mcp server
Scry
Free IPv4 lookups against a distributed attacker-observation corpus.
Description as published by the maintainer. Source
- version 0.5.0
- archived
archived — The owner archived the repository. It will not receive fixes.
What this server can do
12 functions, named and described by the server itself. Parameter names are shown because they say more about what a function does than its name usually does.
scry_asn(asn, since_ms)- Roll-up of corpus activity for a single ASN — observation count, distinct source IPs, actor count, scanner count, high-confidence actor count, and per-protocol breakdown. Required: asn.
scry_campaign(id)- Single campaign detail by id (format: c[0-9a-f]{15}). Required: id.
scry_campaigns(limit, include_inactive)- Active threat campaigns — coordinated attacker activity that exceeds the noise floor. ≥5 distinct actors, ≥3 ASNs, ≤5 destination ports, ≥1h history.
scry_check(ip)- Returns Scry's corpus knowledge for a single IPv4 address: when it was first/last observed, observation count, protocols and ports targeted, ASN, country, category (actor/scanner/not_observed), and confidence_bucket (low/medium/high). Use when an agent needs IP triage, hostility assessment, or risk signaling. Do NOT use for raw payloads (never exposed) or IPv6 (corpus is v4-only at v0.1). Required: ip.
scry_check_bulk(ips)- Look up many IPv4 addresses in one request. Up to 100 IPs per call. Same per-IP shape as scry_check, keyed by IP. Required: ips.
scry_country(country, since_ms)- Roll-up of corpus activity by ISO country code. Same shape as scry_asn. Required: country.
scry_recent(limit, country, protocol, since_ms, include_noise)- Recent observations feed — aggregated by source IP within a time window. Cursor-paginated via since_ms.
scry_stats- Returns aggregate Scry corpus telemetry: total observation count, distinct source IPs, first/last observation timestamps, last-24h activity, and per-protocol breakdowns. Useful as a liveness/density check before issuing per-IP queries — lets an agent decide whether the corpus has enough data to be authoritative. Use this tool when: - An agent is planning a multi-step investigation and wants to know if Scry has corpus density worth querying. - You want a 'corpus health' signal in a dashboard or report. Do NOT use this tool when: - You want details about a specific IP — use `scry_check`. - You want sensor fleet size or node identities — never exposed at any tier. Inputs: none. Returns: total_observations, distinct_source_ips, first_seen_ms, last_seen_ms, observations_last_24h, distinct_source_ips_last_24h, by_protocol, as_of_ms. Cost: free, anonymous, rate-limited. Latency: <100ms typical.
scry_timeseries(bucket, since_ms, until_ms)- Bucketed observation counts over time. Detect bursts, plot trends, sanity-check whether attacker activity is rising or falling.
scry_tool(id)- Single tool detail by 16-char hex id from scry_tools. Required: id.
scry_tools(limit, protocol, since_ms)- List detected attack tools — (protocol, payload, path) tuples sent by 3+ distinct source IPs. Aggregate metadata only; never lists member actors.
scry_top(limit, since_ms, dimension, include_noise)- Top-N source dimensions over a time window. Useful for situational awareness — 'where is the noise coming from right now?'
Last successful function declaration observed on . Source: https://mcp.tunnelmind.ai/mcp. We list what the server declared; we do not call any of these functions.
Endpoint status observed on . Source: https://mcp.tunnelmind.ai/mcp.
Signals
These are separate measurements of different things. They are deliberately not combined into one score, because a popularity number that mixes website traffic with saves and stars cannot be checked or acted on.
| Signal | Value | What it measures | Window | Observed | Source |
|---|---|---|---|---|---|
| GitHub stars | 0 | Number of GitHub accounts that bookmarked this repository since it was created. It is a bookmark count, not installs, not active users and not quality. | cumulative, all time | GitHub | |
| Last commit | 2026-05-25 | Date of the most recent push to any branch. This is the strongest cheap indicator of whether the project is still maintained. | point in time | GitHub | |
| Open issues | 0 | Open issues plus open pull requests, as GitHub counts them together. A high number can mean an active project or an abandoned one. | as of fetch | GitHub | |
| Latest published version | 0.5.0 | Latest version string the maintainer published to the registry. | as of fetch | Model Context Protocol | |
| Registry record last updated | 2026-05-25 | When the registry record was last updated by its maintainer. | point in time | Model Context Protocol | |
| First listed in the MCP Registry | 2026-05-25 | Date this server was first published to the official MCP Registry. Not a usage or quality measure. | point in time | Model Context Protocol | |
| repository status | archived | The owner archived this repository on GitHub. It is read-only and will not receive fixes. | as of fetch | GitHub | |
| mcp tools declared | 12 tools | Number of functions the server itself declared when asked to list them. This is what the server offers an agent, not a measure of how well any of them work. | as of probe | mcp.tunnelmind.ai | |
| mcp endpoint status | ok | The server listed 12 functions when asked. | as of probe | mcp.tunnelmind.ai |
Where to get it
Related, by what their authors tagged them
-
Phishunt
— last commit 2026-08-02, shares cloudflare-workers, threat-intelligence
Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.
-
TweetFeed
— last commit 2026-08-01, shares cloudflare-workers, threat-intelligence
IOCs (URLs, domains, IPs, hashes) shared by the infosec community on X/Twitter. No auth, CC0.
-
ContrastAPI
— last commit 2026-08-04, shares security, threat-intelligence
55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.
-
com.threadlinqs/intelthreadlinqs-mcp
— last commit 2026-08-03, shares security, threat-intelligence
Threadlinqs threat-intelligence MCP — 73 tools: threats, detections, IOCs, actors, C2, MITRE, CVEs
-
io.github.aplaceforallmystuff/mcp-threatintel
— last commit 2026-08-05, shares security, threat-intelligence
Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker
-
data-breach-detector
— last commit 2026-08-06, shares security, threat-intelligence
Read-only breach intel, full history 2007-today: reports THAT an org was breached, never the data.
-
io.github.BurtTheCoder/shodan
— last commit 2026-03-31, shares security, threat-intelligence
MCP server for Shodan API — device search, IP lookup, DNS, and CVE/CPE queries.
-
io.github.BurtTheCoder/virustotal
— last commit 2026-05-24, shares security, threat-intelligence
MCP server for querying VirusTotal API with comprehensive security analysis tools.
-
Bawbel Scanner
— last commit 2026-05-23, shares agentic-ai, threat-intelligence
Scan MCP servers and skill files for AVE vulnerabilities. Conformance scoring and threat intel.
-
io.github.AynOps/AynOps
— last commit 2026-08-06, shares threat-intelligence
AynOps is a reconnaissance focused MCP Server which gives reconnaissance capabilities to AI Clients
These share tags the maintainers applied themselves, such as cloudflare-workers, threat-intelligence, security, agentic-ai. Common tags like "mcp" or "ai" are ignored for this: agreeing with six hundred other projects is not a similarity.
This is not a recommendation and not a test result. It is a map of what the authors said their work is about.
How the author describes it
Topics the maintainer set on GitHub: agentic-ai, cloudflare-workers, mcp, mcp-server, security, threat-intelligence.
This record as data
Every field on this page, with its source and observation date, is in the catalog JSON. Fetch the whole kind at once instead of parsing this HTML.
GET /api/v1/entries/mcp_server.json