All servers · Security

Jeevesus — DugganUSA threat-intel MCP

io.github.pduggusa/dugganusa-threat-intel · v1.1.2

Measured by MCP Station

Description written by the publisher, not verified

Membrane for AI agents: threat intel you can check, IOC enrichment, pre-install package checks.

Connect

claude mcp add --transport http dugganusa-threat-intel https://analytics.dugganusa.com/api/v1/mcp

{
  "mcpServers": {
    "dugganusa-threat-intel": {
      "url": "https://analytics.dugganusa.com/api/v1/mcp"
    }
  }
}

Tools as reported by the server

• search
  Searches threat-intelligence records about threat actors, malware, campaigns, CVEs, breaches, vendors and indicators. The default search covers security topics only; a few public-document archives can be searched by naming them (listed below). It holds no general programming or web content. Hybrid (
• enrich-ioc
  Looks up an IP address, domain, URL or file hash, such as one from a message, log line, SIEM alert or code under review. Look up a single indicator of compromise (IP, domain, URL, or hash) in the DugganUSA corpus. Returns the threat type, malware family, confidence and references of the record with
• stix-feed-summary
  Summarizes what is in the feed right now: useful for "what's active this week", feed freshness, or planning SIEM / blocklist ingestion. Shape report on the most recent 5,000 indicators in the DugganUSA STIX 2.1 feed, bounded to a 1-7 day window. Returns how many of those fall in the window (capped a
• ai-model-price
  Looks up what an AI model or an agent session costs at list price. Prices are dated and copied from each provider's own pricing page. Returns the per-1M-token USD rates for a model (input, output, and for Anthropic models the 5-minute and 1-hour cache write, cache read and fast-mode rates), the date
• kev-vendor-risk
  Shows where confirmed exploitation concentrates for a vendor or product (Microsoft, Cisco, Fortinet, an appliance, an ERP), for questions like "what should I patch first". Vendor / product risk matrix built from CISA's Known Exploited Vulnerabilities (KEV) catalog — where real, confirmed in-the-wild
• kev-exploitation-stickiness
  Measures whether a product's exploitation risk is chronic or a one-off, for patch prioritization. Does in-the-wild exploitation risk STICK to proven products, or SPREAD to new ones? Analyzes CISA KEV: correlates each product's historical known-exploited count against its RECENT KEV additions (Spearm
• check-package
  Checks whether a dependency (npm, PyPI or RubyGems, or a GitHub Action used in a workflow) is on the DugganUSA malicious-package deny-list or has published advisories. Suited to a pre-install step in an agent or a CI pipeline, against slopsquatting and hijacked-package attacks. Returns a crisp, mach

Tool changes

• 2026-10-24: search, enrich-ioc, stix-feed-summary, ai-model-price, kev-vendor-risk, kev-exploitation-stickiness, check-package
• 2026-10-21: search, enrich-ioc, stix-feed-summary, ai-model-price, kev-vendor-risk, kev-exploitation-stickiness, check-package
• 2026-10-19: search, enrich-ioc, stix-feed-summary, ai-model-price, kev-vendor-risk, kev-exploitation-stickiness, check-package
• 2026-10-16: search, enrich-ioc, stix-feed-summary, ai-model-price, kev-vendor-risk, kev-exploitation-stickiness, check-package

Repository · Website · JSON · Text for agents · Registry updated 2026-10-16