, or domain UUID. Use at_risk=true to show only currently active risks. Resolved events are excluded by default; set show_resolved=true to include them.

Input parameters:

- `at_risk` (boolean): When true, only return currently active (unresolved, unsuppressed) risk events.
- `client_uuid` (string, required): Client UUID, from cork_get_clients.
- `created_after` (string)
- `created_before` (string)
- `device_uuid` (string): Filter to a specific device UUID from cork_get_client_devices.
- `domain_uuid` (string): Filter to a specific domain UUID from cork_get_client_domains.
- `event_type` (string): Filter by event type. Use cork_get_compliance_event_types for valid values.
- `inbox_uuid` (string): Filter to a specific inbox UUID from cork_get_client_inboxes.
- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.
- `resolved_after` (string): Requires show_resolved=true.
- `resolved_before` (string): Requires show_resolved=true.
- `show_resolved` (boolean): Include resolved events in results. Required to use resolved_after/resolved_before. Defaults to false.
- `show_silenced` (boolean): Include silenced/suppressed events in results. Defaults to false.

### `cork_get_compliance_notification_settings` (~115 tokens)

List the notification and alerting rules configured for compliance events on a client's assets - which event types trigger alerts and how they are routed.

Input parameters:

- `client_uuid` (string, required): Client UUID, from cork_get_clients.
- `device_uuid` (string)
- `domain_uuid` (string)
- `inbox_uuid` (string)
- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.

### `cork_get_compliance_event_types` (~39 tokens)

List all compliance event types with their descriptions and cure periods. Use to discover valid event_type values before filtering cork_get_compliance_events.

### `cork_get_software_vulnerabilities` (~256 tokens)

List individual software vulnerabilities with full CVE details including CVSS score, EPSS score, KEV (known exploited) status, and impacted version. Filter by minimum_cvss_score, minimum_epss_score, minimum_priority, or only_known_exploited=true to focus on the highest-risk findings. Scope by client_uuid or device_uuid.

Input parameters:

- `client_uuid` (string): Filter by client, from cork_get_clients.
- `device_uuid` (string): Filter by device, from cork_get_client_devices.
- `minimum_cvss_score` (number): Minimum CVSS score. Defaults to 0.
- `minimum_epss_score` (number): Minimum EPSS score. Defaults to 0.
- `minimum_priority` (string)
- `only_known_exploited` (boolean): Only show known exploited vulnerabilities.
- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.
- `partner_uuid` (string): Filter by partner, for distributors only.
- `sort_by` (string)
- `sort_direction` (string)
- `sw_vendor` (string): Filter by software vendor.

### `cork_get_software_vulnerability_summary` (~165 tokens)

Get a rollup of CVEs grouped by software product, showing number of impacted devices, impacted versions, and highest severity rating. Use client_uuid to scope to a single client. Follow up with cork_get_software_vulnerabilities to drill into specific CVEs for a product.

Input parameters:

- `client_uuid` (string): Filter by client, from cork_get_clients.
- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.
- `partner_uuid` (string): Filter by partner, for distributors only.
- `sort_by` (string)
- `sort_direction` (string)
- `sw_vendor` (string): Filter by software vendor.

### `cork_get_available_integrations` (~111 tokens)

List integration types that can be connected to Cork, including required credential fields. Metadata about what CAN be connected, not what IS connected - see cork_get_connected_integrations for that.

Input parameters:

- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.
- `vendor_type` (string): Filter by vendor type (e.g. 'rmm', 'edr', 'mfa').

### `cork_get_connected_integrations` (~161 tokens)

List integrations connected to Cork - vendor, connection status, and sync details. RMM integrations also carry an installer block describing whether software installs can run through them (capable, requires_manual_setup, authorized, configured_package_managers). Use with cork_get_client_devices to see which integration a device is mapped through. Discovers integration UUIDs needed by cork_get_integration_devices, cork_get_integration_users, and cork_get_integration_tenants.

Input parameters:

- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.
- `partner_uuid` (string): Filter by partner UUID (distributor users only). Obtain from cork_get_partners.

### `cork_get_integration_devices` (~100 tokens)

List devices observed from an integration - hostnames, IP addresses, device properties, and normalized OS details for devices that have been mapped.

Input parameters:

- `integration_uuid` (string, required): Integration UUID, from cork_get_connected_integrations.
- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.
- `tenant_uuid` (string)

### `cork_get_integration_tenants` (~82 tokens)

List customer tenants observed from an integration.

Input parameters:

- `integration_uuid` (string, required): Integration UUID, from cork_get_connected_integrations.
- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.
- `tenant_uuid` (string)

### `cork_get_integration_users` (~80 tokens)

List users observed from an integration.

