Log inSubmit server
DugganUSA CLI — Local STDIO MCP logo

DugganUSA CLI — Local STDIO MCP

Read-only STDIO MCP access to DugganUSA threat intelligence with search, IP enrichment, and STIX feed summaries.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install DugganUSA CLI — Local STDIO MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "dugganusa-cli-local-stdio-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "dugganusa-cli"
      ],
      "env": {
        "DUGGANUSA_API_KEY": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y dugganusa-cli

Process exited before answering initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 11d ago.

Overview

DugganUSA CLI — Local STDIO MCP exposes the DugganUSA read-only threat-intelligence corpus to MCP clients over local STDIO. It provides search, IP enrichment, and STIX/TAXII feed summary tools without write, filesystem, or command-execution capabilities. Requests run through a locally owned binary and send indicators to DugganUSA for lookup. Use it when an agent needs threat-intelligence context, IOC correlations, or feed statistics inside Claude Desktop, Cursor, Claude Code, Windsurf, or another STDIO-capable MCP client.

Use cases

  • Search threat-intelligence records from an AI assistant
  • Enrich suspicious IP addresses with network and malware context
  • Review STIX and TAXII feed statistics during investigations
  • Add read-only IOC context to a local MCP workflow

Key features

  • Local JSON-RPC over STDIO
  • Full-text threat-intelligence search
  • IP enrichment with cross-index correlations
  • STIX 2.1 and TAXII 2.1 feed summaries
  • Optional --dredd-gate policy hook
  • Read-only tool surface with no filesystem or exec access

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

11/11 checks healthy over the last 56d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 11d ago via OSV.dev · dugganusa-cli (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars2Stargazers on the source repository.
npm downloads212Package downloads in the last 30 days.
Last commit5d agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.

How DugganUSA CLI — Local STDIO MCP works

What DugganUSA CLI — Local STDIO MCP does

DugganUSA CLI — Local STDIO MCP gives an AI agent read-only access to the DugganUSA threat-intelligence corpus. The index combines external sources such as abuse.ch SSLBL, URLhaus, Spamhaus, CISA KEV, and OSV malicious-package feeds with DugganUSA research, GitHub Hunt detections, exploit collection, and edge honeypot data.

Its MCP surface contains three tools:

  • search performs full-text queries across IOCs, adversary information, CISA KEV content, blog material, and other indexed data.
  • enrich-ioc enriches an IP with country, ASN, threat type, malware family, and cross-index correlations.
  • stix-feed-summary returns index statistics and pointers to the STIX 2.1 and TAXII 2.1 feeds.

The server is intentionally read-only. It does not write data, access the local filesystem, or execute commands.

How it works

The MCP process runs on the local machine and communicates with the client using JSON-RPC 2.0 over STDIO. The binary makes HTTPS requests to analytics.dugganusa.com when a tool needs feed data. Indicators submitted for lookup are the data that leaves the machine; the agent and its local context remain on the client side.

The feed is API-key enforced. A registered free key provides 10 queries per day, while an exhausted key can receive HTTP 429 responses. The server also supports an optional --dredd-gate flag. When enabled, it checks tool names and required arguments before dispatch, logs permitted calls to stderr, and provides a place to add local restrictions such as allow-lists, deny-lists, or per-tool limits.

Setup and configuration

Run the MCP server without a global installation:

Terminal
npx -y -p dugganusa-cli dugganusa-mcp

For a global installation, install the package with npm; both the scanner and MCP binaries are placed on PATH:

Terminal
npm install -g dugganusa-cli
dugganusa-mcp --help

Register an API key through the DugganUSA STIX registration page, then expose it to the process:

server.ts
export DUGGANUSA_API_KEY=dugusa_YOUR_KEY

Claude Desktop can launch the server with an mcpServers entry using npx, the dugganusa-mcp binary, and the DUGGANUSA_API_KEY environment variable. The same STDIO arrangement is described for Cursor, Windsurf, Claude Code, and other MCP clients that support local STDIO servers.

Limitations and notes

Anonymous requests and unregistered keys receive 401 responses, and registered keys over their daily allowance receive 429 responses. The MCP interface is limited to the three read-only tools above; the package's separate command-line scanner supports additional workflows such as file scanning, stdin input, JSON or table output, and CI exit codes, but those are not MCP tools.

The project includes an optional local audit path: its source separates argument parsing, STDIO JSON-RPC handling, tool schemas and handlers, and upstream HTTPS requests. The repository also provides an MCP test command covering dispatch and live network calls.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about DugganUSA CLI — Local STDIO MCP

DugganUSA CLI — Local STDIO MCP is an MCP server that connects MCP clients to the DugganUSA read-only threat-intelligence corpus. Its main tools are search for corpus-wide text queries, enrich-ioc for IP enrichment and correlations, and stix-feed-summary for index statistics and STIX/TAXII feed pointers. It performs no writes or filesystem operations.

Install it with npm or run it directly with npx. Use `npx -y -p dugganusa-cli dugganusa-mcp` for an ephemeral launch, or run `npm install -g dugganusa-cli` to place both package binaries on your PATH.

Set a registered key in the `DUGGANUSA_API_KEY` environment variable before starting the server. The feed requires an API key; the free tier provides 10 queries per day, while anonymous or unregistered requests receive 401 responses.

Yes, it works with Cursor through its local STDIO MCP configuration. The same launch pattern used for Claude Desktop can be adapted for Cursor, with `npx` starting `dugganusa-mcp` and the API key supplied through the environment.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewDugganUSA CLI — Local STDIO MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/dugganusa-cli-local-stdio-mcp?style=directory)](https://allmcps.com/mcp/dugganusa-cli-local-stdio-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/dugganusa-cli-local-stdio-mcp"><img src="https://allmcps.com/api/badge/dugganusa-cli-local-stdio-mcp?style=directory" alt="DugganUSA CLI — Local STDIO MCP on AllMCPs" /></a>