{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_jhvge377nrgh","handle":"dragons-eye-ransomware-claims","url":"https://wellknown.network/agents/dragons-eye-ransomware-claims","links":{"self":"https://wellknown.network/agents/dragons-eye-ransomware-claims/record.json","html":"https://wellknown.network/agents/dragons-eye-ransomware-claims","markdown":"https://wellknown.network/agents/dragons-eye-ransomware-claims/record.md","api":"https://wellknown.network/api/v1/agents/dragons-eye-ransomware-claims","status":"https://wellknown.network/api/v1/agents/dragons-eye-ransomware-claims/status","claim":"https://wellknown.network/agents/dragons-eye-ransomware-claims/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/dragons-eye-ransomware-claims/claim.json","badge":"https://wellknown.network/agents/dragons-eye-ransomware-claims/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/dragons-eye-ransomware-claims/history","tools":"https://wellknown.network/api/v1/agents/dragons-eye-ransomware-claims/tools"},"ard":{"identifier":"urn:air:api.ransomware-tracker.com:server:dragons-eye-ransomware-claims","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"Dragons Eye Ransomware Claims","summary":"Ransomware claim lookups, IOC and CVE intel, group intel, bulk checks and watch alerts (x402 USDC).","description":"Ransomware claim lookups, IOC and CVE intel, group intel, bulk checks and watch alerts (x402 USDC).","publisher":{"name":"com.ransomware-tracker.api","url":null},"homepage":"https://api.ransomware-tracker.com/llms.txt","repository":null,"version":"1.5.0","license":null,"protocols":["mcp"],"tags":[],"pricing":null,"endpoints":[{"url":"https://api.ransomware-tracker.com/mcp","type":"mcp_streamable_http","auth":null,"probeable":true}],"skills":null,"tools":null,"extra":{"updatedAt":"2026-10-17T16:38:14.034926Z","publishedAt":"2026-10-17T16:38:14.034926Z","registryName":"com.ransomware-tracker.api/dragonseye"},"attribution":{"kind":"mcp_registry","name":"mcp_registry","summary":"mcp_registry","version":"mcp_registry","description":"mcp_registry","homepageUrl":"mcp_registry","publisherName":"mcp_registry"}},"derived":{"capabilities":[{"slug":"communication.notifications","name":"Notifications","confidence":0.9,"provenance":"derived"},{"slug":"code.security-review","name":"Security Review","confidence":0.807,"provenance":"derived"},{"slug":"content.marketing","name":"Marketing","confidence":0.525,"provenance":"derived"},{"slug":"commerce.ecommerce","name":"E-commerce Operations","confidence":0.525,"provenance":"derived"},{"slug":"commerce.payments","name":"Payments","confidence":0.51,"provenance":"derived"},{"slug":"commerce.pricing","name":"Pricing & Quotes","confidence":0.51,"provenance":"derived"}],"categories":["code","commerce","communication","content"],"language":"en"},"observed":{"status":"live","statusReason":"Responded 2h ago.","lastOkAt":"2026-10-24T06:27:04.794Z","lastProbedAt":"2026-10-24T06:27:04.794Z","statusComputedAt":"2026-10-24T06:29:54.328Z","reliability30d":{"probes":44,"successRate":1,"p50Ms":62,"basis":"service","measures":{"availability":"availability","latency":"response time","tools":"tool surface observed","summary":"Checks reached the service itself."},"checks":{"total":44,"ok":44,"authBoundaryOk":0,"serviceOk":44,"note":"Counted from the observation rows for the window, checks of the server only (HTTP, A2A card, MCP initialize). ok = authBoundaryOk + serviceOk. `probes` is the sum of daily rollups and includes registry checks, so it can differ from `total`."}},"latestObservations":[{"at":"2026-10-24T06:27:04.794Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":45,"error":null,"detail":{"tools":[{"name":"validate_query","description":"Free. Check and normalize a company name or domain before calling lookup_victim; tells you whether it will be searched as a domain or a name. Offline: no networ"},{"name":"pricing","description":"Free. Return the price of every paid tool, the payment network (Base) and address, the licensed data sources, and the 'unverified claim' label every result carr"},{"name":"lookup_victim","description":"Search ransomware leak-site claims for one company name or domain: has a group claimed it? Returns matching claims with group, claimed date, first-observed date"},{"name":"recent_claims","description":"List the newest ransomware leak-site claims (1-10), optionally filtered to one group such as akira or qilin. Use it to watch recent activity; use lookup_victim "},{"name":"group_profile","description":"Get a profile of one ransomware group: aliases, when RansomLook first observed it, and a sample of its newest claims. Use it to understand who a group is; use r"},{"name":"batch_exposure_check","description":"Check up to 25 vendor or supplier domains in one call for ransomware leak-site claims, for third-party-risk reviews. Returns one result per domain (found, claim"},{"name":"vendor_risk_report","description":"Build a third-party ransomware risk report for up to 100 vendors (domains or company names). For each vendor: matching leak-site claims (group, claimed and firs"},{"name":"bulk_vendor_check","description":"Check up to 100 vendors (domains or company names) for ransomware leak-site claims in one call: per vendor, matching claims (group, dates, sources), claim count"},{"name":"indicator_check","description":"Check one domain (or its parent domains) or IPv4 address against ThreatCluster's