A comprehensive threat intelligence aggregation MCP server
Listed on its own since 2026-09-25. Until then it was part of cyber-sentinel-mcp, where its earlier checks remain.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"iflow-mcp-jx888-max-cyber-sentinel-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# 🛡️ Cyber Sentinel MCP Server A comprehensive threat intelligence aggregation MCP (Model Context Protocol) server that provides unified access to multiple threat intelligence sources for security analysis. ## 🎯 Overview Cyber Sentinel eliminates the tedious manual process of querying multiple threat intelligence sources by providing a single, unified interface. Security analysts can now analyze indicators (IPs, domains, hashes, URLs) across multiple sources with a single command, getting aggregated results with confidence scoring. ## ✨ Features ### 🔍 Threat Intelligence - **Multi-Source Intelligence**: Aggregates data from VirusTotal v3, AbuseIPDB, URLhaus, Shodan, ThreatFox, and MalwareBazaar - **Smart Indicator Detection**: Automatically detects IP addresses, domains, file hashes, and URLs - **Intelligent Aggregation**: Combines results from multiple sources with confidence scoring - **Async Performance**: High-performance concurrent processing - **Smart Caching**: Reduces API calls and improves response times (1-hour TTL) - **Rate Limiting**: Respects API limits across all sources (60 req/min default) - **Error Recovery**: Graceful handling of API failures and timeouts ### 🛡️ Code Security Analysis - **Multi-Language Support**: Analyzes Python, JavaScript, Java, C#, PHP, Go, Rust, C++, and SQL code - **Vulnerability Detection**: Identifies hardcoded secrets, SQL injection, XSS, path traversal, and more - **Network Indicator Analysis**: Extracts and analyzes IPs, domains, and URLs found in code - **Secure Alternatives**: Provides secure coding recommendations and alternatives - **Risk Scoring**: Calculates comprehensive security risk scores ### 📦 Dependency Security - **Multi-Platform Support**: Scans NPM, Python, Maven, Cargo, Go, and Composer dependencies - **Vulnerability Detection**: Identifies known malicious packages and outdated dependencies - **Security Recommendations**: Provides actionable security improvement suggestions - **Risk Assessmen…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.