Agent MCP Directory

Casco: MCP server, CLI and agent surfaces

Yes: Casco runs a public MCP server at casco.com that listed 4 tools to a client with no credentials on 4 November 2026. Examples: get_cve, check_dependencies, list_cve_updates. It speaks streamable-http, protocol 2025-11-25. Ora's cached score for casco.com is 41, grade D, read on 5 November 2026.

Fact sheet

CompanyCasco (registry title: CVE Intelligence by Casco)
Domaincasco.com
CategorySecurity (Ora leaderboard category)
MCP serverVerified (No authentication)
Ora score41, grade D; Ora scanned the domain on 22 August 2026 and the cached score was read on 5 November 2026 from its score API (Ora's score page for casco.com, a vendor-published score)
Company found throughOra's public leaderboard
Last verified4 November 2026

MCP server

Endpointhttps://casco.com/cve/mcp
How it was foundlisted in Ora's public leaderboard
Transportstreamable-http
HTTP status200
Protocol version2025-11-25
Servercom.casco/cve-intelligence 1.0.0
Capabilitiestools
Tools4
Resources0
Prompts0
Connected4 November 2026, 20:02 UTC
Handshake time1,063 ms over 1 attempt

Tools listed

4 tools

  • get_cve
  • check_dependencies
  • list_cve_updates
  • list_ecosystems

Connector log

2 connections on 4 November 2026, read-only methods only

  • 19:56:49Z https://casco.com/cve/mcp sent initialize, notifications/initialized, tools/list result verified (HTTP 200) 1181 ms
  • 20:02:20Z https://casco.com/cve/mcp sent initialize, notifications/initialized, tools/list result verified (HTTP 200) 1063 ms

Authentication

Auth typeNo authentication

The sign-in route, step by step

  1. Send the handshake to https://casco.com/cve/mcp over streamable-http. Servers on the 2026-07-28 revision answer server/discover; older servers answer initialize.
  2. Send tools/list, then resources/list and prompts/list if the capabilities name them.
  3. Send no token. The connector sent none and the server answered, so any MCP client can read this list.
  4. Calling a tool is a separate step this directory never takes.

See OAuth for MCP: client ID metadata documents and dynamic registration for how each route works.

CLI

No CLI is on record for Casco. The directory checks a package only where a source names one, so this is a floor: a company can ship a command line that no source read for this edition mentions. See shipping a CLI agents can use.

Other agent surfaces

Agent surfaces other than MCP and CLI
SurfaceResult
OpenAPI fileNo OpenAPI file at the root paths checked.
WebMCP in the initial HTMLNot detected on the home page by the shared crawl.
MCP discovery fileNot found (the crawl got a non-200 answer).
A2A agent cardNot found (the crawl got a non-200 answer).
A2A agent card (older path)Not found (the crawl got a non-200 answer).
agents.jsonNot found (the crawl got a non-200 answer).
OAuth authorization server metadataNot found (the crawl got a non-200 answer).
NLWeb endpointNot checked in this edition.

Registry listings

Registry listings
RegistryListed
Official MCP RegistryYes: com.casco/cve-intelligence
GitHub MCP RegistryNo
awesome-remote-mcp-serversNo
SmitheryNot checked: Smithery's listing pages and search API were unavailable on 4 November 2026.
GlamaNot checked: Glama's API needs a key and attribution terms.