# Nullcone Threat Intelligence [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/maco144/nullcone-mcp  
**GitHub Stars:** 0  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/nullcone-threat-intelligence

## Description
Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats

## Claude Desktop Quick Installation
Remote MCP endpoint (confidence: high). Install path detected from listing signals. Add as a URL/SSE server in your client:

```json
"mcpServers": {
  "nullcone-threat-intelligence": {
    "url": "https://modelcontextprotocol.io"
  }
}
```

## Documentation & README

# Nullcone MCP Server

Real-time threat intelligence for AI agents, exposed as a [Model Context Protocol](https://modelcontextprotocol.io) server. Check IPs, domains, URLs, hashes, CVEs, **prompt-injection payloads**, and **malicious AI-skill / MCP-tool definitions** against the Nullcone network — **890K+ IOCs**, free, no API key.

Backed by [nullcone.ai](https://nullcone.ai).

## Use it (hosted — nothing to install)

The server is hosted at `https://nullcone.ai/mcp` over streamable HTTP. Add it to any MCP client:

**Claude Code**
```bash
claude mcp add --transport http nullcone https://nullcone.ai/mcp
```

**Cursor / other MCP clients** — add to your MCP config:
```json
{
  "mcpServers": {
    "nullcone": {
      "url": "https://nullcone.ai/mcp"
    }
  }
}
```

No signup or token required. Read tools and IOC submission are open; destructive tools (e.g. `revoke_ioc`) are disabled on the public endpoint.

## Tools

30+ tools including:

- `lookup_ioc(value)` — check any indicator against the feed
- `recent_threats(limit, min_severity)` — current threat picture
- `submit_ioc(...)` / `submit_batch(...)` — contribute indicators
- `check_prompt(...)` — sub-millisecond prompt-injection lookup
- `validate_skill(...)` / `scan_skill_content(...)` — vet MCP tools / AI skills before loading
- `poll_since(last_id)` — incremental sync, no persistent connection
- `get_stats()`, `list_families()`, `search_by_type(...)`, and more

Resources: `threat://stats`, `threat://recent`, `threat://families`, `threat://family/{name}`, `threat://ioc/{value}`.
Prompts: `analyze_ioc`, `triage_alert`, `threat_brief`.

## Self-host

The server is built on the public [`nullcone`](https://pypi.org/project/nullcone/) SDK.

```bash
pip install -r requirements.txt
MCP_TRANSPORT=streamable-http MCP_PORT=8001 python server.py
```

Or with Docker:
```bash
docker build -t nullcone-mcp .
docker run -p 8001:8001 nullcone-mcp
```

Set `MCP_PUBLIC=1` to run an anonymous public endpoint (disables destructive tools); omit it for full local control over stdio (`MCP_TRANSPORT=stdio`).

## License

Rising Sun License v1.0 — see [LICENSE](https://github.com/maco144/nullcone-mcp/blob/HEAD/LICENSE). Free for individuals and small teams.