English Français العربية

Nullcone Threat Intelligence

Official registry Security

Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats

Source code Website Documentation

What can you do with Nullcone Threat Intelligence?

  • lookup_ioc(value) — check any indicator against the feed
  • recent_threats(limit, min_severity) — current threat picture
  • submit_ioc(...) / submit_batch(...) — contribute indicators
  • check_prompt(...) — sub-millisecond prompt-injection lookup
  • validate_skill(...) / scan_skill_content(...) — vet MCP tools / AI skills before loading
  • poll_since(last_id) — incremental sync, no persistent connection
  • get_stats(), list_families(), search_by_type(...), and more

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http nullcone-threat-intelligence 'https://nullcone.ai/mcp'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "nullcone-threat-intelligence": {
            "type": "http",
            "url": "https://nullcone.ai/mcp"
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. Nullcone MCP Server
  2. Use it (hosted — nothing to install)
  3. Tools
  4. Self-host
  5. License

Nullcone MCP Server

Real-time threat intelligence for AI agents, exposed as a Model Context Protocol server. Check IPs, domains, URLs, hashes, CVEs, prompt-injection payloads, and malicious AI-skill / MCP-tool definitions against the Nullcone network — 890K+ IOCs, free, no API key.

Backed by nullcone.ai.

Use it (hosted — nothing to install)

The server is hosted at https://nullcone.ai/mcp over streamable HTTP. Add it to any MCP client:

Claude Code

claude mcp add --transport http nullcone https://nullcone.ai/mcp

Cursor / other MCP clients — add to your MCP config:

{
  "mcpServers": {
    "nullcone": {
      "url": "https://nullcone.ai/mcp"
    }
  }
}

No signup or token required. Read tools and IOC submission are open; destructive tools (e.g. revoke_ioc) are disabled on the public endpoint.

Tools

30+ tools including:

  • lookup_ioc(value) — check any indicator against the feed
  • recent_threats(limit, min_severity) — current threat picture
  • submit_ioc(...) / submit_batch(...) — contribute indicators
  • check_prompt(...) — sub-millisecond prompt-injection lookup
  • validate_skill(...) / scan_skill_content(...) — vet MCP tools / AI skills before loading
  • poll_since(last_id) — incremental sync, no persistent connection
  • get_stats(), list_families(), search_by_type(...), and more

Resources: threat://stats, threat://recent, threat://families, threat://family/{name}, threat://ioc/{value}. Prompts: analyze_ioc, triage_alert, threat_brief.

Self-host

The server is built on the public nullcone SDK.

pip install -r requirements.txt
MCP_TRANSPORT=streamable-http MCP_PORT=8001 python server.py

Or with Docker:

docker build -t nullcone-mcp .
docker run -p 8001:8001 nullcone-mcp

Set MCP_PUBLIC=1 to run an anonymous public endpoint (disables destructive tools); omit it for full local control over stdio (MCP_TRANSPORT=stdio).

License

Rising Sun License v1.0 — see LICENSE. Free for individuals and small teams.

Frequently asked questions

What is Nullcone Threat Intelligence?

Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats

How do I install Nullcone Threat Intelligence?

It runs as a remote server. In Claude Code: claude mcp add --transport http nullcone-threat-intelligence 'https://nullcone.ai/mcp'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does Nullcone Threat Intelligence need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is Nullcone Threat Intelligence open source?

Its code is public on GitHub, but the repository does not declare a standard license.

Who maintains Nullcone Threat Intelligence?

It is published by maco144. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.