Security & Testing

nullcone.ai

Free threat intelligence that blocks malicious IPs, domains, and attacks for developers and AI agents.

1 endpoint30 known toolsFirst detected July 25, 2026Last detected August 29, 2026

ENDPOINT 1

https://nullcone.ai/mcp

No auth detected

MCP server metadata

Name: Nullcone Threat Intelligence
Version: 1.29.0

Capabilities

experimentalpromptsresourcestools

Server instructions

Tools, resources, and prompts for submitting, querying, and reporting on threat indicators (IOCs) in the Nullcone distributed threat intelligence network. All agents in the network share a live SpacetimeDB instance — new IOCs submitted here are immediately visible to every subscribed sensor. Quick-start patterns: - Check an indicator: lookup_ioc(value='...') - Get current threat picture: read resource threat://recent or call recent_threats() - Bulk ingest: submit_batch(iocs=[...]) - Incremental sync: poll_since(last_id=<persisted>) — no persistent connection needed - Use prompts/ for structured analysis templates

Known tools 30

submit_ioc

Submit a threat indicator (IOC) to the shared intelligence network.

Inferred read-only

submit_batch

Submit multiple IOCs in a single call.

Inferred read-only

lookup_ioc

Look up a threat signature by its exact IOC value.

Inferred read-only

recent_threats

Return the most recently observed threat signatures.

Inferred read-only

family_threats

Return all threat signatures associated with a known malware family.

Inferred read-only

list_families

Return all known malware families in the intelligence database.

Inferred read-only

search_by_type

Return threat signatures filtered by IOC type.

Inferred read-only

report_detection

Report that you detected and acted on a known threat signature.

Inferred read-only

vote_false_positive

Flag a threat signature as a likely false positive.

Inferred read-only

poll_since

Fetch new threat signatures since a high-water mark ID.

Inferred read-only

get_stats

Return aggregate statistics for the threat intelligence database.

Inferred read-only

validate_skill

Synchronous SKILL IOC lookup — call this before loading or invoking any MCP tool/skill to check it against the Nullcone threat feed.

Inferred read-only

scan_skill_content

Pre-execution content scan for skill/instruction files.

Inferred read-only

get_new_threats

Drain the live push-subscription buffer of threats received since the last call.

Inferred read-only

warm_prompt_cache

Load all PROMPT IOCs from SpacetimeDB into the in-memory hash set.

Inferred read-only

check_prompt

Check a prompt or text fragment for known PROMPT IOC patterns.

Inferred read-only

check_prompt_batch

Check multiple prompts for PROMPT IOC patterns in a single call.

Inferred read-only

prompt_cache_stats

Return PROMPT IOC cache statistics: size, hit rate, latency, refresh status.

Inferred read-only

check_freshness

Validate that IOC threat intelligence is fresh enough for the named action.

Inferred read-only

freshness_limits

Return the configured IOC freshness limits for all action tiers.

Inferred read-only

fingerprint_tool_metadata

Analyze an MCP tool definition for instruction-injection and malicious patterns.

Inferred read-only

registry_monitor_stats

Return MCP registry monitoring statistics.

Inferred read-only

registry_flagged_tools

Return all MCP tools that have been flagged as suspicious or malicious.

Inferred read-only

subscribe_threats

Open a named, stateful subscription to live threat push delivery.

Inferred read-only

drain_subscription

Drain the buffer of a stateful subscription created by subscribe_threats().

Inferred read-only

unsubscribe

Cancel a stateful subscription and free its buffer.

Inferred read-only

list_subscriptions

List all active stateful push subscriptions on this MCP server instance.

Inferred read-only

revoke_ioc

Revoke an IOC by its value hash, pushing the expiration event to all active subscriptions in real-time.

Inferred read-only

is_ioc_revoked

Check whether an IOC has been revoked.

Inferred read-only

list_revocations

List recent IOC revocations, newest first.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.nullcone-threat-intelligence]
url = "https://nullcone.ai/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "nullcone-threat-intelligence": {
      "type": "http",
      "url": "https://nullcone.ai/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: nullcone-threat-intelligence
Remote MCP URL: https://nullcone.ai/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "nullcone-threat-intelligence": {
      "url": "https://nullcone.ai/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "nullcone-threat-intelligence": {
      "type": "http",
      "url": "https://nullcone.ai/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "nullcone-threat-intelligence",
  "transport": "streamable-http",
  "url": "https://nullcone.ai/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Trust Data Available

BuiltWith Trust API v2 evidence for nullcone.ai was fetched 2026-08-21T22:54:59.842Z.

Trust status Neutral

nullcone.ai is assessed as Neutral: No suspicious signals found, but no strong positive signal either

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.