{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_as4e3ug9xw2c","handle":"nullcone-threat-intelligence","url":"https://wellknown.network/agents/nullcone-threat-intelligence","links":{"self":"https://wellknown.network/agents/nullcone-threat-intelligence/record.json","html":"https://wellknown.network/agents/nullcone-threat-intelligence","markdown":"https://wellknown.network/agents/nullcone-threat-intelligence/record.md","api":"https://wellknown.network/api/v1/agents/nullcone-threat-intelligence","status":"https://wellknown.network/api/v1/agents/nullcone-threat-intelligence/status","claim":"https://wellknown.network/agents/nullcone-threat-intelligence/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/nullcone-threat-intelligence/claim.json","badge":"https://wellknown.network/agents/nullcone-threat-intelligence/badge.svg","openapi":"https://wellknown.network/openapi.json"},"ard":{"identifier":"urn:air:nullcone.ai:server:nullcone-threat-intelligence","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"Nullcone Threat Intelligence","summary":"Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats","description":"Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats","publisher":{"name":"maco144","url":null},"homepage":"https://nullcone.ai","repository":"https://github.com/maco144/nullcone-mcp","version":"0.1.0","license":null,"protocols":["mcp"],"tags":[],"pricing":null,"endpoints":[{"url":"https://nullcone.ai/mcp","type":"mcp_streamable_http","auth":null,"probeable":true}],"skills":null,"tools":null,"extra":{"updatedAt":"2026-06-06T11:42:32.019523Z","publishedAt":"2026-06-06T11:42:32.019523Z","registryName":"io.github.maco144/nullcone"},"attribution":{"kind":"mcp_registry","name":"mcp_registry","repoUrl":"mcp_registry","summary":"mcp_registry","version":"mcp_registry","description":"mcp_registry","homepageUrl":"mcp_registry","publisherName":"mcp_registry"}},"derived":{"capabilities":[{"slug":"ai.prompting","name":"Prompt Management","confidence":1,"provenance":"derived"},{"slug":"dev.monitoring","name":"Monitoring & Observability","confidence":0.554,"provenance":"derived"},{"slug":"data.database","name":"Databases","confidence":0.525,"provenance":"derived"},{"slug":"code.execution","name":"Code Execution","confidence":0.51,"provenance":"derived"}],"categories":["ai","code","data","dev"]},"observed":{"status":"live","statusReason":"Responded 7h ago.","lastOkAt":"2026-09-07T23:24:25.142Z","lastProbedAt":"2026-09-07T23:24:25.142Z","statusComputedAt":"2026-09-07T23:34:38.333Z","reliability30d":{"probes":4,"successRate":1,"p50Ms":92},"latestObservations":[{"at":"2026-09-08T06:24:21.363Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":120,"error":null,"detail":{"tools":[{"name":"submit_ioc","description":"\n    Submit a threat indicator (IOC) to the shared intelligence network.\n\n    The IOC is automatically classified into a malware family, metadata is\n    compres"},{"name":"submit_batch","description":"\n    Submit multiple IOCs in a single call. Preferred over looping submit_ioc\n    for bulk ingest from honeypots, sandboxes, or feed processing.\n\n    Each dict "},{"name":"lookup_ioc","description":"\n    Look up a threat signature by its exact IOC value.\n\n    Returns the full signature record if found, including severity, family,\n    detection count, and fa"},{"name":"recent_threats","description":"\n    Return the most recently observed threat signatures.\n\n    Args:\n        limit:        Max number of results to return (1-200)\n        min_severity: Minimum"},{"name":"family_threats","description":"\n    Return all threat signatures associated with a known malware family.\n\n    Use list_families() first to discover available family names.\n\n    Args:\n        "},{"name":"list_families","description":"\n    Return all known malware families in the intelligence database.\n\n    Each entry includes the family name, description, and category. Use\n    family_threats"},{"name":"search_by_type","description":"\n    Return threat signatures filtered by IOC type.\n\n    Useful for pulling all known-bad IPs, all malicious domains, all\n    malicious AI skill hashes, etc.\n\n "},{"name":"report_detection","description":"\n    Report that you detected and acted on a known threat signature.\n\n    Increments the signature's detection count and creates a ThreatEvent\n    visible to al"},{"name":"vote_false_positive","description":"\n    Flag a threat signature as a likely false positive.