dugganusa-cli

1.5M+ IOCs. ~38M+ documents. Two binaries. One install. The MCP we'd audit.

What's New (v1.5.1)

• Supply-chain scanning leveled up. The corpus now ingests OSV malicious-package feeds for both npm and PyPI — named-malicious packages, zero-heuristic, daily — alongside daily GitHub Hunt detections of malware-staging repos and install-time execution signatures. Pipe a lockfile or --file package.json and known-bad packages surface next to network IOCs. This is the CI angle: catch a poisoned dependency before it ships.
• Four live, no-auth, deploy-durable validation endpoints now prove feed quality:
  • Novelty — feed-uniqueness: ~75%+ of what we publish ThreatFox doesn't have (measured live).
  • Timeliness — kev-lead: a live ledger of how far ahead of CISA KEV we flagged each exploited CVE — positive leads, same-day, and no-receipt all shown honestly, with receipts.
  • Accuracy — spamhaus-validation: Spamhaus independently corroborates our first-hand contributions.
  • Liveness — feed-efficacy: opt-in consumer reports of when our indicators actually fire on real traffic — proof the feed is operationally live, not just large.

# Scanner — block bad IOCs in your stack
npx dugganusa-cli 185.39.19.176

# MCP server — wire DugganUSA into Claude Desktop / Cursor / Claude Code
npx -y -p dugganusa-cli dugganusa-mcp

A two-person Minnesota LLC. A Bloom filter for novelty checks. Meilisearch cross-index correlation. A github-hunt cron that runs at 08:15 UTC every day.

That's the stack that named TeamPCP 45 days before CISA added LiteLLM CVE-2026-42208 to KEV. That named Handala 28 days before they exfiltrated 6 petabytes from Dubai. That named NGINX-UI as actively exploited 20 days before the same agency caught up.

This is the CLI that puts the same corpus in your terminal.

Bin rename (since v1.3.0): the scanner bin was dugganusa-lookup in v1.2.0. It is now dugganusa-cli. The old dugganusa-lookup package is dead — use dugganusa-cli. The MCP bin (dugganusa-mcp) is unchanged. Update any pinned scripts.

Install

# Run without installing
npx dugganusa-cli 185.39.19.176
npx -y -p dugganusa-cli dugganusa-mcp --help

# Or install globally — both bins on PATH
npm install -g dugganusa-cli

Scanner usage

# Single lookup
dugganusa-cli 185.39.19.176
dugganusa-cli welcome.supp0v3.com
dugganusa-cli CVE-2026-21643

# Multiple indicators
dugganusa-cli 185.39.19.176 welcome.supp0v3.com CVE-2026-21643

# Scan a file for IOCs
dugganusa-cli --file config.js
dugganusa-cli --file terraform/main.tf

# Pipe stdin (works with any tool)
cat firewall.log | dugganusa-cli --stdin
grep -r "http" src/ | dugganusa-cli --stdin

# Batch lookup (one IOC per line)
dugganusa-cli --batch iocs.txt

# AIPM audit (AI presence + brand exposure)
dugganusa-cli --aipm crowdstrike.com

# Output formats
dugganusa-cli --format json 185.39.19.176
dugganusa-cli --format markdown --file report.md
dugganusa-cli --format table 185.39.19.176  # default

# Only show matches (suppress clean results)
dugganusa-cli --file app.js --quiet

# With API key (higher rate limits)
dugganusa-cli --key dugusa_YOUR_KEY 185.39.19.176
# Or set env var
export DUGGANUSA_API_KEY=dugusa_YOUR_KEY

Output

  !!    12  185.39.19.176                                 IOC: Cobalt Strike C2 (via SSLBL) | Blocked 47x | 3 OTX pulse(s)
  OK     0  8.8.8.8                                       clean

  1 threat indicator(s) found in 2 checked.
  Full enrichment: https://analytics.dugganusa.com/api/v1/search/correlate?q=<indicator>
  Free API key: https://analytics.dugganusa.com/stix/register

Exit codes

Exit 1 on match is the whole point. Block deployments containing known-bad indicators before they ship.

CI/CD examples

# GitHub Actions — block deploys containing live IOCs
- name: Scan for threat indicators
  run: npx dugganusa-cli --file config/production.json --quiet

# Shell pipeline
if npx dugganusa-cli --file deploy.conf --quiet; then
  echo "Clean — deploying"
  ./deploy.sh
else
  echo "BLOCKED — threat indicators found"
  exit 1
fi

API key

The STIX feed is API-key-enforced: anonymous requests get 401, an unregistered Bearer gets 429. The free tier is a free registered key — not anonymous. Register here: analytics.dugganusa.com/stix/register

Free tier: 500 queries/day. Set the key via --key flag or DUGGANUSA_API_KEY env var.

