Summary
Connects your Claude agent to the Nullcone threat intelligence network with 890K+ indicators of compromise. You get 30+ tools for checking IPs, domains, URLs, file hashes, and CVEs against live threat feeds, plus two AI-specific lookups: prompt injection payload detection and MCP tool definition scanning. The hosted endpoint at nullcone.ai/mcp requires no API key and supports incremental polling via poll_since for staying current without webhooks. Reach for this when you're building agents that handle untrusted input, load third-party skills, or need to validate artifacts against known malware hashes and malicious infrastructure. Submit your own IOCs back to the network or self-host the Python server for full control over stdio transport.
Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →
belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →
Give your AI agent a complete email layer—sending, inbound inboxes, and sandbox testing.
Get 4K emails/month free →
Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →
Notes, actions and memory. Without a meeting bot. First month 100% off.
Download for free →
Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.
Try For Free →Nullcone MCP Server
Real-time threat intelligence for AI agents, exposed as a Model Context Protocol server. Check IPs, domains, URLs, hashes, CVEs, prompt-injection payloads, and malicious AI-skill / MCP-tool definitions against the Nullcone network — 890K+ IOCs, free, no API key.
Backed by nullcone.ai.
Use it (hosted — nothing to install)
The server is hosted at https://nullcone.ai/mcp over streamable HTTP. Add it to any MCP client:
Claude Code
claude mcp add --transport http nullcone https://nullcone.ai/mcp
Cursor / other MCP clients — add to your MCP config:
{
"mcpServers": {
"nullcone": {
"url": "https://nullcone.ai/mcp"
}
}
}
No signup or token required. Read tools and IOC submission are open; destructive tools (e.g. revoke_ioc) are disabled on the public endpoint.
Tools
30+ tools including:
lookup_ioc(value)— check any indicator against the feedrecent_threats(limit, min_severity)— current threat picturesubmit_ioc(...)/submit_batch(...)— contribute indicatorscheck_prompt(...)— sub-millisecond prompt-injection lookupvalidate_skill(...)/scan_skill_content(...)— vet MCP tools / AI skills before loadingpoll_since(last_id)— incremental sync, no persistent connectionget_stats(),list_families(),search_by_type(...), and more
Resources: threat://stats, threat://recent, threat://families, threat://family/{name}, threat://ioc/{value}.
Prompts: analyze_ioc, triage_alert, threat_brief.
Self-host
The server is built on the public nullcone SDK.
pip install -r requirements.txt
MCP_TRANSPORT=streamable-http MCP_PORT=8001 python server.py
Or with Docker:
docker build -t nullcone-mcp .
docker run -p 8001:8001 nullcone-mcp
Set MCP_PUBLIC=1 to run an anonymous public endpoint (disables destructive tools); omit it for full local control over stdio (MCP_TRANSPORT=stdio).
License
Rising Sun License v1.0 — see LICENSE. Free for individuals and small teams.
Featured
Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →Give your AI agent a complete email layer—sending, inbound inboxes, and sandbox testing.
Get 4K emails/month free →Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →Notes, actions and memory. Without a meeting bot. First month 100% off.
Download for free →Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.
Try For Free →
