A comprehensive threat intelligence aggregation MCP server
Until 2026-09-25 this record combined several servers published from one repository. The others now have records of their own: iflow-mcp_jx888-max_cyber-sentinel-mcp. Checks from before that date include them.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"cyber-sentinel-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# 🛡️ Cyber Sentinel MCP Server A comprehensive threat intelligence aggregation MCP (Model Context Protocol) server that provides unified access to multiple threat intelligence sources for security analysis. ## 🎯 Overview Cyber Sentinel eliminates the tedious manual process of querying multiple threat intelligence sources by providing a single, unified interface. Security analysts can now analyze indicators (IPs, domains, hashes, URLs) across multiple sources with a single command, getting aggregated results with confidence scoring. ## ✨ Features ### 🔍 Threat Intelligence - **Multi-Source Intelligence**: Aggregates data from VirusTotal v3, AbuseIPDB, URLhaus, Shodan, ThreatFox, and MalwareBazaar - **Smart Indicator Detection**: Automatically detects IP addresses, domains, file hashes, and URLs - **Intelligent Aggregation**: Combines results from multiple sources with confidence scoring - **Async Performance**: High-performance concurrent processing - **Smart Caching**: Reduces API calls and improves response times (1-hour TTL) - **Rate Limiting**: Respects API limits across all sources (60 req/min default) - **Error Recovery**: Graceful handling of API failures and timeouts ### 🛡️ Code Security Analysis - **Multi-Language Support**: Analyzes Python, JavaScript, Java, C#, PHP, Go, Rust, C++, and SQL code - **Vulnerability Detection**: Identifies hardcoded secrets, SQL injection, XSS, path traversal, and more - **Network Indicator Analysis**: Extracts and analyzes IPs, domains, and URLs found in code - **Secure Alternatives**: Provides secure coding recommendations and alternatives - **Risk Scoring**: Calculates comprehensive security risk scores ### 📦 Dependency Security - **Multi-Platform Support**: Scans NPM, Python, Maven, Cargo, Go, and Composer dependencies - **Vulnerability Detection**: Identifies known malicious packages and outdated dependencies - **Security Recommendations**: Provides actionable security improvement s…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.