{
  "markdown": "# Nullcone MCP Server\n\nReal-time threat intelligence for AI agents, exposed as a [Model Context Protocol](https://modelcontextprotocol.io) server. Check IPs, domains, URLs, hashes, CVEs, **prompt-injection payloads**, and **malicious AI-skill / MCP-tool definitions** against the Nullcone network — **890K+ IOCs**, free, no API key.\n\nBacked by [nullcone.ai](https://nullcone.ai).\n\n## Use it (hosted — nothing to install)\n\nThe server is hosted at `https://nullcone.ai/mcp` over streamable HTTP. Add it to any MCP client:\n\n**Claude Code**\n```bash\nclaude mcp add --transport http nullcone https://nullcone.ai/mcp\n```\n\n**Cursor / other MCP clients** — add to your MCP config:\n```json\n{\n  \"mcpServers\": {\n    \"nullcone\": {\n      \"url\": \"https://nullcone.ai/mcp\"\n    }\n  }\n}\n```\n\nNo signup or token required. Read tools and IOC submission are open; destructive tools (e.g. `revoke_ioc`) are disabled on the public endpoint.\n\n## Tools\n\n30+ tools including:\n\n- `lookup_ioc(value)` — check any indicator against the feed\n- `recent_threats(limit, min_severity)` — current threat picture\n- `submit_ioc(...)` / `submit_batch(...)` — contribute indicators\n- `check_prompt(...)` — sub-millisecond prompt-injection lookup\n- `validate_skill(...)` / `scan_skill_content(...)` — vet MCP tools / AI skills before loading\n- `poll_since(last_id)` — incremental sync, no persistent connection\n- `get_stats()`, `list_families()`, `search_by_type(...)`, and more\n\nResources: `threat://stats`, `threat://recent`, `threat://families`, `threat://family/{name}`, `threat://ioc/{value}`.\nPrompts: `analyze_ioc`, `triage_alert`, `threat_brief`.\n\n## Self-host\n\nThe server is built on the public [`nullcone`](https://pypi.org/project/nullcone/) SDK.\n\n```bash\npip install -r requirements.txt\nMCP_TRANSPORT=streamable-http MCP_PORT=8001 python server.py\n```\n\nOr with Docker:\n```bash\ndocker build -t nullcone-mcp .\ndocker run -p 8001:8001 nullcone-mcp\n```\n\nSet `MCP_PUBLIC=1` to run an anonymous public endpoint (disables destructive tools); omit it for full local control over stdio (`MCP_TRANSPORT=stdio`).\n\n## License\n\nRising Sun License v1.0 — see [LICENSE](LICENSE). Free for individuals and small teams.\n",
  "bytes": 2175,
  "sha": "ee7061e55ac0f52863355b16ec61f0534190e14f44f321e9e37e0484b3bb6818",
  "repo_slug": "maco144/nullcone-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_maco144_nullcone_b3f8aa74/readme"
}