high-confidence 30-day IOC feed: is it listed as attacker infrastructure (C2, p"},{"name":"indicator_batch_check","description":"Same as indicator_check for up to 100 domains or IPv4 addresses in one call (one flat price). Costs $0.25 USDC per call via x402 (payment goes in _meta[\"x402/pa"},{"name":"cve_status","description":"Free. CISA KEV status (date added, due date, known ransomware campaign use, required action), EPSS when known, and whether paid cve_intel detail is cached for t"},{"name":"cve_intel","description":"Everything an agent needs to prioritize one CVE: CVSS, affected vendors/products, vendor advisories, CISA KEV status and known ransomware use, EPSS, recorded pu"},{"name":"cve_batch_intel","description":"cve_intel for up to 50 CVEs in one call. Charged only if every CVE is cached; otherwise an error lists the ids with no data and the covered ids to retry with (n"},{"name":"group_intel","description":"Threat-hunting profile of one active ransomware group: total and recent leak-site listings with a momentum status, reported tools, malware, campaigns, ATT&CK te"},{"name":"coverage","description":"Free. Indicator-feed freshness and the CVE ids and ransomware groups currently cached for cve_intel and group_intel."},{"name":"watch_status","description":"Free. Status of a paid vendor watch (created with HTTP POST /v1/watch): items, expiry, last check, last webhook delivery."}],"toolCount":16,"toolsHash":"452946ee73b2b1e7c6e489209cb2a0c56ce5cc1f26b84653641022b2ef5bbd9e","serverName":"dragonseye","capabilities":["tools"],"serverVersion":"1.5.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-23T23:27:51.206Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":55,"error":null,"detail":{"tools":[{"name":"validate_query","description":"Free. Check and normalize a company name or domain before calling lookup_victim; tells you whether it will be searched as a domain or a name. Offline: no networ"},{"name":"pricing","description":"Free. Return the price of every paid tool, the payment network (Base) and address, the licensed data sources, and the 'unverified claim' label every result carr"},{"name":"lookup_victim","description":"Search ransomware leak-site claims for one company name or domain: has a group claimed it? Returns matching claims with group, claimed date, first-observed date"},{"name":"recent_claims","description":"List the newest ransomware leak-site claims (1-10), optionally filtered to one group such as akira or qilin. Use it to watch recent activity; use lookup_victim "},{"name":"group_profile","description":"Get a profile of one ransomware group: aliases, when RansomLook first observed it, and a sample of its newest claims. Use it to understand who a group is; use r"},{"name":"batch_exposure_check","description":"Check up to 25 vendor or supplier domains in one call for ransomware leak-site claims, for third-party-risk reviews. Returns one result per domain (found, claim"},{"name":"vendor_risk_report","description":"Build a third-party ransomware risk report for up to 100 vendors (domains or company names). For each vendor: matching leak-site claims (group, claimed and firs"},{"name":"bulk_vendor_check","description":"Check up to 100 vendors (domains or company names) for ransomware leak-site claims in one call: per vendor, matching claims (group, dates, sources), claim count"},{"name":"indicator_check","description":"Check one domain (or its parent domains) or IPv4 address against ThreatCluster's high-confidence 30-day IOC feed: is it listed as attacker infrastructure (C2, p"},{"name":"indicator_batch_check","description":"Same as indicator_check for up to 100 domains or IPv4 addresses in one call (one flat price). Costs $0.25 USDC per call via x402 (payment goes in _meta[\"x402/pa"},{"name":"cve_status","description":"Free. CISA KEV status (date added, due date, known ransomware campaign use, required action), EPSS when known, and whether paid cve_intel detail is cached for t"},{"name":"cve_intel","description":"Everything an agent needs to prioritize one CVE: CVSS, affected vendors/products, vendor advisories, CISA KEV status and known ransomware use, EPSS, recorded pu"},{"name":"cve_batch_intel","description":"cve_intel for up to 50 CVEs in one call. Charged only if every CVE is cached; otherwise an error lists the ids with no data and the covered ids to retry with (n"},{"name":"group_intel","description":"Threat-hunting profile of one active ransomware group: total and recent leak-site listings with a momentum status, reported tools, malware, campaigns, ATT&CK te"},{"name":"coverage","description":"Free. Indicator-feed freshness and the CVE ids and ransomware groups currently cached for cve_intel and group_intel."},{"name":"watch_status","description":"Free. Status of a paid vendor watch (created with HTTP POST /v1/watch): items, expiry, last check, last webhook delivery."}],"toolCount":16,"toolsHash":"452946ee73b2b1e7c6e489209cb2a0c56ce5cc1f26b84653641022b2ef5bbd9e","serverName":"dragonseye","capabilities":["tools"],"serverVersion":"1.5.