# DugganUSA CLI — Local STDIO MCP [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/pduggusa/dugganusa-cli  
**GitHub Stars:** 2  
**npm Downloads (last month):** 212  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/dugganusa-cli-local-stdio-mcp

## Description
Local STDIO MCP for DugganUSA threat intel. 1.13M IOCs. Read-only. npm: dugganusa-cli.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "dugganusa-cli-local-stdio-mcp": {
    "command": "npx",
    "args": ["-y","dugganusa-cli"],
    "env": {
      "DUGGANUSA_API_KEY": ""
    }
  }
}
```

**Requires environment variables:** `DUGGANUSA_API_KEY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What DugganUSA CLI — Local STDIO MCP does

DugganUSA CLI — Local STDIO MCP gives an AI agent read-only access to the DugganUSA threat-intelligence corpus. The index combines external sources such as abuse.ch SSLBL, URLhaus, Spamhaus, CISA KEV, and OSV malicious-package feeds with DugganUSA research, GitHub Hunt detections, exploit collection, and edge honeypot data.

Its MCP surface contains three tools:

- `search` performs full-text queries across IOCs, adversary information, CISA KEV content, blog material, and other indexed data.
- `enrich-ioc` enriches an IP with country, ASN, threat type, malware family, and cross-index correlations.
- `stix-feed-summary` returns index statistics and pointers to the STIX 2.1 and TAXII 2.1 feeds.

The server is intentionally read-only. It does not write data, access the local filesystem, or execute commands.

## How it works

The MCP process runs on the local machine and communicates with the client using JSON-RPC 2.0 over STDIO. The binary makes HTTPS requests to `analytics.dugganusa.com` when a tool needs feed data. Indicators submitted for lookup are the data that leaves the machine; the agent and its local context remain on the client side.

The feed is API-key enforced. A registered free key provides 10 queries per day, while an exhausted key can receive HTTP 429 responses. The server also supports an optional `--dredd-gate` flag. When enabled, it checks tool names and required arguments before dispatch, logs permitted calls to stderr, and provides a place to add local restrictions such as allow-lists, deny-lists, or per-tool limits.

## Setup and configuration

Run the MCP server without a global installation:

```bash
npx -y -p dugganusa-cli dugganusa-mcp
```

For a global installation, install the package with npm; both the scanner and MCP binaries are placed on `PATH`:

```bash
npm install -g dugganusa-cli
dugganusa-mcp --help
```

Register an API key through the DugganUSA STIX registration page, then expose it to the process:

```bash
export DUGGANUSA_API_KEY=dugusa_YOUR_KEY
```

Claude Desktop can launch the server with an `mcpServers` entry using `npx`, the `dugganusa-mcp` binary, and the `DUGGANUSA_API_KEY` environment variable. The same STDIO arrangement is described for Cursor, Windsurf, Claude Code, and other MCP clients that support local STDIO servers.

## Limitations and notes

Anonymous requests and unregistered keys receive 401 responses, and registered keys over their daily allowance receive 429 responses. The MCP interface is limited to the three read-only tools above; the package's separate command-line scanner supports additional workflows such as file scanning, stdin input, JSON or table output, and CI exit codes, but those are not MCP tools.

The project includes an optional local audit path: its source separates argument parsing, STDIO JSON-RPC handling, tool schemas and handlers, and upstream HTTPS requests. The repository also provides an MCP test command covering dispatch and live network calls.

_Full upstream README: https://allmcps.com/mcp/dugganusa-cli-local-stdio-mcp/readme_