About Nullcone Threat Intelligence
Nullcone Threat Intelligence is an MCP server for real-time threat intelligence aimed at AI agents. It checks indicators, CVEs, prompt-injection payloads, and malicious AI-skill or MCP-tool definitions, with more than 30 tools and a hosted endpoint that requires no API key.
Key features
- 01Look up IPs, domains, URLs, hashes, and CVEs
- 02Check prompt-injection payloads
- 03Validate AI skills and MCP tool definitions
- 04Submit individual or batches of IOCs
- 05Incrementally sync threat data
- 06Expose threat resources and prompts
Use cases
- 01Check a suspicious IP, URL, or file hash
- 02Screen prompts for injection before processing
- 03Review AI skills or MCP tools before loading
- 04Sync recent threats and analyze IOCs
MCP support
The MCP server exposes threat-intelligence tools, resources, and prompts through its hosted endpoint or a self-hosted deployment.
Configuration
Remote servers need no local install. Pick your client, then copy the config or install in one click.
https://nullcone.ai/mcpclaude mcp add --transport http maco144-nullcone https://nullcone.ai/mcp{"mcpServers":{"maco144-nullcone":{"type":"http","url":"https://nullcone.ai/mcp"}}}Open in Cursor{"servers":{"maco144-nullcone":{"type":"http","url":"https://nullcone.ai/mcp"}}}Open in VS Code{"mcpServers":{"maco144-nullcone":{"type":"http","url":"https://nullcone.ai/mcp"}}}{"mcpServers":{"maco144-nullcone":{"serverUrl":"https://nullcone.ai/mcp"}}}Run commands in a terminal; paste JSON into the client’s MCP config and restart. Servers that need sign-in will prompt on first connect.
Tools
30| Parameter | Type | Required | Description |
|---|---|---|---|
| tags | array | No | |
| value | string | Yes | |
| source | string | No | |
| context | string | No | |
| ioc_type | string | Yes | |
| severity | integer | No | |
| confidence | integer | No | |
| family_hint | string | No |
Details
From the project READMENullcone MCP Server
Real-time threat intelligence for AI agents, exposed as a Model Context Protocol server. Check IPs, domains, URLs, hashes, CVEs, prompt-injection payloads, and malicious AI-skill / MCP-tool definitions against the Nullcone network — 890K+ IOCs, free, no API key.
Backed by nullcone.ai.
Use it (hosted — nothing to install)
The server is hosted at https://nullcone.ai/mcp over streamable HTTP. Add it to any MCP client:
Claude Code
claude mcp add --transport http nullcone https://nullcone.ai/mcp
Cursor / other MCP clients — add to your MCP config:
{
"mcpServers": {
"nullcone": {
"url": "https://nullcone.ai/mcp"
}
}
}
No signup or token required. Read tools and IOC submission are open; destructive tools (e.g. revoke_ioc) are disabled on the public endpoint.
Tools
30+ tools including:
lookup_ioc(value)— check any indicator against the feedrecent_threats(limit, min_severity)— current threat picturesubmit_ioc(...)/submit_batch(...)— contribute indicatorscheck_prompt(...)— sub-millisecond prompt-injection lookupvalidate_skill(...)/scan_skill_content(...)— vet MCP tools / AI skills before loadingpoll_since(last_id)— incremental sync, no persistent connectionget_stats(),list_families(),search_by_type(...), and more
Resources: threat://stats, threat://recent, threat://families, threat://family/{name}, threat://ioc/{value}.
Prompts: analyze_ioc, triage_alert, threat_brief.
Self-host
The server is built on the public nullcone SDK.
pip install -r requirements.txt
MCP_TRANSPORT=streamable-http MCP_PORT=8001 python server.py
Or with Docker:
docker build -t nullcone-mcp .
docker run -p 8001:8001 nullcone-mcp
Set MCP_PUBLIC=1 to run an anonymous public endpoint (disables destructive tools); omit it for full local control over stdio (MCP_TRANSPORT=stdio).
License
Rising Sun License v1.0 — see LICENSE. Free for individuals and small teams.
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.