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-23T17:30:28.917Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":174,"error":null,"detail":{"tools":[{"name":"validate_query","description":"Free. Check and normalize a company name or domain before calling lookup_victim; tells you whether it will be searched as a domain or a name. Offline: no networ"},{"name":"pricing","description":"Free. Return the price of every paid tool, the payment network (Base) and address, the licensed data sources, and the 'unverified claim' label every result carr"},{"name":"lookup_victim","description":"Search ransomware leak-site claims for one company name or domain: has a group claimed it? Returns matching claims with group, claimed date, first-observed date"},{"name":"recent_claims","description":"List the newest ransomware leak-site claims (1-10), optionally filtered to one group such as akira or qilin. Use it to watch recent activity; use lookup_victim "},{"name":"group_profile","description":"Get a profile of one ransomware group: aliases, when RansomLook first observed it, and a sample of its newest claims. Use it to understand who a group is; use r"},{"name":"batch_exposure_check","description":"Check up to 25 vendor or supplier domains in one call for ransomware leak-site claims, for third-party-risk reviews. Returns one result per domain (found, claim"},{"name":"vendor_risk_report","description":"Build a third-party ransomware risk report for up to 100 vendors (domains or company names). For each vendor: matching leak-site claims (group, claimed and firs"},{"name":"bulk_vendor_check","description":"Check up to 100 vendors (domains or company names) for ransomware leak-site claims in one call: per vendor, matching claims (group, dates, sources), claim count"},{"name":"indicator_check","description":"Check one domain (or its parent domains) or IPv4 address against ThreatCluster's high-confidence 30-day IOC feed: is it listed as attacker infrastructure (C2, p"},{"name":"indicator_batch_check","description":"Same as indicator_check for up to 100 domains or IPv4 addresses in one call (one flat price). Costs $0.25 USDC per call via x402 (payment goes in _meta[\"x402/pa"},{"name":"cve_status","description":"Free. CISA KEV status (date added, due date, known ransomware campaign use, required action), EPSS when known, and whether paid cve_intel detail is cached for t"},{"name":"cve_intel","description":"Everything an agent needs to prioritize one CVE: CVSS, affected vendors/products, vendor advisories, CISA KEV status and known ransomware use, EPSS, recorded pu"},{"name":"cve_batch_intel","description":"cve_intel for up to 50 CVEs in one call. Charged only if every CVE is cached; otherwise an error lists the ids with no data and the covered ids to retry with (n"},{"name":"group_intel","description":"Threat-hunting profile of one active ransomware group: total and recent leak-site listings with a momentum status, reported tools, malware, campaigns, ATT&CK te"},{"name":"coverage","description":"Free. Indicator-feed freshness and the CVE ids and ransomware groups currently cached for cve_intel and group_intel."},{"name":"watch_status","description":"Free. Status of a paid vendor watch (created with HTTP POST /v1/watch): items, expiry, last check, last webhook delivery."}],"toolCount":16,"toolsHash":"452946ee73b2b1e7c6e489209cb2a0c56ce5cc1f26b84653641022b2ef5bbd9e","serverName":"dragonseye","capabilities":["tools"],"serverVersion":"1.5.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-23T10:34:35.089Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":133,"error":null,"detail":{"tools":[{"name":"validate_query","description":"Free. Check and normalize a company name or domain before calling lookup_victim; tells you whether it will be searched as a domain or a name. Offline: no networ"},{"name":"pricing","description":"Free. Return the price of every paid tool, the payment network (Base) and address, the licensed data sources, and the 'unverified claim' label every result carr"},{"name":"lookup_victim","description":"Search ransomware leak-site claims for one company name or domain: has a group claimed it? Returns matching claims with group, claimed date, first-observed date"},{"name":"recent_claims","description":"List the newest ransomware leak-site claims (1-10), optionally filtered to one group such as akira or qilin. Use it to watch recent activity; use lookup_victim "},{"name":"group_profile","description":"Get a profile of one ransomware group: aliases, when RansomLook first observed it, and a sample of its newest claims. Use it to understand who a group is; use r"},{"name":"batch_exposure_check","description":"Check up to 25 vendor or supplier domains in one call for ransomware leak-site claims, for third-party-risk reviews. Returns one result per domain (found, claim"},{"name":"vendor_risk_report","description":"Build a third-party ransomware risk report for up to 100 vendors (domains or company names). For each vendor: matching leak-site claims (group, claimed and firs"},{"name":"bulk_vendor_check","description":"Check up to 100 vendors (domains or company names) for ransomware leak-site claims in one call: per vendor, matching claims (group, dates, sources), claim count"},{"name":"indicator_check","description":"Check one domain (or its parent domains) or IPv4 address against ThreatCluster's high-confidence 30-day IOC feed: is it listed as attacker infrastructure (C2, p"},{"name":"indicator_batch_check","description":"Same as indicator_check for up to 100 domains or IPv4 addresses in one call (one flat price). Costs $0.25 USDC per call via x402 (payment goes in _meta[\"x402/pa"},{"name":"cve_status","description":"Free. CISA KEV status (date added, due date, known ransomware campaign use, required action), EPSS when known, and whether paid cve_intel detail is cached for t"},{"name":"cve_intel","description":"Everything an agent needs to prioritize one CVE: CVSS, affected vendors/products, vendor advisories, CISA KEV status and known ransomware use, EPSS, recorded pu"},{"name":"cve_batch_intel","description":"cve_intel for up to 50 CVEs in one call. Charged only if every CVE is cached; otherwise an error lists the ids with no data and the covered ids to retry with (n"},{"name":"group_intel","description":"Threat-hunting profile of one active ransomware group: total and recent leak-site listings with a momentum status, reported tools, malware, campaigns, ATT&CK te"},{"name":"coverage","description":"Free. Indicator-feed freshness and the CVE ids and ransomware groups currently cached for cve_intel and group_intel."},{"name":"watch_status","description":"Free. Status of a paid vendor watch (created with HTTP POST /v1/watch): items, expiry, last check, last webhook delivery."}],"toolCount":16,"toolsHash":"452946ee73b2b1e7c6e489209cb2a0c56ce5cc1f26b84653641022b2ef5bbd9e","serverName":"dragonseye","capabilities":["tools"],"serverVersion":"1.5.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-23T03:22:29.610Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":70,"error":null,"detail":{"tools":[{"name":"validate_query","description":"Free. Check and normalize a company name or domain before calling lookup_victim; tells you whether it will be searched as a domain or a name. Offline: no networ"},{"name":"pricing","description":"Free. Return the price of every paid tool, the payment network (Base) and address, the licensed data sources, and the 'unverified claim' label every result carr"},{"name":"lookup_victim","description":"Search ransomware leak-site claims for one company name or domain: has a group claimed it? Returns matching claims with group, claimed date, first-observed date"},{"name":"recent_claims","description":"List the newest ransomware leak-site claims (1-10), optionally filtered to one group such as akira or qilin. Use it to watch recent activity; use lookup_victim "},{"name":"group_profile","description":"Get a profile of one ransomware group: aliases, when RansomLook first observed it, and a sample of its newest claims. Use it to understand who a group is; use r"},{"name":"batch_exposure_check","description":"Check up to 25 vendor or supplier domains in one call for ransomware leak-site claims, for third-party-risk reviews. Returns one result per domain (found, claim"},{"name":"vendor_risk_report","description":"Build a third-party ransomware risk report for up to 100 vendors (domains or company names). For each vendor: matching leak-site claims (group, claimed and firs"},{"name":"bulk_vendor_check","description":"Check up to 100 vendors (domains or company names) for ransomware leak-site claims in one call: per vendor, matching claims (group, dates, sources), claim count"},{"name":"indicator_check","description":"Check one domain (or its parent domains) or IPv4 address against ThreatCluster's high-confidence 30-day IOC feed: is it listed as attacker infrastructure (C2, p"},{"name":"indicator_batch_check","description":"Same as indicator_check for up to 100 domains or IPv4 addresses in one call (one flat price). Costs $0.25 USDC per call via x402 (payment goes in _meta[\"x402/pa"},{"name":"cve_status","description":"Free. CISA KEV status (date added, due date, known ransomware campaign use, required action), EPSS when known, and whether paid cve_intel detail is cached for t"},{"name":"cve_intel","description":"Everything an agent needs to prioritize one CVE: CVSS, affected vendors/products, vendor advisories, CISA KEV status and known ransomware use, EPSS, recorded pu"},{"name":"cve_batch_intel","description":"cve_intel for up to 50 CVEs in one call. Charged only if every CVE is cached; otherwise an error lists the ids with no data and the covered ids to retry with (n"},{"name":"group_intel","description":"Threat-hunting profile of one active ransomware group: total and recent leak-site listings with a momentum status, reported tools, malware, campaigns, ATT&CK te"},{"name":"coverage","description":"Free. Indicator-feed freshness and the CVE ids and ransomware groups currently cached for cve_intel and group_intel."},{"name":"watch_status","description":"Free. Status of a paid vendor watch (created with HTTP POST /v1/watch): items, expiry, last check, last webhook delivery."}],"toolCount":16,"toolsHash":"452946ee73b2b1e7c6e489209cb2a0c56ce5cc1f26b84653641022b2ef5bbd9e","serverName":"dragonseye","capabilities":["tools"],"serverVersion":"1.5.