Keyboardcrumbs Threat Intel

Created By

kbcrumbs10 days ago

Live threat intelligence for Claude — check IPs, CVEs, KEV predictions, malware hashes, and pre-attack staging detection. Free, no API key required. Data updates every 15 minutes.

# threat-intel

# security

Overview Content Tools Comments

Content

KeyboardCrumbs MCP Server

mcp-name: com.keyboardcrumbs/mcp

Live threat intelligence tools for Claude Desktop. Free, no API key required.

Tools

Tool	Description
`check_ip`	Threat intel for any IP — risk score, geo, ASN, C2 associations, staging clusters
`check_cve`	CVE lookup — CVSS, EPSS, KEV status, exploit availability, patch urgency
`check_domain`	Domain intel — DNS records, WHOIS, malware associations, subdomains
`check_hash`	Malware hash lookup via VirusTotal (68+ engines) + CIRCL (6.3B files)
`active_threats`	Live snapshot — KEV count, active C2s, ransomware victims, data freshness
`predict_kev`	KEV Oracle — top CVEs predicted to be added to CISA KEV before it happens
`check_staging`	GhostWatch — detect pre-attack infrastructure staging for an IP or domain
`check_ransomware`	Ransomware group lookup and victim tracking

Install

Option 1 — uvx (no install needed)

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "keyboardcrumbs": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/keyboardcrumbs/mcp", "keyboardcrumbs-mcp"]
    }
  }
}

Option 2 — Clone and run locally

git clone https://github.com/keyboardcrumbs/mcp
cd mcp
uv venv && source .venv/bin/activate
uv add "mcp[cli]" httpx

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "keyboardcrumbs": {
      "command": "uv",
      "args": ["--directory", "/path/to/mcp", "run", "server.py"]
    }
  }
}

Restart Claude Desktop.

Example Usage

Once installed, just ask Claude:

"Is 45.141.26.73 malicious?"
"Should I patch CVE-2024-3400 immediately?"
"What CVEs are about to be added to CISA KEV?"
"Is this domain staging for an attack?"
"What's the current threat landscape?"

Claude will call the live KeyboardCrumbs API and return real-time threat intelligence.

Data Sources

URLhaus · Feodo Tracker · AlienVault OTX · CISA KEV · NVD · EPSS · ExploitDB · VirusTotal · CIRCL · SANS ISC DShield · Shodan · RIPE · crt.sh · Ransomware.live

Data updates every 15 minutes. No API key. No signup. No rate limits for normal use.

Server Config

{
  "mcpServers": {
    "keyboardcrumbs": {
      "command": "uvx",
      "args": [
        "--from",
        "keyboardcrumbs-mcp",
        "keyboardcrumbs-mcp"
      ]
    }
  }
}

Recommend Servers

TraeBuild with Free GPT-4.1 & Claude 3.7. Fully MCP-Ready.

DeepChatYour AI Partner on Desktop

Playwright McpPlaywright MCP server

BlenderBlenderMCP connects Blender to Claude AI through the Model Context Protocol (MCP), allowing Claude to directly interact with and control Blender. This integration enables prompt assisted 3D modeling, scene creation, and manipulation.

MCP AdvisorMCP Advisor & Installation - Use the right MCP server for your needs

WindsurfThe new purpose-built IDE to harness magic

EdgeOne Pages MCPAn MCP service designed for deploying HTML content to EdgeOne Pages and obtaining an accessible public URL.

CursorThe AI Code Editor

Amap Maps高德地图官方 MCP Server

Y GuiA web-based graphical interface for AI chat interactions with support for multiple AI models and MCP (Model Context Protocol) servers.

Visual Studio Code - Open Source ("Code - OSS")Visual Studio Code