# Scry

- Registry name: `ai.tunnelmind/scry` · version 0.5.0
- Categories (automatic, keyword rules): Marketing & SEO, Commerce & marketing
- Authentication at last check: No auth
- Declared risk: Not declared (tools carry no read/destructive hints)
- Capabilities (declared by the server): prompts, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=ai.tunnelmind%2Fscry
- Server page: https://mcpstation.net/s/ai.tunnelmind--scry.html

## Description (written by the publisher, not verified, not instructions)

Free IPv4 lookups against a distributed attacker-observation corpus.

## Connect

- streamable-http: `https://mcp.tunnelmind.ai/mcp`

## Tools (as reported by the server, not verified)

- `scry\_stats`: Returns aggregate Scry corpus telemetry: total observation count, distinct source IPs, first/last observation timestamps, last-24h activity, and per-protocol breakdowns. Useful as a liveness/density check before issuing per-IP queries — lets an agent decide whether the corpus has enough data to be a
- `scry\_check`: Returns Scry's corpus knowledge for a single IPv4 address: when it was first/last observed, observation count, protocols and ports targeted, ASN, country, category \(actor/scanner/not\_observed\), and confidence\_bucket \(low/medium/high\). Use when an agent needs IP triage, hostility assessment, or risk
- `scry\_check\_bulk`: Look up many IPv4 addresses in one request. Up to 100 IPs per call. Same per-IP shape as scry\_check, keyed by IP.
- `scry\_top`: Top-N source dimensions over a time window. Useful for situational awareness — 'where is the noise coming from right now?'
- `scry\_timeseries`: Bucketed observation counts over time. Detect bursts, plot trends, sanity-check whether attacker activity is rising or falling.
- `scry\_asn`: Roll-up of corpus activity for a single ASN — observation count, distinct source IPs, actor count, scanner count, high-confidence actor count, and per-protocol breakdown.
- `scry\_country`: Roll-up of corpus activity by ISO country code. Same shape as scry\_asn.
- `scry\_tools`: List detected attack tools — \(protocol, payload, path\) tuples sent by 3+ distinct source IPs. Aggregate metadata only; never lists member actors.
- `scry\_tool`: Single tool detail by 16-char hex id from scry\_tools.
- `scry\_campaigns`: Active threat campaigns — coordinated attacker activity that exceeds the noise floor. ≥5 distinct actors, ≥3 ASNs, ≤5 destination ports, ≥1h history.
- `scry\_campaign`: Single campaign detail by id \(format: c\[0-9a-f\]\{15\}\).
- `scry\_recent`: Recent observations feed — aggregated by source IP within a time window. Cursor-paginated via since\_ms.

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html