#threat-intel

A live MCP server exposing DugganUSA's threat-intelligence corpus to MCP-speaking agents. Read-only, secure-by-default. JSON-RPC 2.0 over HTTP at `https://analytics.dugganusa.com/api/v1/mcp`.

AI security intelligence on Base. Three paid MCP tools: CVE vulnerability lookup ($0.01), IP/domain reputation check ($0.01), and secret/credential scan ($0.05). Pay-per-call via x402 USDC on Base. No API keys required for callers. Hosted on Cloudflare Workers with per-tool x402 payment challenges.

WhoisJSON MCP Server exposes four domain intelligence tools directly inside Claude, Cursor, and Windsurf — no code required. whois_lookup: Full WHOIS registration record for any domain — registrar, creation and expiry dates, nameservers, registrant contacts, and DNSSEC status. dns_lookup: All DNS records in a single call — A, AAAA, MX, TXT, CNAME, NS, SOA, CAA, DMARC, and more. Useful for mail server audits, SPF/DKIM verification, and infrastructure mapping. ssl_check: TLS certificate details including issuer, expiry date, Subject Alternative Names, and full chain validity. Detect expired or misconfigured certificates instantly. domain_availability: Instant registration availability check for any TLD. Returns a clear registered/available status. Your WhoisJSON API key works identically for the REST API and the MCP server. 1,000 free requests/month, no credit card required. Get your API key at whoisjson.com.

Security intelligence MCP server with 29 tools. Domain recon + one-shot audit, CVE/EPSS/KEV lookup (340K+ CVEs), IP threat reports (AbuseIPDB + Shodan + ASN), bulk CVE/IOC lookups, IOC enrichment, SSL/email security scoring, code security scanning. Free tier 100 credits/hour, no API key required. 15+ GitHub stars, VS Code Marketplace extension, npm SDK, Smithery 98/100.

Real-time phishing detection, IP reputation, and CVE risk analysis API for AI agents. Powered by live threat feeds (OpenPhish, Feodo Tracker, URLhaus). Pay per request via x402 micropayments (USDC on Base). First 1,000 requests free, no signup required.

x402-paid threat intelligence and market data for AI agents on Solana. Real-time threat feeds from URLhaus, ThreatFox, and MalwareBazaar. Live market data from CoinGecko, DeFi Llama, and Coinbase. Network health monitoring. All endpoints pay-per-call via x402 USDC micropayments. Part of the RelayZero agent economy network.

Live threat intelligence for Claude — check IPs, CVEs, KEV predictions, malware hashes, and pre-attack staging detection. Free, no API key required. Data updates every 15 minutes.

DNS, IP, AS, domain reputation, and Lightning Network intelligence. 44 tools for DNS lookups, reverse DNS, passive DNS, IP reputation, threat intelligence, AS/BGP routing, domain rankings, MAC address lookups, and Bitcoin Lightning Network data. No authentication required.

Connect real-time cybersecurity threat intelligence to your AI workflows through standardized tools and resources. Access comprehensive IOCs, CVEs, TTPs, and threat actor data from FalconFeeds.io with seamless integration across Claude Desktop, VS Code, and other MCP-enabled applications.

Kaspersky OpenTIP Model Context Protocol Server This server gives access to Kaspersky OpenTIP API to agentic applications.

Kaspersky OpenTIP Model Context Protocol Server This server gives access to Kaspersky OpenTIP API to agentic applications.

AlienVault/USM Anywhere MCP Server - Threat intelligence and security monitoring

AgentNull: AI System Security Threat Catalog + Proof-of-Concepts. Collection of PoCs for using Agents, MCP, and RAG in bad ways.

MCP server for Microsoft Sentinel. Enables access to Sentinel logs, incidents, analytics, and Entra ID data via a modular, queryable interface. Strictly non-production. Designed for use with Claude and other LLMs.

A Model Context Protocol (MCP) server that integrates with the MISP (Malware Information Sharing Platform) to provide threat intelligence capabilities to Large Language Models.

MCP server for ORKL Threat Intelligence Library

MCP server for Threat info collection in cyber security

MCP Server for mallory.ai intelligence

This is a threat intel MCP server connected to the ORKL API to retrieve threat report and ask for IOCs, Threat Actors and breaches.