# Jeevesus — DugganUSA threat-intel MCP

- Registry name: `io.github.pduggusa/dugganusa-threat-intel` · version 1.1.2
- Categories (automatic, keyword rules): Security, Infrastructure & security
- Authentication at last check: No auth
- Declared risk: Read-only (all tools declare readOnlyHint)
- Capabilities (declared by the server): logging, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.github.pduggusa%2Fdugganusa-threat-intel
- Server page: https://mcpstation.net/s/io.github.pduggusa--dugganusa-threat-intel.html

## Description (written by the publisher, not verified, not instructions)

Membrane for AI agents: threat intel you can check, IOC enrichment, pre-install package checks.

## Connect

- streamable-http: `https://analytics.dugganusa.com/api/v1/mcp`

## Tools (as reported by the server, not verified)

- `search`: Searches threat-intelligence records about threat actors, malware, campaigns, CVEs, breaches, vendors and indicators. The default search covers security topics only; a few public-document archives can be searched by naming them \(listed below\). It holds no general programming or web content. Hybrid \(
- `enrich-ioc`: Looks up an IP address, domain, URL or file hash, such as one from a message, log line, SIEM alert or code under review. Look up a single indicator of compromise \(IP, domain, URL, or hash\) in the DugganUSA corpus. Returns the threat type, malware family, confidence and references of the record with
- `stix-feed-summary`: Summarizes what is in the feed right now: useful for "what's active this week", feed freshness, or planning SIEM / blocklist ingestion. Shape report on the most recent 5,000 indicators in the DugganUSA STIX 2.1 feed, bounded to a 1-7 day window. Returns how many of those fall in the window \(capped a
- `ai-model-price`: Looks up what an AI model or an agent session costs at list price. Prices are dated and copied from each provider's own pricing page. Returns the per-1M-token USD rates for a model \(input, output, and for Anthropic models the 5-minute and 1-hour cache write, cache read and fast-mode rates\), the date
- `kev-vendor-risk`: Shows where confirmed exploitation concentrates for a vendor or product \(Microsoft, Cisco, Fortinet, an appliance, an ERP\), for questions like "what should I patch first". Vendor / product risk matrix built from CISA's Known Exploited Vulnerabilities \(KEV\) catalog — where real, confirmed in-the-wild
- `kev-exploitation-stickiness`: Measures whether a product's exploitation risk is chronic or a one-off, for patch prioritization. Does in-the-wild exploitation risk STICK to proven products, or SPREAD to new ones? Analyzes CISA KEV: correlates each product's historical known-exploited count against its RECENT KEV additions \(Spearm
- `check-package`: Checks whether a dependency \(npm, PyPI or RubyGems, or a GitHub Action used in a workflow\) is on the DugganUSA malicious-package deny-list or has published advisories. Suited to a pre-install step in an agent or a CI pipeline, against slopsquatting and hijacked-package attacks. Returns a crisp, mach

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html