MCP.so
Sign In
K

Keyboardcrumbs Threat Intel

@kbcrumbs

Repository

About Keyboardcrumbs Threat Intel

Live threat intelligence for Claude — check IPs, CVEs, KEV predictions, malware hashes, and pre-attack

#threat-intel#security#cybersecurity

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "keyboardcrumbs": {
      "command": "uvx",
      "args": [
        "--from",
        "keyboardcrumbs-mcp",
        "keyboardcrumbs-mcp"
      ]
    }
  }
}

Tools

8

Threat intel for any IP — risk score, geo, ASN, C2 associations, staging clusters

CVE lookup — CVSS, EPSS, KEV status, exploit availability, patch urgency

Domain intel — DNS records, WHOIS, malware associations, subdomains

Malware hash lookup via VirusTotal (68+ engines) + CIRCL (6.3B files)

Live snapshot — KEV count, active C2s, ransomware victims, data freshness

KEV Oracle — top CVEs predicted to be added to CISA KEV before it happens

GhostWatch — detect pre-attack infrastructure staging for an IP or domain

Ransomware group lookup and victim tracking

Overview

What is Keyboardcrumbs Threat Intel?

Live threat intelligence tools for Claude Desktop. Free, no API key required. Provides tools to check IPs, CVEs, domains, hashes, active threats, KEV predictions, staging detection, and ransomware tracking.

How to use Keyboardcrumbs Threat Intel?

Install via uvx (no install needed) or clone and run locally. Add configuration to claude_desktop_config.json and restart Claude Desktop. Once installed, ask natural language questions like "Is 45.141.26.73 malicious?" or "Should I patch CVE-2024-3400 immediately?".

Key features of Keyboardcrumbs Threat Intel

  • Free, no API key or signup required.
  • Live threat intelligence with data updates every 15 minutes.
  • Tools for IP, CVE, domain, hash, and ransomware analysis.
  • KEV Oracle predicts CVEs before CISA adds them.
  • GhostWatch detects pre-attack infrastructure staging.
  • Integrates multiple sources: URLhaus, VirusTotal, CIRCL, Shodan, etc.

Use cases of Keyboardcrumbs Threat Intel

  • Check if an IP address is malicious with risk score and C2 associations.
  • Look up CVE details including CVSS, EPSS, KEV status, and patch urgency.
  • Investigate domains for DNS records, WHOIS, and malware associations.
  • Query file hashes across 68+ antivirus engines and CIRCL databases.
  • Get a live snapshot of active threats, KEV count, and ransomware victims.

FAQ from Keyboardcrumbs Threat Intel

Is an API key required?

No, the server is free and requires no API key or signup.

Are there rate limits?

No rate limits for normal use.

How often is the data updated?

Data updates every 15 minutes.

What data sources are used?

Sources include URLhaus, Feodo Tracker, AlienVault OTX, CISA KEV, NVD, EPSS, ExploitDB, VirusTotal, CIRCL, SANS ISC DShield, Shodan, RIPE, crt.sh, and Ransomware.live.

How do I install it?

You can install via uvx without cloning, or clone the repository and run locally. Configuration is added to claude_desktop_config.json.

Frequently asked questions

Is an API key required?

No, the server is free and requires no API key or signup.

Are there rate limits?

No rate limits for normal use.

How often is the data updated?

Data updates every 15 minutes.

What data sources are used?

Sources include URLhaus, Feodo Tracker, AlienVault OTX, CISA KEV, NVD, EPSS, ExploitDB, VirusTotal, CIRCL, SANS ISC DShield, Shodan, RIPE, crt.sh, and Ransomware.live.

How do I install it?

You can install via uvx without cloning, or clone the repository and run locally. Configuration is added to `claude_desktop_config.json`.

Comments

Basic information

Category

Other

Transports

stdio

Author

kbcrumbs

Submitted by

kbcrumbs

More Other MCP servers

EverArt

modelcontextprotocol

Model Context Protocol Servers

88.1K

Glasswarp

Glasswarp

See and control a real Windows PC you own — from any MCP client, locally or remotely. Observe (UIA + screenshots), click/type/drag/scroll, launch apps, owner Live View. BYOH: your machine, your key.

MaxKB

1Panel-dev

🔥 MaxKB is an open-source platform for building enterprise-grade agents. 强大易用的开源企业级智能体平台。

22.0K

Lemon.io

lemon-io

Request dedicated senior developers to work on your project, write job descriptions, and prep technical interviews — all without leaving your Claude chat. Just describe what you need, and Lemon.io MCP does the rest. 1–3

ICSS

chokcoco

不止于 CSS

20.7K