ai.tunnelmind/scry

up checked 2026-11-10T21:37:34.293Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided title

Scry

Publisher-provided description

Free IPv4 lookups against a distributed attacker-observation corpus.

Summary by lookupd

Query a free attacker-observation corpus to check IPv4 addresses, ASNs, countries, campaigns, and attack tools for threat intelligence.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http scry https://mcp.tunnelmind.ai/mcp

Codex, remote (streamable-http)

codex mcp add scry --url https://mcp.tunnelmind.ai/mcp

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "scry": {
      "url": "https://mcp.tunnelmind.ai/mcp"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (12 tools)

Publisher-provided text

• scry_stats Returns aggregate Scry corpus telemetry: total observation count, distinct source IPs, first/last observation timestamps, last-24h activity, and per-protocol br
• scry_check Returns Scry's corpus knowledge for a single IPv4 address: when it was first/last observed, observation count, protocols and ports targeted, ASN, country, categ
• scry_check_bulk Look up many IPv4 addresses in one request. Up to 100 IPs per call. Same per-IP shape as scry_check, keyed by IP.
• scry_top Top-N source dimensions over a time window. Useful for situational awareness — 'where is the noise coming from right now?'
• scry_timeseries Bucketed observation counts over time. Detect bursts, plot trends, sanity-check whether attacker activity is rising or falling.
• scry_asn Roll-up of corpus activity for a single ASN — observation count, distinct source IPs, actor count, scanner count, high-confidence actor count, and per-protocol
• scry_country Roll-up of corpus activity by ISO country code. Same shape as scry_asn.
• scry_tools List detected attack tools — (protocol, payload, path) tuples sent by 3+ distinct source IPs. Aggregate metadata only; never lists member actors.
• scry_tool Single tool detail by 16-char hex id from scry_tools.
• scry_campaigns Active threat campaigns — coordinated attacker activity that exceeds the noise floor. ≥5 distinct actors, ≥3 ASNs, ≤5 destination ports, ≥1h history.
• scry_campaign Single campaign detail by id (format: c[0-9a-f]{15}).
• scry_recent Recent observations feed — aggregated by source IP within a time window. Cursor-paginated via since_ms.

Details

• Version: 0.5.0
• Transports: streamable-http
• Uptime (7 days): 78%
• Median latency: 719 ms
• First indexed: 2026-11-01T08:51:11.479Z
• Last seen in registry: 2026-11-01T08:51:11.522Z
• Repository: https://github.com/TunnelMind/scry-mcp
• Website: https://api.tunnelmind.ai

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/ai.tunnelmind/scry.svg)](https://lookupd.com/servers/ai.tunnelmind/scry)

• 62141 servers
• Last crawl: 2026-11-11T18:17:25.333Z
• API base: https://api.lookupd.com
• MCP URL: https://api.lookupd.com/mcp