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-22T20:26:55.995Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":84,"error":null,"detail":{"tools":[{"name":"validate_query","description":"Free. Check and normalize a company name or domain before calling lookup_victim; tells you whether it will be searched as a domain or a name. Offline: no networ"},{"name":"pricing","description":"Free. Return the price of every paid tool, the payment network (Base) and address, the licensed data sources, and the 'unverified claim' label every result carr"},{"name":"lookup_victim","description":"Search ransomware leak-site claims for one company name or domain: has a group claimed it? Returns matching claims with group, claimed date, first-observed date"},{"name":"recent_claims","description":"List the newest ransomware leak-site claims (1-10), optionally filtered to one group such as akira or qilin. Use it to watch recent activity; use lookup_victim "},{"name":"group_profile","description":"Get a profile of one ransomware group: aliases, when RansomLook first observed it, and a sample of its newest claims. Use it to understand who a group is; use r"},{"name":"batch_exposure_check","description":"Check up to 25 vendor or supplier domains in one call for ransomware leak-site claims, for third-party-risk reviews. Returns one result per domain (found, claim"},{"name":"vendor_risk_report","description":"Build a third-party ransomware risk report for up to 100 vendors (domains or company names). For each vendor: matching leak-site claims (group, claimed and firs"},{"name":"bulk_vendor_check","description":"Check up to 100 vendors (domains or company names) for ransomware leak-site claims in one call: per vendor, matching claims (group, dates, sources), claim count"},{"name":"indicator_check","description":"Check one domain (or its parent domains) or IPv4 address against ThreatCluster's high-confidence 30-day IOC feed: is it listed as attacker infrastructure (C2, p"},{"name":"indicator_batch_check","description":"Same as indicator_check for up to 100 domains or IPv4 addresses in one call (one flat price). Costs $0.25 USDC per call via x402 (payment goes in _meta[\"x402/pa"},{"name":"cve_status","description":"Free. CISA KEV status (date added, due date, known ransomware campaign use, required action), EPSS when known, and whether paid cve_intel detail is cached for t"},{"name":"cve_intel","description":"Everything an agent needs to prioritize one CVE: CVSS, affected vendors/products, vendor advisories, CISA KEV status and known ransomware use, EPSS, recorded pu"},{"name":"cve_batch_intel","description":"cve_intel for up to 50 CVEs in one call. Charged only if every CVE is cached; otherwise an error lists the ids with no data and the covered ids to retry with (n"},{"name":"group_intel","description":"Threat-hunting profile of one active ransomware group: total and recent leak-site listings with a momentum status, reported tools, malware, campaigns, ATT&CK te"},{"name":"coverage","description":"Free. Indicator-feed freshness and the CVE ids and ransomware groups currently cached for cve_intel and group_intel."},{"name":"watch_status","description":"Free. Status of a paid vendor watch (created with HTTP POST /v1/watch): items, expiry, last check, last webhook delivery."}],"toolCount":16,"toolsHash":"452946ee73b2b1e7c6e489209cb2a0c56ce5cc1f26b84653641022b2ef5bbd9e","serverName":"dragonseye","capabilities":["tools"],"serverVersion":"1.5.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-22T13:31:12.437Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":73,"error":null,"detail":{"tools":[{"name":"validate_query","description":"Free. Check and normalize a company name or domain before calling lookup_victim; tells you whether it will be searched as a domain or a name. Offline: no networ"},{"name":"pricing","description":"Free. Return the price of every paid tool, the payment network (Base) and address, the licensed data sources, and the 'unverified claim' label every result carr"},{"name":"lookup_victim","description":"Search ransomware leak-site claims for one company name or domain: has a group claimed it? Returns matching claims with group, claimed date, first-observed date"},{"name":"recent_claims","description":"List the newest ransomware leak-site claims (1-10), optionally filtered to one group such as akira or qilin. Use it to watch recent activity; use lookup_victim "},{"name":"group_profile","description":"Get a profile of one ransomware group: aliases, when RansomLook first observed it, and a sample of its newest claims. Use it to understand who a group is; use r"},{"name":"batch_exposure_check","description":"Check up to 25 vendor or supplier domains in one call for ransomware leak-site claims, for third-party-risk reviews. Returns one result per domain (found, claim"},{"name":"vendor_risk_report","description":"Build a third-party ransomware risk report for up to 100 vendors (domains or company names). For each vendor: matching leak-site claims (group, claimed and firs"},{"name":"bulk_vendor_check","description":"Check up to 100 vendors (domains or company names) for ransomware leak-site claims in one call: per vendor, matching claims (group, dates, sources), claim count"},{"name":"indicator_check","description":"Check one domain (or its parent domains) or IPv4 address against ThreatCluster's high-confidence 30-day IOC feed: is it listed as attacker infrastructure (C2, p"},{"name":"indicator_batch_check","description":"Same as indicator_check for up to 100 domains or IPv4 addresses in one call (one flat price). Costs $0.25 USDC per call via x402 (payment goes in _meta[\"x402/pa"},{"name":"cve_status","description":"Free. CISA KEV status (date added, due date, known ransomware campaign use, required action), EPSS when known, and whether paid cve_intel detail is cached for t"},{"name":"cve_intel","description":"Everything an agent needs to prioritize one CVE: CVSS, affected vendors/products, vendor advisories, CISA KEV status and known ransomware use, EPSS, recorded pu"},{"name":"cve_batch_intel","description":"cve_intel for up to 50 CVEs in one call. Charged only if every CVE is cached; otherwise an error lists the ids with no data and the covered ids to retry with (n"},{"name":"group_intel","description":"Threat-hunting profile of one active ransomware group: total and recent leak-site listings with a momentum status, reported tools, malware, campaigns, ATT&CK te"},{"name":"coverage","description":"Free. Indicator-feed freshness and the CVE ids and ransomware groups currently cached for cve_intel and group_intel."