What's in the index

1.5M+ indicators sourced from 15 external feed sources (OTX, abuse.ch SSLBL, URLhaus, Spamhaus, CISA KEV, OSV malicious-package feeds for npm + PyPI, and more), plus DugganUSA original research, our exploit harvester, daily GitHub Hunt detections, and our edge honeypots. Cross-correlated across 65 indexes covering ~38M+ documents. The same feed pulled daily by 275+ consumers in 46 countries — including Microsoft, AT&T, and Starlink.

You are getting the receipts the big platforms get. Same corpus, your terminal.

MCP server (dugganusa-mcp)

Local STDIO MCP server. Wire it into any MCP client, your AI assistant gets the DugganUSA threat-intel corpus as read-only tools.

This is the MCP we wrote because the ones we audited were dangerous.

Three tools, that's it

• search — full-text across IOCs, pulses, blog, adversaries, CISA KEV, Epstein files, and 40+ indexes. 38M+ documents.
• enrich-ioc — IP enrichment: country, ASN, threat type, malware family, cross-index correlations.
• stix-feed-summary — index stats + pointers to our STIX 2.1 / TAXII 2.1 feeds.

No tools that write. No tools that touch your filesystem. No tools that exec. Read-only, all the way down.

Wire it into Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS):

{
  "mcpServers": {
    "dugganusa": {
      "command": "npx",
      "args": ["-y", "-p", "dugganusa-cli", "dugganusa-mcp"],
      "env": {
        "DUGGANUSA_API_KEY": "your-registered-key"
      }
    }
  }
}

Restart Claude Desktop. Three tools appear in the picker. Same pattern works for Cursor, Windsurf, Claude Code, or any MCP client that speaks STDIO.

Local policy enforcement: --dredd-gate

dugganusa-mcp --dredd-gate

Pre-flights every tool call: validates tool name, required arguments, logs allowed calls to stderr. Read the verdict function in mcp/lib/serve.js (function dreddVerdict). This is the hook where you wire stricter policy: deny lists, IP allow-lists, per-tool rate limits, or a remote dredd verdict endpoint.

Default is off. Turn it on if your environment is anything more than your laptop.

Why this MCP exists

On April 20, 2026 we published "Anthropic's MCP Has a Critical RCE Vulnerability. We Don't Use MCP. Here's Why." (dugganusa.com)

We named the affected vendors three weeks before they hit the headlines: MCP Inspector, LibreChat, Windsurf, LiteLLM, Langchain-Chatchat, NGINX-UI. The architectural problem was that MCP trusts the transport — STDIO gives an AI model a pipe to execute commands on the host, and the path from "tool definition" to "command execution" had no gate.

We meant it. We still don't trust other people's MCPs without auditing them first. The coherent answer is to ship the MCP we'd audit:

• Read-only tool surface only — no write, no exec
• No third-party MCP SDK dependency (every line is in this repo)
• Customer owns the binary, runs it locally, sees every request before it leaves the machine
• Optional --dredd-gate local policy hook
• Zero npm runtime dependencies

This is that MCP.

Auditing the binary

Read the bytes you're running:

# install
npm install -g dugganusa-cli

# audit
grep -rnE 'child_process|require\(.*shell|require\(.*child|exec\(|spawn\(|eval\(' "$(npm root -g)/dugganusa-cli"

Should return nothing.

Source layout under mcp/:

• mcp/serve.js — bin entry, argv parser (~45 LOC)
• mcp/lib/serve.js — JSON-RPC 2.0 over STDIO (~125 LOC)
• mcp/lib/tools.js — three tool schemas + handlers (~80 LOC)
• mcp/lib/upstream.js — HTTPS request to analytics.dugganusa.com (~40 LOC)

Tests:

npm run test:mcp

10 tests covering the dispatch surface and live network calls. Every release runs them in CI before publishing.

Provenance

Releases ≥ v1.3.0 are published via npm Trusted Publishing (GitHub Actions OIDC) with --provenance. Verify:

npm audit signatures dugganusa-cli

You get signed attestation that the published bytes came from a specific commit in a specific GitHub workflow run. No long-lived tokens involved.

Receipts

The platform behind this CLI runs left-of-boom on adversary infrastructure: