com.profullstack/threatcrush

up checked 2026-11-11T13:38:36.494Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided title

threatcrush

Publisher-provided description

Reputation + security findings (threatcrush.com)

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http threatcrush https://threatcrush.com/api/mcp

Codex, remote (streamable-http)

codex mcp add threatcrush --url https://threatcrush.com/api/mcp

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "threatcrush": {
      "url": "https://threatcrush.com/api/mcp"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (20 tools)

Publisher-provided text

• av_hash_lookup CrushAV file reputation, no key needed: look up up to 100 SHA-256 file hashes. For each hash something is known about, returns `knownMalicious` (the source list
• reputation_lookup Look up an IP address or a domain against the ThreatCrush community threat database (what every linked ThreatCrush daemon blocked). Returns `listed` (the corrob
• reputation_bulk Look up many IPs or domains at once (up to 100 with a free key, 1,000 with Reputation Pro). Results come back in request order; each counts against the daily al
• redeem_credit_code Redeem a ThreatCrush credit code (CR-XXXX-XXXX-XXXX-XXXX) into the signed-in account's credit balance (1 credit = $1.00). Needs the account's session token (`th
• list_invites The signed-in account's invites: how many are left of 3, who joined, and whether the bonus credits were paid. Session token only.
• create_invite Create one invite link (each account has 3, single use, 30 days). When a new account joins on it and confirms its email, both get bonus credits. Session token o
• findings_list Your org's tracked findings from threatcrush scan, pentest and ai-scan (deduped across runs, with a triage status). Default: open + acknowledged. Session token
• findings_get One tracked finding with its details (code snippet, remediation, evidence), property and history.
• findings_triage Set the status and/or note of up to 500 findings: acknowledged, fixed, false_positive, ignored or open. fixed is reopened by a later run that still sees it; fal
• incidents_list Your org's incidents: what `threatcrush investigate --raise`, the daemon (critical detections) and people raised to humans. Filter by host and explicit since ti
• incidents_get One incident: linked forensic evidence, recent events from the same observed source IP on its server, block history for that IP, saved AI assessment, multi-pers
• incidents_update Update fix work performed by your assigned agent or human: set multiple assignees, fix status, PR URL, test status and evidence, verification or blocker, and/or
• incidents_raise Raise an incident report (report_version 1: title, severity, source, dedupe_key, summary, verdict, findings, timeline, recommendations, optional team_id/server_
• webhooks_list Your org's webhook endpoints (signed Standard Webhooks deliveries, retried for about three days) and the events ThreatCrush emits: detection.created, findings.r
• webhooks_create Add a webhook endpoint (public https URL). Returns the endpoint and its signing secret (whsec_…), shown once.
• webhooks_update Change a webhook endpoint's url, events, description, or switch it on/off (on again clears its failure count).
• webhooks_delete Remove a webhook endpoint and its delivery log.
• webhooks_test Send a signed webhook.test event to one endpoint now and say how it went.
• webhooks_rotate_secret Replace an endpoint's signing secret; the old one stops working at once. Returns the new secret.
• webhooks_deliveries Recent webhook deliveries (status, attempts, last HTTP status/error, payload), for one endpoint or all.

Details

• Version: 1.0.0
• Transports: streamable-http
• Uptime (7 days): 100%
• Median latency: 448 ms
• First indexed: 2026-11-11T13:17:20.494Z
• Last seen in registry: 2026-11-11T13:17:20.494Z
• Website: https://threatcrush.com

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/com.profullstack/threatcrush.svg)](https://lookupd.com/servers/com.profullstack/threatcrush)

• 62071 servers
• Last crawl: 2026-11-11T16:39:06.253Z
• API base: https://api.lookupd.com
• MCP URL: https://api.lookupd.com/mcp