},{"name":"watch_status","description":"Free. Status of a paid vendor watch (created with HTTP POST /v1/watch): items, expiry, last check, last webhook delivery."}],"toolCount":16,"toolsHash":"452946ee73b2b1e7c6e489209cb2a0c56ce5cc1f26b84653641022b2ef5bbd9e","serverName":"dragonseye","capabilities":["tools"],"serverVersion":"1.5.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-22T07:28:14.331Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":69,"error":null,"detail":{"tools":[{"name":"validate_query","description":"Free. Check and normalize a company name or domain before calling lookup_victim; tells you whether it will be searched as a domain or a name. Offline: no networ"},{"name":"pricing","description":"Free. Return the price of every paid tool, the payment network (Base) and address, the licensed data sources, and the 'unverified claim' label every result carr"},{"name":"lookup_victim","description":"Search ransomware leak-site claims for one company name or domain: has a group claimed it? Returns matching claims with group, claimed date, first-observed date"},{"name":"recent_claims","description":"List the newest ransomware leak-site claims (1-10), optionally filtered to one group such as akira or qilin. Use it to watch recent activity; use lookup_victim "},{"name":"group_profile","description":"Get a profile of one ransomware group: aliases, when RansomLook first observed it, and a sample of its newest claims. Use it to understand who a group is; use r"},{"name":"batch_exposure_check","description":"Check up to 25 vendor or supplier domains in one call for ransomware leak-site claims, for third-party-risk reviews. Returns one result per domain (found, claim"},{"name":"vendor_risk_report","description":"Build a third-party ransomware risk report for up to 100 vendors (domains or company names). For each vendor: matching leak-site claims (group, claimed and firs"},{"name":"bulk_vendor_check","description":"Check up to 100 vendors (domains or company names) for ransomware leak-site claims in one call: per vendor, matching claims (group, dates, sources), claim count"},{"name":"indicator_check","description":"Check one domain (or its parent domains) or IPv4 address against ThreatCluster's high-confidence 30-day IOC feed: is it listed as attacker infrastructure (C2, p"},{"name":"indicator_batch_check","description":"Same as indicator_check for up to 100 domains or IPv4 addresses in one call (one flat price). Costs $0.25 USDC per call via x402 (payment goes in _meta[\"x402/pa"},{"name":"cve_status","description":"Free. CISA KEV status (date added, due date, known ransomware campaign use, required action), EPSS when known, and whether paid cve_intel detail is cached for t"},{"name":"cve_intel","description":"Everything an agent needs to prioritize one CVE: CVSS, affected vendors/products, vendor advisories, CISA KEV status and known ransomware use, EPSS, recorded pu"},{"name":"cve_batch_intel","description":"cve_intel for up to 50 CVEs in one call. Charged only if every CVE is cached; otherwise an error lists the ids with no data and the covered ids to retry with (n"},{"name":"group_intel","description":"Threat-hunting profile of one active ransomware group: total and recent leak-site listings with a momentum status, reported tools, malware, campaigns, ATT&CK te"},{"name":"coverage","description":"Free. Indicator-feed freshness and the CVE ids and ransomware groups currently cached for cve_intel and group_intel."},{"name":"watch_status","description":"Free. Status of a paid vendor watch (created with HTTP POST /v1/watch): items, expiry, last check, last webhook delivery."}],"toolCount":16,"toolsHash":"452946ee73b2b1e7c6e489209cb2a0c56ce5cc1f26b84653641022b2ef5bbd9e","serverName":"dragonseye","capabilities":["tools"],"serverVersion":"1.5.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-22T00:31:42.874Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":76,"error":null,"detail":{"tools":[{"name":"validate_query","description":"Free. Check and normalize a company name or domain before calling lookup_victim; tells you whether it will be searched as a domain or a name. Offline: no networ"},{"name":"pricing","description":"Free. Return the price of every paid tool, the payment network (Base) and address, the licensed data sources, and the 'unverified claim' label every result carr"},{"name":"lookup_victim","description":"Search ransomware leak-site claims for one company name or domain: has a group claimed it? Returns matching claims with group, claimed date, first-observed date"},{"name":"recent_claims","description":"List the newest ransomware leak-site claims (1-10), optionally filtered to one group such as akira or qilin. Use it to watch recent activity; use lookup_victim "},{"name":"group_profile","description":"Get a profile of one ransomware group: aliases, when RansomLook first observed it, and a sample of its newest claims. Use it to understand who a group is; use r"},{"name":"batch_exposure_check","description":"Check up to 25 vendor or supplier