# Isc Sans [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/pipeworx-io/mcp-isc-sans  
**GitHub Stars:** 0  
**npm Downloads (last month):** 721  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/isc-sans

## Description
SANS Internet Storm Center (ISC) MCP.

## Tools
Capabilities this server exposes over MCP:

- **ip_reputation** — Look up an IPv4 address in the SANS ISC DShield database — its attack-report history, ASN/owner, abuse contact, and risk. A high report_count means the IP is an active attack source (firewall logs submitted by sensors worldwide). report_count null/0 = no malicious activity reported. The comment field often names known infrastructure (e.g. "Google public recursive name server"). Keyless.
- **port_activity** — Get recent attack/probe activity for a TCP/UDP port from SANS ISC — daily counts of report records, distinct target IPs, and distinct source IPs hitting the port. Useful for spotting scanning surges against services like SSH (22), RDP (3389), SMB (445), or Telnet (23). Keyless.
- **threat_level** — Get the global SANS ISC InfoCon threat level — the internet-wide "weather report" for malicious activity. Returns one of green/yellow/orange/red with a plain-English meaning. An at-a-glance signal of whether a major internet-scale event is underway. Keyless, no arguments.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "isc-sans": {
    "command": "npx",
    "args": ["-y","@pipeworx/mcp-isc-sans"],
    "env": {
      "PIPEWORX_API_KEY": "",
      "PIPEWORX_META_TOOLS": "",
      "NODE_USE_ENV_PROXY": ""
    }
  }
}
```

**Requires environment variables:** `PIPEWORX_API_KEY`, `PIPEWORX_META_TOOLS`, `NODE_USE_ENV_PROXY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What Isc Sans does

Isc Sans brings selected SANS Internet Storm Center (ISC) data into MCP-compatible clients. Its tools focus on external threat context rather than local system inspection:

- `ip_reputation` looks up an IPv4 address in the SANS ISC DShield database. Results include attack-report history, the address's ASN or owner, an abuse contact, and a risk signal. The report count reflects firewall reports submitted by sensors; a high count can indicate an active attack source, while a null or zero count indicates no reported malicious activity.
- `port_activity` summarizes recent TCP or UDP attack and probe activity for a specified port. The response includes daily report totals, distinct target addresses, and distinct source addresses, helping identify scanning increases against services such as SSH, RDP, SMB, or Telnet.
- `threat_level` returns the global SANS ISC InfoCon level as green, yellow, orange, or red, along with a plain-language interpretation. It takes no arguments.

The integration is independent and unofficial; it is not published, endorsed, or affiliated with SANS or ISC.

## How it works

The hosted MCP endpoint is `https://gateway.pipeworx.io/isc-sans/mcp`. Add that URL to an MCP client to connect over the gateway. A scoped connection lists the Isc Sans tools and also exposes shared Pipeworx meta-tools, including routing and discovery functions. The full gateway endpoint, `https://gateway.pipeworx.io/mcp`, provides direct access to the broader catalog instead.

For clients or scripts that use HTTP directly, tool calls can be sent to the gateway's `/v1/tools/` paths. The npm package, `@pipeworx/mcp-isc-sans`, acts as a local stdio bridge: the client starts it with `npx`, and the bridge forwards requests to the hosted endpoint. Network access is required because the bridge has no offline mode.

## Setup and configuration

A hosted connection can be configured with the `url` value below:

```json
{
  "mcpServers": {
    "isc-sans": {
      "url": "https://gateway.pipeworx.io/isc-sans/mcp"
    }
  }
}
```

For a local stdio connection, use:

```json
{
  "mcpServers": {
    "isc-sans": {
      "command": "npx",
      "args": ["-y", "@pipeworx/mcp-isc-sans"]
    }
  }
}
```

Anonymous usage is capped at 50 calls per day. A free Pipeworx account raises the limit to 200 calls per day; place the resulting key in `PIPEWORX_API_KEY`. Setting `PIPEWORX_META_TOOLS=1` makes the local bridge list the shared Pipeworx tools as well as the Isc Sans tools. The key is sent as a Bearer token. Behind an HTTPS proxy, newer Node.js versions can use the proxy environment settings when `NODE_USE_ENV_PROXY=1` is enabled.

## Limitations and notes

Results depend on the data available from SANS ISC and should be treated as external threat intelligence, not as proof that an address is malicious. The port tool reports activity statistics rather than identifying a specific campaign. The hosted and npm modes both depend on network connectivity. Scoped gateway connections include shared meta-tools, so the total tool count can exceed the three Isc Sans-specific tools.

_Full upstream README: https://allmcps.com/mcp/isc-sans/readme_