{
  "markdown": "# tweetfeed-mcp\n\n**Model Context Protocol (MCP) server for [tweetfeed.live](https://tweetfeed.live).**\n\nExposes the public IOC feed (URLs, domains, IPs, SHA256/MD5 hashes shared by the\ninfosec community on Twitter/X) as MCP tools so AI agents can query threat\nintel programmatically.\n\n- **Endpoint**: `https://mcp.tweetfeed.live/` (HTTP JSON-RPC 2.0, POST)\n- **Protocol version**: 2025-11-25 (negotiated; older clients fall back automatically)\n- **Auth**: none (all IOC data is CC0)\n- **License (data)**: CC0-1.0 · **License (code)**: MIT\n\n## Tools\n\n| Name | Purpose |\n|---|---|\n| `query_iocs` | Query IOCs by time window (today/week/month) with optional user, tag, and type filters. |\n| `check_url` | Check whether a specific URL appears in the feed. |\n| `check_ip` | Check whether an IPv4/IPv6 address appears in the feed. |\n| `check_hash` | Check whether an MD5 or SHA-256 hash appears in the feed (type auto-detected). |\n| `list_recent_iocs` | List IOCs added since a given date, with optional type/tag filters. |\n| `get_tag_info` | Window aggregates plus recent IOCs for a tag (leading `#` optional). |\n| `get_trending` | Top tags and IOC-type distribution for a window (today/week/month/year). |\n| `enrich_ioc` | Exact lookup of an IOC (auto-detected type: url/domain/ip/md5/sha256) over the past 365 days, with AI/external-corroboration/net/domain-registration (reg, including the domain's age in days at first report and a `newly_registered` flag) context and campaign membership when available, plus an archive of history older than 365 days when it exists (can accompany a live match); falls back to a 30-day substring scan on a miss. |\n| `get_campaigns` | AI-clustered campaign groupings from the last 30 days, with optional brand and min-confidence filters. |\n| `get_campaign_iocs` | Full IOC membership (header + rows) of one campaign by id, with optional type filter and limit. |\n| `get_trends` | 31-day IOC trend analytics: daily volume by type, top moving tags week-over-week, most-abused TLDs, new vs recurring ratio, producer concentration. |\n| `search` | ChatGPT connector interface: find document ids (`ioc:<value>`, `tag:<tag>`, `campaign:<tfc-id>`) for an IOC value, tag, campaign id or free text. |\n| `fetch` | ChatGPT connector interface: full document (`{id, title, text, url, metadata}`) for an id returned by `search`. |\n\n## Use with Claude Desktop / Claude.ai / other MCP clients\n\n```json\n{\n  \"mcpServers\": {\n    \"tweetfeed\": {\n      \"url\": \"https://mcp.tweetfeed.live/\"\n    }\n  }\n}\n```\n\nOr from the Claude Code CLI:\n\n```bash\nclaude mcp add tweetfeed https://mcp.tweetfeed.live/\n```\n\n## Use as a ChatGPT connector\n\nChatGPT (Settings > Connectors > Create, or a Deep research custom connector)\naccepts `https://mcp.tweetfeed.live/` with no authentication. The server\nexposes the required `search` and `fetch` tools alongside the others, and\nevery result carries a tweetfeed.live URL so ChatGPT can cite it.\n\n## Quick test\n\n```bash\ncurl -sX POST https://mcp.tweetfeed.live/ \\\n  -H 'content-type: application/json' \\\n  -d '{\"jsonrpc\":\"2.0\",\"method\":\"tools/list\",\"id\":1}' | jq .\n\n# Example tool call:\ncurl -sX POST https://mcp.tweetfeed.live/ \\\n  -H 'content-type: application/json' \\\n  -d '{\"jsonrpc\":\"2.0\",\"method\":\"tools/call\",\"id\":2,\n       \"params\":{\"name\":\"query_iocs\",\n                 \"arguments\":{\"time\":\"today\",\"tag\":\"phishing\",\"type\":\"url\",\"limit\":5}}}' | jq .\n```\n\n## Develop\n\n```bash\nnpm install\nnpm run dev          # wrangler dev on http://localhost:8787\nMCP_URL=http://localhost:8787 npm test\n```\n\n## Deploy\n\n```bash\nnpm run deploy       # wrangler deploy (routes mcp.tweetfeed.live/*)\nMCP_URL=https://mcp.tweetfeed.live npm test\n```\n",
  "bytes": 3674,
  "sha": "7001b059b663d1514a554fb9ecf6274db7b2e35a6e55b207b6ea3fcf1e5fd80b",
  "repo_slug": "0xdaniellopez/tweetfeed-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_0xdaniellopez_tweetfeed_d5fcc3ad/readme"
}