\n\n    When more than 20% of agents vote false positive on a signature,\n    its `is_likely_fp` flag becom"},{"name":"poll_since","description":"\n    Fetch new threat signatures since a high-water mark ID. This is the\n    recommended sync pattern — one call, get new data, persist next_id,\n    disconnect."},{"name":"get_stats","description":"\n    Return aggregate statistics for the threat intelligence database.\n\n    Includes total signatures, known malware families, active agents,\n    and total dete"},{"name":"validate_skill","description":"\n    Synchronous SKILL IOC lookup — call this before loading or invoking any\n    MCP tool/skill to check it against the Nullcone threat feed.\n\n    This is the p"},{"name":"scan_skill_content","description":"\n    Pre-execution content scan for skill/instruction files.\n\n    Analyzes the full text of a skill (markdown, plain text, SKILL.md, etc.)\n    for malicious pat"},{"name":"get_new_threats","description":"\n    Drain the live push-subscription buffer of threats received since the\n    last call. Zero-polling — threats are delivered via SpacetimeDB WebSocket\n    sub"},{"name":"warm_prompt_cache","description":"\n    Load all PROMPT IOCs from SpacetimeDB into the in-memory hash set.\n\n    Call once at startup (or after a major feed update) to populate the\n    sub-1ms que"},{"name":"check_prompt","description":"\n    Check a prompt or text fragment for known PROMPT IOC patterns.\n\n    Uses an in-memory hash set for sub-1ms token-level querying — no\n    network calls afte"},{"name":"check_prompt_batch","description":"\n    Check multiple prompts for PROMPT IOC patterns in a single call.\n\n    More efficient than calling check_prompt() in a loop — tokenization\n    overhead is a"},{"name":"prompt_cache_stats","description":"\n    Return PROMPT IOC cache statistics: size, hit rate, latency, refresh status.\n\n    Use this to verify the cache is warmed and healthy before relying on\n    "},{"name":"check_freshness","description":"\n    Validate that IOC threat intelligence is fresh enough for the named action.\n\n    Call this before any high-risk agent action to ensure the TI snapshot\n    "},{"name":"freshness_limits","description":"\n    Return the configured IOC freshness limits for all action tiers.\n\n    Shows max staleness, warn threshold, and which actions belong to each tier.\n    Use t"},{"name":"fingerprint_tool_metadata","description":"\n    Analyze an MCP tool definition for instruction-injection and malicious patterns.\n\n    Performs semantic fingerprinting of the tool's description, parameter"},{"name":"registry_monitor_stats","description":"\n    Return MCP registry monitoring statistics.\n\n    Shows how many tool definitions are tracked, how many have been flagged,\n    and the current drift detectio"},{"name":"registry_flagged_tools","description":"\n    Return all MCP tools that have been flagged as suspicious or malicious.\n\n    Includes tools flagged on initial ingestion (high-risk fingerprint)\n    and to"},{"name":"subscribe_threats","description":"\n    Open a named, stateful subscription to live threat push delivery.\n\n    Returns a subscription_id. Pass it to drain_subscription() to collect\n    the IOCs t"},{"name":"drain_subscription","description":"\n    Drain the buffer of a stateful subscription created by subscribe_threats().\n\n    Returns all IOCs delivered to this subscription since the last drain.\n    "},{"name":"unsubscribe","description":"\n    Cancel a stateful subscription and free its buffer.\n\n    Call this when you no longer need the subscription to release memory.\n    Subscriptions also auto-"},{"name":"list_subscriptions","description":"\n    List all active stateful push subscriptions on this MCP server instance.\n\n    Returns metadata for each subscription (not the buffered IOCs themselves).\n  "},{"name":"revoke_ioc","description":"\n    Revoke an IOC by its value hash, pushing the expiration event to all\n    active subscriptions in real-time.\n\n    Call this when an IOC is determined to be "},{"name":"is_ioc_revoked","description":"\n    Check whether an IOC has been revoked. O(1) in-process lookup.\n\n    Use this before acting on any cached threat intelligence to ensure the\n    IOC has not "},{"name":"list_revocations","description":"\n    List recent IOC revocations, newest first.\n\n    Args:\n        limit:       Maximum number of revocations to return (default 50).\n        since_hours: Only "}],"toolCount":30,"serverName":"Nullcone Threat Intelligence","capabilities":["experimental","prompts","resources","tools"],"serverVersion":"1.29.0","protocolVersion":"2025-06-18"}},{"at":"2026-09-07T23:24:25.142Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":90,"error":null,"detail":{"tools":[{"name":"submit_ioc","description":"\n    Submit a threat indicator (IOC) to the shared intelligence network.