Keyboardcrumbs Threat Intel

Created By

kbcrumbs9 days ago

Live threat intelligence for Claude — check IPs, CVEs, KEV predictions, malware hashes, and pre-attack staging detection. Free, no API key required. Data updates every 15 minutes.

# threat-intel

# security

Overview Content Tools Comments

Overview

KeyboardCrumbs MCP Server

mcp-name: com.keyboardcrumbs/mcp

Live threat intelligence tools for Claude Desktop. Free, no API key required.

Tools

Tool	Description
`check_ip`	Threat intel for any IP — risk score, geo, ASN, C2 associations, staging clusters
`check_cve`	CVE lookup — CVSS, EPSS, KEV status, exploit availability, patch urgency
`check_domain`	Domain intel — DNS records, WHOIS, malware associations, subdomains
`check_hash`	Malware hash lookup via VirusTotal (68+ engines) + CIRCL (6.3B files)
`active_threats`	Live snapshot — KEV count, active C2s, ransomware victims, data freshness
`predict_kev`	KEV Oracle — top CVEs predicted to be added to CISA KEV before it happens
`check_staging`	GhostWatch — detect pre-attack infrastructure staging for an IP or domain
`check_ransomware`	Ransomware group lookup and victim tracking

Install

Option 1 — uvx (no install needed)

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "keyboardcrumbs": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/keyboardcrumbs/mcp", "keyboardcrumbs-mcp"]
    }
  }
}

Option 2 — Clone and run locally

git clone https://github.com/keyboardcrumbs/mcp
cd mcp
uv venv && source .venv/bin/activate
uv add "mcp[cli]" httpx

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "keyboardcrumbs": {
      "command": "uv",
      "args": ["--directory", "/path/to/mcp", "run", "server.py"]
    }
  }
}

Restart Claude Desktop.

Example Usage

Once installed, just ask Claude:

"Is 45.141.26.73 malicious?"
"Should I patch CVE-2024-3400 immediately?"
"What CVEs are about to be added to CISA KEV?"
"Is this domain staging for an attack?"
"What's the current threat landscape?"

Claude will call the live KeyboardCrumbs API and return real-time threat intelligence.

Data Sources

URLhaus · Feodo Tracker · AlienVault OTX · CISA KEV · NVD · EPSS · ExploitDB · VirusTotal · CIRCL · SANS ISC DShield · Shodan · RIPE · crt.sh · Ransomware.live

Data updates every 15 minutes. No API key. No signup. No rate limits for normal use.

Server Config

{
  "mcpServers": {
    "keyboardcrumbs": {
      "command": "uvx",
      "args": [
        "--from",
        "keyboardcrumbs-mcp",
        "keyboardcrumbs-mcp"
      ]
    }
  }
}

Recommend Servers

TraeBuild with Free GPT-4.1 & Claude 3.7. Fully MCP-Ready.

Amap Maps高德地图官方 MCP Server

MCP AdvisorMCP Advisor & Installation - Use the right MCP server for your needs

AiimagemultistyleA Model Context Protocol (MCP) server for image generation and manipulation using fal.ai's Stable Diffusion model.

Visual Studio Code - Open Source ("Code - OSS")Visual Studio Code

Baidu Map百度地图核心API现已全面兼容MCP协议，是国内首家兼容MCP协议的地图服务商。

Y GuiA web-based graphical interface for AI chat interactions with support for multiple AI models and MCP (Model Context Protocol) servers.

Playwright McpPlaywright MCP server

DeepChatYour AI Partner on Desktop

ChatWiseThe second fastest AI chatbot™

Jina AI MCP ToolsA Model Context Protocol (MCP) server that integrates with Jina AI Search Foundation APIs.