Isc Sans

What Isc Sans does

Isc Sans brings selected SANS Internet Storm Center (ISC) data into MCP-compatible clients. Its tools focus on external threat context rather than local system inspection:

• ip_reputation looks up an IPv4 address in the SANS ISC DShield database. Results include attack-report history, the address's ASN or owner, an abuse contact, and a risk signal. The report count reflects firewall reports submitted by sensors; a high count can indicate an active attack source, while a null or zero count indicates no reported malicious activity.
• port_activity summarizes recent TCP or UDP attack and probe activity for a specified port. The response includes daily report totals, distinct target addresses, and distinct source addresses, helping identify scanning increases against services such as SSH, RDP, SMB, or Telnet.
• threat_level returns the global SANS ISC InfoCon level as green, yellow, orange, or red, along with a plain-language interpretation. It takes no arguments.

The integration is independent and unofficial; it is not published, endorsed, or affiliated with SANS or ISC.

How it works

The hosted MCP endpoint is https://gateway.pipeworx.io/isc-sans/mcp. Add that URL to an MCP client to connect over the gateway. A scoped connection lists the Isc Sans tools and also exposes shared Pipeworx meta-tools, including routing and discovery functions. The full gateway endpoint, https://gateway.pipeworx.io/mcp, provides direct access to the broader catalog instead.

For clients or scripts that use HTTP directly, tool calls can be sent to the gateway's /v1/tools/ paths. The npm package, @pipeworx/mcp-isc-sans, acts as a local stdio bridge: the client starts it with npx, and the bridge forwards requests to the hosted endpoint. Network access is required because the bridge has no offline mode.

Setup and configuration

A hosted connection can be configured with the url value below:

{
  "mcpServers": {
    "isc-sans": {
      "url": "https://gateway.pipeworx.io/isc-sans/mcp"
    }
  }
}

For a local stdio connection, use:

{
  "mcpServers": {
    "isc-sans": {
      "command": "npx",
      "args": ["-y", "@pipeworx/mcp-isc-sans"]
    }
  }
}

Anonymous usage is capped at 50 calls per day. A free Pipeworx account raises the limit to 200 calls per day; place the resulting key in PIPEWORX_API_KEY. Setting PIPEWORX_META_TOOLS=1 makes the local bridge list the shared Pipeworx tools as well as the Isc Sans tools. The key is sent as a Bearer token. Behind an HTTPS proxy, newer Node.js versions can use the proxy environment settings when NODE_USE_ENV_PROXY=1 is enabled.

Limitations and notes

Results depend on the data available from SANS ISC and should be treated as external threat intelligence, not as proof that an address is malicious. The port tool reports activity statistics rather than identifying a specific campaign. The hosted and npm modes both depend on network connectivity. Scoped gateway connections include shared meta-tools, so the total tool count can exceed the three Isc Sans-specific tools.