\n\n    The IOC is automatically classified into a malware family, metadata is\n    compres"},{"name":"submit_batch","description":"\n    Submit multiple IOCs in a single call. Preferred over looping submit_ioc\n    for bulk ingest from honeypots, sandboxes, or feed processing.\n\n    Each dict "},{"name":"lookup_ioc","description":"\n    Look up a threat signature by its exact IOC value.\n\n    Returns the full signature record if found, including severity, family,\n    detection count, and fa"},{"name":"recent_threats","description":"\n    Return the most recently observed threat signatures.\n\n    Args:\n        limit:        Max number of results to return (1-200)\n        min_severity: Minimum"},{"name":"family_threats","description":"\n    Return all threat signatures associated with a known malware family.\n\n    Use list_families() first to discover available family names.\n\n    Args:\n        "},{"name":"list_families","description":"\n    Return all known malware families in the intelligence database.\n\n    Each entry includes the family name, description, and category. Use\n    family_threats"},{"name":"search_by_type","description":"\n    Return threat signatures filtered by IOC type.\n\n    Useful for pulling all known-bad IPs, all malicious domains, all\n    malicious AI skill hashes, etc.\n\n "},{"name":"report_detection","description":"\n    Report that you detected and acted on a known threat signature.\n\n    Increments the signature's detection count and creates a ThreatEvent\n    visible to al"},{"name":"vote_false_positive","description":"\n    Flag a threat signature as a likely false positive.\n\n    When more than 20% of agents vote false positive on a signature,\n    its `is_likely_fp` flag becom"},{"name":"poll_since","description":"\n    Fetch new threat signatures since a high-water mark ID. This is the\n    recommended sync pattern — one call, get new data, persist next_id,\n    disconnect."},{"name":"get_stats","description":"\n    Return aggregate statistics for the threat intelligence database.\n\n    Includes total signatures, known malware families, active agents,\n    and total dete"},{"name":"validate_skill","description":"\n    Synchronous SKILL IOC lookup — call this before loading or invoking any\n    MCP tool/skill to check it against the Nullcone threat feed.\n\n    This is the p"},{"name":"scan_skill_content","description":"\n    Pre-execution content scan for skill/instruction files.\n\n    Analyzes the full text of a skill (markdown, plain text, SKILL.md, etc.)\n    for malicious pat"},{"name":"get_new_threats","description":"\n    Drain the live push-subscription buffer of threats received since the\n    last call. Zero-polling — threats are delivered via SpacetimeDB WebSocket\n    sub"},{"name":"warm_prompt_cache","description":"\n    Load all PROMPT IOCs from SpacetimeDB into the in-memory hash set.\n\n    Call once at startup (or after a major feed update) to populate the\n    sub-1ms que"},{"name":"check_prompt","description":"\n    Check a prompt or text fragment for known PROMPT IOC patterns.\n\n    Uses an in-memory hash set for sub-1ms token-level querying — no\n    network calls afte"},{"name":"check_prompt_batch","description":"\n    Check multiple prompts for PROMPT IOC patterns in a single call.\n\n    More efficient than calling check_prompt() in a loop — tokenization\n    overhead is a"},{"name":"prompt_cache_stats","description":"\n    Return PROMPT IOC cache statistics: size, hit rate, latency, refresh status.\n\n    Use this to verify the cache is warmed and healthy before relying on\n    "},{"name":"check_freshness","description":"\n    Validate that IOC threat intelligence is fresh enough for the named action.\n\n    Call this before any high-risk agent action to ensure the TI snapshot\n    "},{"name":"freshness_limits","description":"\n    Return the configured IOC freshness limits for all action tiers.\n\n    Shows max staleness, warn threshold, and which actions belong to each tier.\n    Use t"},{"name":"fingerprint_tool_metadata","description":"\n    Analyze an MCP tool definition for instruction-injection and malicious patterns.\n\n    Performs semantic fingerprinting of the tool's description, parameter"},{"name":"registry_monitor_stats","description":"\n    Return MCP registry monitoring statistics.