Input parameters:

- `integration_uuid` (string, required): Integration UUID, from cork_get_connected_integrations.
- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.
- `tenant_uuid` (string)

### `cork_get_warranties` (~103 tokens)

List active cyber warranty packages. To identify which clients lack coverage, check the warranty_status field in cork_get_clients results - clients with 'unwarranted' status have no active warranty.

Input parameters:

- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.
- `partner_uuid` (string): Filter by partner UUID (distributor users only).

### `cork_get_invoices` (~90 tokens)

List billing invoices. Returns invoice UUIDs required by cork_get_invoice_line_items. If the API user is a distributor, pass partner_uuid to scope results to a specific partner.

Input parameters:

- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.
- `partner_uuid` (string)

### `cork_get_invoice_line_items` (~154 tokens)

List billed, top-level line items for an invoice (obtained via cork_get_invoices). Only items with a nonzero total billed are returned; discount line items are included and carry a negative total_billed. Sub-items billed as part of a parent line item (e.g. individual licenses within a bundle) are nested under that item's children field, and always carry a total_billed of 0 since their amount is rolled into the parent.

Input parameters:

- `invoice_uuid` (string, required): Invoice UUID, from cork_get_invoices.
- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.

### `cork_get_partners` (~87 tokens)

List partner sub-accounts managed by this distributor. Returns partner UUIDs that can be passed as partner_uuid to cork_get_clients and other tools to scope results to a specific partner. Distributor accounts only.

Input parameters:

- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.

### `cork_get_installer_history` (~205 tokens)

List past software install attempts (most recent first) with dispatch state, target client/device, package, and any errors. Filter by client_uuid or device_uuid. state is one of queued, running, success, partial, error - 'success' means the RMM accepted the job, not that the on-device install finished.

Input parameters:

- `client_uuid` (string): Filter to installs targeting a single client. Obtain from cork_get_clients.
- `device_uuid` (string): Filter to installs targeting a single mapped device. Obtain from cork_get_client_devices.
- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.
- `partner_uuid` (string): Filter by partner UUID (distributor users only). Distributors scoping to a child partner's client or device must set this too - client_uuid/device_uuid alone stay scoped to your own partner's install…

### `cork_get_software_packages` (~134 tokens)

List software packages available to install across supported package managers (WinGet, Chocolatey). Filter by package_manager_key or search (substring match against name/publisher). Returns package_id values that would be used by a future install dispatch - this connector does not implement software install itself.

Input parameters:

- `package_manager_key` (string): Filter by package manager key.
- `page` (number): Page number (1-based). Defaults to 1.
- `page_size` (number): Items per page (max 100). Defaults to 10.
- `search` (string): Case-insensitive substring match against package name and publisher.

### `cork_get_installer_setup` (~139 tokens)

Get the one-time setup steps for an RMM vendor that requires manual setup before software installs work - the script to create in the RMM, its exact name, settings to match, and variables to declare. Use when a connected integration shows installer.requires_manual_setup=true (and the package manager is missing from installer.configured_package_managers).

Input parameters:

- `package_manager_key` (string, required): Package manager the setup is for.
- `vendor_key` (string, required): RMM vendor key to set up (e.g. NINJA_RMM, DATTO_RMM). Obtain from a connected integration's vendor.key where installer.requires_manual_setup is true.

### `cork_who_am_i` (~37 tokens)

Get information on the authenticated Cork user (identity, role, and partner/distributor scope). Useful for a quick credential sanity check.

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/wyre-ai-cork-mcp/ghcr-io-wyre-ai-cork-mcp-v1-0-0#diagnostics

## Score history

- 2026-09-20: 38

## Common questions

### What is the Cork MCP server?

Cork is an MCP server listed in the public MCP registry as io.github.WYRE-AI/cork-mcp. MCP server for Cork's cyber-insurance API for MSPs. This page covers its container image (ghcr.io/wyre-ai/cork-mcp:v1.0.0).

### Is the Cork MCP server safe to use?

Cork scores 38 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Cork MCP server expose?

Cork exposes 23 tools: cork_get_clients, cork_get_client_devices, cork_get_client_domains, cork_get_client_inboxes, cork_get_client_score_history, and 18 more. Their descriptions and schemas cost roughly 3,068 tokens of context every time the server is loaded.

### Is the Cork MCP server still maintained?

Cork is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Cork MCP server under?

Cork declares the NOASSERTION licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.

## Links

- Repository: https://github.com/WYRE-AI/cork-mcp
- Changelog RSS feed: https://verifymcp.io/servers/wyre-ai-cork-mcp/ghcr-io-wyre-ai-cork-mcp-v1-0-0.xml
- Changelog JSON feed: https://verifymcp.io/servers/wyre-ai-cork-mcp/ghcr-io-wyre-ai-cork-mcp-v1-0-0.json
- HTML version of this page: https://verifymcp.io/servers/wyre-ai-cork-mcp/ghcr-io-wyre-ai-cork-mcp-v1-0-0