domains in one call for ransomware leak-site claims, for third-party-risk reviews. Returns one result per domain (found, claim"},{"name":"vendor_risk_report","description":"Build a third-party ransomware risk report for up to 100 vendors (domains or company names). For each vendor: matching leak-site claims (group, claimed and firs"},{"name":"bulk_vendor_check","description":"Check up to 100 vendors (domains or company names) for ransomware leak-site claims in one call: per vendor, matching claims (group, dates, sources), claim count"},{"name":"indicator_check","description":"Check one domain (or its parent domains) or IPv4 address against ThreatCluster's high-confidence 30-day IOC feed: is it listed as attacker infrastructure (C2, p"},{"name":"indicator_batch_check","description":"Same as indicator_check for up to 100 domains or IPv4 addresses in one call (one flat price). Costs $0.25 USDC per call via x402 (payment goes in _meta[\"x402/pa"},{"name":"cve_status","description":"Free. CISA KEV status (date added, due date, known ransomware campaign use, required action), EPSS when known, and whether paid cve_intel detail is cached for t"},{"name":"cve_intel","description":"Everything an agent needs to prioritize one CVE: CVSS, affected vendors/products, vendor advisories, CISA KEV status and known ransomware use, EPSS, recorded pu"},{"name":"cve_batch_intel","description":"cve_intel for up to 50 CVEs in one call. Charged only if every CVE is cached; otherwise an error lists the ids with no data and the covered ids to retry with (n"},{"name":"group_intel","description":"Threat-hunting profile of one active ransomware group: total and recent leak-site listings with a momentum status, reported tools, malware, campaigns, ATT&CK te"},{"name":"coverage","description":"Free. Indicator-feed freshness and the CVE ids and ransomware groups currently cached for cve_intel and group_intel."},{"name":"watch_status","description":"Free. Status of a paid vendor watch (created with HTTP POST /v1/watch): items, expiry, last check, last webhook delivery."}],"toolCount":16,"toolsHash":"452946ee73b2b1e7c6e489209cb2a0c56ce5cc1f26b84653641022b2ef5bbd9e","serverName":"dragonseye","capabilities":["tools"],"serverVersion":"1.5.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-21T17:34:38.589Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":96,"error":null,"detail":{"tools":[{"name":"validate_query","description":"Free. Check and normalize a company name or domain before calling lookup_victim; tells you whether it will be searched as a domain or a name. Offline: no networ"},{"name":"pricing","description":"Free. Return the price of every paid tool, the payment network (Base) and address, the licensed data sources, and the 'unverified claim' label every result carr"},{"name":"lookup_victim","description":"Search ransomware leak-site claims for one company name or domain: has a group claimed it? Returns matching claims with group, claimed date, first-observed date"},{"name":"recent_claims","description":"List the newest ransomware leak-site claims (1-10), optionally filtered to one group such as akira or qilin. Use it to watch recent activity; use lookup_victim "},{"name":"group_profile","description":"Get a profile of one ransomware group: aliases, when RansomLook first observed it, and a sample of its newest claims. Use it to understand who a group is; use r"},{"name":"batch_exposure_check","description":"Check up to 25 vendor or supplier domains in one call for ransomware leak-site claims, for third-party-risk reviews. Returns one result per domain (found, claim"},{"name":"vendor_risk_report","description":"Build a third-party ransomware risk report for up to 100 vendors (domains or company names). For each vendor: matching leak-site claims (group, claimed and firs"},{"name":"bulk_vendor_check","description":"Check up to 100 vendors (domains or company names) for ransomware leak-site claims in one call: per vendor, matching claims (group, dates, sources), claim count"},{"name":"indicator_check","description":"Check one domain (or its parent domains) or IPv4 address against ThreatCluster's high-confidence 30-day IOC feed: is it listed as attacker infrastructure (C2, p"},{"name":"indicator_batch_check","description":"Same as indicator_check for up to 100 domains or IPv4 addresses in one call (one flat price). Costs $0.25 USDC per call via x402 (payment goes in _meta[\"x402/pa"},{"name":"cve_status","description":"Free. CISA KEV status (date added, due date, known ransomware campaign use, required action), EPSS when known, and whether paid cve_intel detail is cached for t"},{"name":"cve_intel","description":"Everything an agent needs to prioritize one CVE: CVSS, affected vendors/products, vendor advisories, CISA KEV status and known ransomware use, EPSS, recorded pu"},{"name":"cve_batch_intel","description":"cve_intel for up to 50 CVEs in one call. Charged only if every CVE is cached; otherwise an error lists the ids with no data and the covered ids to retry with (n"},{"name":"group_intel","description":"Threat-hunting profile of one active ransomware group: total and recent leak-site listings with a momentum status, reported tools, malware, campaigns, ATT&CK te"},{"name":"coverage","description":"Free. Indicator-feed freshness and the CVE ids and ransomware groups currently cached for cve_intel and group_intel."