io.github.maco144/nullcone

up checked 2026-11-11T06:40:13.620Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided title

Nullcone Threat Intelligence

Publisher-provided description

Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats

Summary by lookupd

Checks prompts, skills, and tool definitions against threat indicators, and looks up or reports malicious IOCs for agent safety.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http nullcone https://nullcone.ai/mcp

Codex, remote (streamable-http)

codex mcp add nullcone --url https://nullcone.ai/mcp

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "nullcone": {
      "url": "https://nullcone.ai/mcp"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (30 tools)

Publisher-provided text

• submit_ioc Submit a threat indicator (IOC) to the shared intelligence network. The IOC is automatically classified into a malware family, metadata is compres
• submit_batch Submit multiple IOCs in a single call. Preferred over looping submit_ioc for bulk ingest from honeypots, sandboxes, or feed processing. Each dict
• lookup_ioc Look up a threat signature by its exact IOC value. Returns the full signature record if found, including severity, family, detection count, and fa
• recent_threats Return the most recently observed threat signatures. Args: limit: Max number of results to return (1-200) min_severity: Minimum
• family_threats Return all threat signatures associated with a known malware family. Use list_families() first to discover available family names. Args:
• list_families Return all known malware families in the intelligence database. Each entry includes the family name, description, and category. Use family_threats
• search_by_type Return threat signatures filtered by IOC type. Useful for pulling all known-bad IPs, all malicious domains, all malicious AI skill hashes, etc.
• report_detection Report that you detected and acted on a known threat signature. Increments the signature's detection count and creates a ThreatEvent visible to al
• vote_false_positive Flag a threat signature as a likely false positive. When more than 20% of agents vote false positive on a signature, its `is_likely_fp` flag becom
• poll_since Fetch new threat signatures since a high-water mark ID. This is the recommended sync pattern — one call, get new data, persist next_id, disconnect.
• get_stats Return aggregate statistics for the threat intelligence database. Includes total signatures, known malware families, active agents, and total dete
• validate_skill Synchronous SKILL IOC lookup — call this before loading or invoking any MCP tool/skill to check it against the Nullcone threat feed. This is the p
• scan_skill_content Pre-execution content scan for skill/instruction files. Analyzes the full text of a skill (markdown, plain text, SKILL.md, etc.) for malicious pat
• get_new_threats Drain the live push-subscription buffer of threats received since the last call. Zero-polling — threats are delivered via SpacetimeDB WebSocket sub
• warm_prompt_cache Load all PROMPT IOCs from SpacetimeDB into the in-memory hash set. Call once at startup (or after a major feed update) to populate the sub-1ms que
• check_prompt Check a prompt or text fragment for known PROMPT IOC patterns. Uses an in-memory hash set for sub-1ms token-level querying — no network calls afte
• check_prompt_batch Check multiple prompts for PROMPT IOC patterns in a single call. More efficient than calling check_prompt() in a loop — tokenization overhead is a
• prompt_cache_stats Return PROMPT IOC cache statistics: size, hit rate, latency, refresh status. Use this to verify the cache is warmed and healthy before relying on
• check_freshness Validate that IOC threat intelligence is fresh enough for the named action. Call this before any high-risk agent action to ensure the TI snapshot
• freshness_limits Return the configured IOC freshness limits for all action tiers. Shows max staleness, warn threshold, and which actions belong to each tier. Use t
• fingerprint_tool_metadata Analyze an MCP tool definition for instruction-injection and malicious patterns. Performs semantic fingerprinting of the tool's description, parameter
• registry_monitor_stats Return MCP registry monitoring statistics. Shows how many tool definitions are tracked, how many have been flagged, and the current drift detectio
• registry_flagged_tools Return all MCP tools that have been flagged as suspicious or malicious. Includes tools flagged on initial ingestion (high-risk fingerprint) and to
• subscribe_threats Open a named, stateful subscription to live threat push delivery. Returns a subscription_id. Pass it to drain_subscription() to collect the IOCs t
• drain_subscription Drain the buffer of a stateful subscription created by subscribe_threats(). Returns all IOCs delivered to this subscription since the last drain.
• unsubscribe Cancel a stateful subscription and free its buffer. Call this when you no longer need the subscription to release memory. Subscriptions also auto-
• list_subscriptions List all active stateful push subscriptions on this MCP server instance. Returns metadata for each subscription (not the buffered IOCs themselves).
• revoke_ioc Revoke an IOC by its value hash, pushing the expiration event to all active subscriptions in real-time. Call this when an IOC is determined to be
• is_ioc_revoked Check whether an IOC has been revoked. O(1) in-process lookup. Use this before acting on any cached threat intelligence to ensure the IOC has not
• list_revocations List recent IOC revocations, newest first. Args: limit: Maximum number of revocations to return (default 50). since_hours: Only

Details

• Version: 0.1.0
• Transports: streamable-http
• Uptime (7 days): 100%
• Median latency: 183 ms
• First indexed: 2026-11-01T09:38:57.687Z
• Last seen in registry: 2026-11-01T09:38:57.687Z
• Repository: https://github.com/maco144/nullcone-mcp
• Website: https://nullcone.ai

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/io.github.maco144/nullcone.svg)](https://lookupd.com/servers/io.github.maco144/nullcone)

• 62033 servers
• Last crawl: 2026-11-11T15:38:39.561Z
• API base: https://api.lookupd.com
• MCP URL: https://api.lookupd.com/mcp