\n\n    Shows how many tool definitions are tracked, how many have been flagged,\n    and the current drift detectio"},{"name":"registry_flagged_tools","description":"\n    Return all MCP tools that have been flagged as suspicious or malicious.\n\n    Includes tools flagged on initial ingestion (high-risk fingerprint)\n    and to"},{"name":"subscribe_threats","description":"\n    Open a named, stateful subscription to live threat push delivery.\n\n    Returns a subscription_id. Pass it to drain_subscription() to collect\n    the IOCs t"},{"name":"drain_subscription","description":"\n    Drain the buffer of a stateful subscription created by subscribe_threats().\n\n    Returns all IOCs delivered to this subscription since the last drain.\n    "},{"name":"unsubscribe","description":"\n    Cancel a stateful subscription and free its buffer.\n\n    Call this when you no longer need the subscription to release memory.\n    Subscriptions also auto-"},{"name":"list_subscriptions","description":"\n    List all active stateful push subscriptions on this MCP server instance.\n\n    Returns metadata for each subscription (not the buffered IOCs themselves).\n  "},{"name":"revoke_ioc","description":"\n    Revoke an IOC by its value hash, pushing the expiration event to all\n    active subscriptions in real-time.\n\n    Call this when an IOC is determined to be "},{"name":"is_ioc_revoked","description":"\n    Check whether an IOC has been revoked. O(1) in-process lookup.\n\n    Use this before acting on any cached threat intelligence to ensure the\n    IOC has not "},{"name":"list_revocations","description":"\n    List recent IOC revocations, newest first.\n\n    Args:\n        limit:       Maximum number of revocations to return (default 50).\n        since_hours: Only "}],"toolCount":30,"serverName":"Nullcone Threat Intelligence","capabilities":["experimental","prompts","resources","tools"],"serverVersion":"1.29.0","protocolVersion":"2025-06-18"}},{"at":"2026-09-07T16:25:36.596Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":90,"error":null,"detail":{"tools":[{"name":"submit_ioc","description":"\n    Submit a threat indicator (IOC) to the shared intelligence network.\n\n    The IOC is automatically classified into a malware family, metadata is\n    compres"},{"name":"submit_batch","description":"\n    Submit multiple IOCs in a single call. Preferred over looping submit_ioc\n    for bulk ingest from honeypots, sandboxes, or feed processing.\n\n    Each dict "},{"name":"lookup_ioc","description":"\n    Look up a threat signature by its exact IOC value.\n\n    Returns the full signature record if found, including severity, family,\n    detection count, and fa"},{"name":"recent_threats","description":"\n    Return the most recently observed threat signatures.\n\n    Args:\n        limit:        Max number of results to return (1-200)\n        min_severity: Minimum"},{"name":"family_threats","description":"\n    Return all threat signatures associated with a known malware family.\n\n    Use list_families() first to discover available family names.\n\n    Args:\n        "},{"name":"list_families","description":"\n    Return all known malware families in the intelligence database.\n\n    Each entry includes the family name, description, and category. Use\n    family_threats"},{"name":"search_by_type","description":"\n    Return threat signatures filtered by IOC type.\n\n    Useful for pulling all known-bad IPs, all malicious domains, all\n    malicious AI skill hashes, etc.\n\n "},{"name":"report_detection","description":"\n    Report that you detected and acted on a known threat signature.\n\n    Increments the signature's detection count and creates a ThreatEvent\n    visible to al"},{"name":"vote_false_positive","description":"\n    Flag a threat signature as a likely false positive.\n\n    When more than 20% of agents vote false positive on a signature,\n    its `is_likely_fp` flag becom"},{"name":"poll_since","description":"\n    Fetch new threat signatures since a high-water mark ID. This is the\n    recommended sync pattern — one call, get new data, persist next_id,\n    disconnect."},{"name":"get_stats","description":"\n    Return aggregate statistics for the threat intelligence database.\n\n    Includes total signatures, known malware families, active agents,\n    and total dete"},{"name":"validate_skill","description":"\n    Synchronous SKILL IOC lookup — call this before loading or invoking any\n    MCP tool/skill to check it against the Nullcone threat feed.\n\n    This is the p"},{"name":"scan_skill_content","description":"\n    Pre-execution content scan for skill/instruction files.