Membrane for AI agents: threat intel you can check, IOC enrichment, pre-install package checks.
Connect Remote server
claude mcp add --transport http threat-intel https://analytics.dugganusa.com/api/v1/mcp{
"mcpServers": {
"threat-intel": {
"url": "https://analytics.dugganusa.com/api/v1/mcp"
}
}
}{
"servers": {
"threat-intel": {
"type": "http",
"url": "https://analytics.dugganusa.com/api/v1/mcp"
}
}
}Settings > Connectors > Add custom connector
URL: https://analytics.dugganusa.com/api/v1/mcpTools 10 found in our last check
searchSearches threat-intelligence records about threat actors, malware, campaigns, CVEs, breaches, vendors and indicators. The default search covers security topics only; a few public-document archives can be searched by naming them (listed below). It holds no general programming or…
enrich-iocLooks up an IP address, domain, URL or file hash, such as one from a message, log line, SIEM alert or code under review. Look up a single indicator of compromise (IP, domain, URL, or hash) in the DugganUSA corpus. Returns the threat type, malware family, confidence and reference…
correlateAnswers two different questions about an IP address or domain, and keeps them apart: do we HOLD it, and what sits NEXT to it. `held` is an exact yes or no, with `held_in` naming the lane that answered (iocs, the published blocklist lane, or the graph). `neighbors` is group membe…
stix-feed-summaryShows what is in the feed right now: useful for "what's active this week", feed freshness, or planning SIEM / blocklist ingestion. Shape report on the most recent 5,000 indicators in the DugganUSA STIX 2.1 feed, bounded to a 1-7 day window. Returns how many of those fall in the…
ai-model-priceLooks up what an AI model or an agent session costs at list price. Prices are dated and copied from each provider's own pricing page. Returns the per-1M-token USD rates for a model (input, output, and for Anthropic models the 5-minute and 1-hour cache-creation, cache read and fa…
kev-vendor-riskShows where confirmed exploitation concentrates for a vendor or product (Microsoft, Cisco, Fortinet, an appliance, an ERP), for questions like "what should I patch first". Vendor / product risk matrix built from CISA's Known Exploited Vulnerabilities (KEV) catalog — where real,…
kev-exploitation-stickinessMeasures whether a product's exploitation risk is chronic or a one-off, for patch prioritization. Does in-the-wild exploitation risk STICK to proven products, or SPREAD to new ones? Analyzes CISA KEV: correlates each product's historical known-exploited count against its RECENT…
check-packageChecks whether a dependency (npm, PyPI, RubyGems or Packagist/Composer, or a GitHub Action used in a workflow) is on the DugganUSA malicious-package deny-list or has published advisories. Suited to a pre-install step in an agent or a CI pipeline, against slopsquatting and hijack…
check-workflowChecks the text of one GitHub Actions workflow file for script injection: places where text an outside user controls (an issue or pull request title or body, a comment, a branch name, a commit message) is pasted into a shell script or a github-script body, a privileged trigger t…
check-repoBefore you open or run a repository someone else sent you (a recruiter's coding test, a downloaded zip, a proof of concept), pass it the few files that matter and get a verdict. It looks for the places a lure hides that a dependency check never reads: npm install hooks that fetc…
Details
| Endpoint | https://analytics.dugganusa.com/api/v1/mcp (Streamable HTTP) |
| First published | 9 Nov 2026 |
| Last updated | 9 Nov 2026 |
| Registry name | com.dugganusa/threat-intel |
More security servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.