Nullcone Threat Intelligence
Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats
Open source Repository Open in the app JSON README (API)
About
Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats
Details
- Kind
- MCP servers
- Topic
- Security & identity
- Publisher
- maco144
- Origin
- official
- Category
- ferramentas
- Transport
- http
- Version
- 0.1.0
- Open pull requests
- 1
- Last push
- 2026-07-08T13:36:17Z
- Repository state
- ativo
- Language
- Python
- License
- NOASSERTION
- Added
- 2026-08-29 04:00:27
- Updated
- 2026-08-29 04:00:27
- Origin id
io.github.maco144/nullcone
README
# Nullcone MCP Server
Real-time threat intelligence for AI agents, exposed as a [Model Context Protocol](https://modelcontextprotocol.io) server. Check IPs, domains, URLs, hashes, CVEs, **prompt-injection payloads**, and **malicious AI-skill / MCP-tool definitions** against the Nullcone network — **890K+ IOCs**, free, no API key.
Backed by [nullcone.ai](https://nullcone.ai).
## Use it (hosted — nothing to install)
The server is hosted at `https://nullcone.ai/mcp` over streamable HTTP. Add it to any MCP client:
**Claude Code**
```bash
claude mcp add --transport http nullcone https://nullcone.ai/mcp
```
**Cursor / other MCP clients** — add to your MCP config:
```json
{
"mcpServers": {
"nullcone": {
"url": "https://nullcone.ai/mcp"
}
}
}
```
No signup or token required. Read tools and IOC submission are open; destructive tools (e.g. `revoke_ioc`) are disabled on the public endpoint.
## Tools
30+ tools including:
- `lookup_ioc(value)` — check any indicator against the feed
- `recent_threats(limit, min_severity)` — current threat picture
- `submit_ioc(...)` / `submit_batch(...)` — contribute indicators
- `check_prompt(...)` — sub-millisecond prompt-injection lookup
- `validate_skill(...)` / `scan_skill_content(...)` — vet MCP tools / AI skills before loading
- `poll_since(last_id)` — incremental sync, no persistent connection
- `get_stats()`, `list_families()`, `search_by_type(...)`, and more
Resources: `threat://stats`, `threat://recent`, `threat://families`, `threat://family/{name}`, `threat://ioc/{value}`.
Prompts: `analyze_ioc`, `triage_alert`, `threat_brief`.
## Self-host
The server is built on the public [`nullcone`](https://pypi.org/project/nullcone/) SDK.
```bash
pip install -r requirements.txt
MCP_TRANSPORT=streamable-http MCP_PORT=8001 python server.py
```
Or with Docker:
```bash
docker build -t nullcone-mcp .
docker run -p 8001:8001 nullcone-mcp
```
Set `MCP_PUBLIC=1` to run an anonymous public endpoint (disables destructive tools); omit it for full local control over stdio (`MCP_TRANSPORT=stdio`).
## License
Rising Sun License v1.0 — see [LICENSE](LICENSE). Free for individuals and small teams.