},{"name":"watch_status","description":"Free. Status of a paid vendor watch (created with HTTP POST /v1/watch): items, expiry, last check, last webhook delivery."}],"toolCount":16,"toolsHash":"452946ee73b2b1e7c6e489209cb2a0c56ce5cc1f26b84653641022b2ef5bbd9e","serverName":"dragonseye","capabilities":["tools"],"serverVersion":"1.5.0","protocolVersion":"2025-06-18"}}],"tools":[{"name":"validate_query","description":"Free. Check and normalize a company name or domain before calling lookup_victim; tells you whether it will be searched as a domain or a name. Offline: no networ"},{"name":"pricing","description":"Free. Return the price of every paid tool, the payment network (Base) and address, the licensed data sources, and the 'unverified claim' label every result carr"},{"name":"lookup_victim","description":"Search ransomware leak-site claims for one company name or domain: has a group claimed it? Returns matching claims with group, claimed date, first-observed date"},{"name":"recent_claims","description":"List the newest ransomware leak-site claims (1-10), optionally filtered to one group such as akira or qilin. Use it to watch recent activity; use lookup_victim "},{"name":"group_profile","description":"Get a profile of one ransomware group: aliases, when RansomLook first observed it, and a sample of its newest claims. Use it to understand who a group is; use r"},{"name":"batch_exposure_check","description":"Check up to 25 vendor or supplier domains in one call for ransomware leak-site claims, for third-party-risk reviews. Returns one result per domain (found, claim"},{"name":"vendor_risk_report","description":"Build a third-party ransomware risk report for up to 100 vendors (domains or company names). For each vendor: matching leak-site claims (group, claimed and firs"},{"name":"bulk_vendor_check","description":"Check up to 100 vendors (domains or company names) for ransomware leak-site claims in one call: per vendor, matching claims (group, dates, sources), claim count"},{"name":"indicator_check","description":"Check one domain (or its parent domains) or IPv4 address against ThreatCluster's high-confidence 30-day IOC feed: is it listed as attacker infrastructure (C2, p"},{"name":"indicator_batch_check","description":"Same as indicator_check for up to 100 domains or IPv4 addresses in one call (one flat price). Costs $0.25 USDC per call via x402 (payment goes in _meta[\"x402/pa"},{"name":"cve_status","description":"Free. CISA KEV status (date added, due date, known ransomware campaign use, required action), EPSS when known, and whether paid cve_intel detail is cached for t"},{"name":"cve_intel","description":"Everything an agent needs to prioritize one CVE: CVSS, affected vendors/products, vendor advisories, CISA KEV status and known ransomware use, EPSS, recorded pu"},{"name":"cve_batch_intel","description":"cve_intel for up to 50 CVEs in one call. Charged only if every CVE is cached; otherwise an error lists the ids with no data and the covered ids to retry with (n"},{"name":"group_intel","description":"Threat-hunting profile of one active ransomware group: total and recent leak-site listings with a momentum status, reported tools, malware, campaigns, ATT&CK te"},{"name":"coverage","description":"Free. Indicator-feed freshness and the CVE ids and ransomware groups currently cached for cve_intel and group_intel."},{"name":"watch_status","description":"Free. Status of a paid vendor watch (created with HTTP POST /v1/watch): items, expiry, last check, last webhook delivery."}],"package":null,"toolSurface":{"id":"ts_fu3kax2xq94s","endpointId":"ep_hhtsqvyzx86v","hash":"452946ee73b2b1e7c6e489209cb2a0c56ce5cc1f26b84653641022b2ef5bbd9e","toolCount":16,"serverName":"dragonseye","serverVersion":"1.5.0","protocolVersion":"2025-06-18","firstSeenAt":"2026-10-17T23:29:21.040Z","lastSeenAt":"2026-10-24T06:27:04.799Z","observations":23,"toolNames":["validate_query","pricing","lookup_victim","recent_claims","group_profile","batch_exposure_check","vendor_risk_report","bulk_vendor_check","indicator_check","indicator_batch_check","cve_status","cve_intel","cve_batch_intel","group_intel","coverage","watch_status"],"distinctSurfaces":7},"endpointFacts":[{"id":"ep_hhtsqvyzx86v","url":"https://api.ransomware-tracker.com/mcp","type":"mcp_streamable_http","factsCheckedAt":"2026-10-23T03:22:29.626Z","auth":{"observedAt":"2026-10-23T03:22:29.661Z","authRequired":false,"scheme":null,"resourceMetadata":null,"authorizationServer":null,"conformance":{"dpop":false,"rfc8414":false,"rfc9728":false,"pkceS256":false,"clientIdMetadataDocument":false,"dynamicClientRegistration":false}},"tls":{"observedAt":"2026-10-23T03:22:29.676Z","protocol":"TLSv1.3","chainValid":true,"chainError":null,"hostMatches":true,"subject":"ransomware-tracker.com","issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validFrom":"2026-10-10T05:19:56.000Z","validTo":"2027-01-08T06:19:36.000Z","daysToExpiry":75,"sanCount":3,"fingerprint256":"8F:09:B8:DA:5A:DC:63:C1:7D:34:FF:3F:FB:6E:3B:18:4A:0B:95:E6:80:48:AF:FA:F1:28:93:84:80:BD:8D:E9"}}]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"mcp_registry","key":"com.ransomware-tracker.api/dragonseye","url":"https://registry.modelcontextprotocol.io/v0/servers/com.ransomware-tracker.api%2Fdragonseye","firstSeenAt":"2026-10-12T07:18:31.328Z","fetchedAt":"2026-10-22T01:22:51.198Z","normalizedAt":"2026-10-22T01:22:51.198Z"}]},"firstSeenAt":"2026-10-12T07:18:31.328Z","updatedAt":"2026-10-24T06:31:42.534Z"}