\n\n    Analyzes the full text of a skill (markdown, plain text, SKILL.md, etc.)\n    for malicious pat"},{"name":"get_new_threats","description":"\n    Drain the live push-subscription buffer of threats received since the\n    last call. Zero-polling — threats are delivered via SpacetimeDB WebSocket\n    sub"},{"name":"warm_prompt_cache","description":"\n    Load all PROMPT IOCs from SpacetimeDB into the in-memory hash set.\n\n    Call once at startup (or after a major feed update) to populate the\n    sub-1ms que"},{"name":"check_prompt","description":"\n    Check a prompt or text fragment for known PROMPT IOC patterns.\n\n    Uses an in-memory hash set for sub-1ms token-level querying — no\n    network calls afte"},{"name":"check_prompt_batch","description":"\n    Check multiple prompts for PROMPT IOC patterns in a single call.\n\n    More efficient than calling check_prompt() in a loop — tokenization\n    overhead is a"},{"name":"prompt_cache_stats","description":"\n    Return PROMPT IOC cache statistics: size, hit rate, latency, refresh status.\n\n    Use this to verify the cache is warmed and healthy before relying on\n    "},{"name":"check_freshness","description":"\n    Validate that IOC threat intelligence is fresh enough for the named action.\n\n    Call this before any high-risk agent action to ensure the TI snapshot\n    "},{"name":"freshness_limits","description":"\n    Return the configured IOC freshness limits for all action tiers.\n\n    Shows max staleness, warn threshold, and which actions belong to each tier.\n    Use t"},{"name":"fingerprint_tool_metadata","description":"\n    Analyze an MCP tool definition for instruction-injection and malicious patterns.\n\n    Performs semantic fingerprinting of the tool's description, parameter"},{"name":"registry_monitor_stats","description":"\n    Return MCP registry monitoring statistics.\n\n    Shows how many tool definitions are tracked, how many have been flagged,\n    and the current drift detectio"},{"name":"registry_flagged_tools","description":"\n    Return all MCP tools that have been flagged as suspicious or malicious.\n\n    Includes tools flagged on initial ingestion (high-risk fingerprint)\n    and to"},{"name":"subscribe_threats","description":"\n    Open a named, stateful subscription to live threat push delivery.\n\n    Returns a subscription_id. Pass it to drain_subscription() to collect\n    the IOCs t"},{"name":"drain_subscription","description":"\n    Drain the buffer of a stateful subscription created by subscribe_threats().\n\n    Returns all IOCs delivered to this subscription since the last drain.\n    "},{"name":"unsubscribe","description":"\n    Cancel a stateful subscription and free its buffer.\n\n    Call this when you no longer need the subscription to release memory.\n    Subscriptions also auto-"},{"name":"list_subscriptions","description":"\n    List all active stateful push subscriptions on this MCP server instance.\n\n    Returns metadata for each subscription (not the buffered IOCs themselves).\n  "},{"name":"revoke_ioc","description":"\n    Revoke an IOC by its value hash, pushing the expiration event to all\n    active subscriptions in real-time.\n\n    Call this when an IOC is determined to be "},{"name":"is_ioc_revoked","description":"\n    Check whether an IOC has been revoked. O(1) in-process lookup.\n\n    Use this before acting on any cached threat intelligence to ensure the\n    IOC has not "},{"name":"list_revocations","description":"\n    List recent IOC revocations, newest first.\n\n    Args:\n        limit:       Maximum number of revocations to return (default 50).\n        since_hours: Only "}],"toolCount":30,"serverName":"Nullcone Threat Intelligence","capabilities":["experimental","prompts","resources","tools"],"serverVersion":"1.29.0","protocolVersion":"2025-06-18"}},{"at":"2026-09-07T09:29:14.369Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":114,"error":null,"detail":{"tools":[{"name":"submit_ioc","description":"\n    Submit a threat indicator (IOC) to the shared intelligence network.\n\n    The IOC is automatically classified into a malware family, metadata is\n    compres"},{"name":"submit_batch","description":"\n    Submit multiple IOCs in a single call. Preferred over looping submit_ioc\n    for bulk ingest from honeypots, sandboxes, or feed processing.\n\n    Each dict "},{"name":"lookup_ioc","description":"\n    Look up a threat signature by its exact IOC value.\n\n    Returns the full signature record if found, including severity, family,\n    detection count, and fa"},{"name":"recent_threats","description":"\n    Return the most recently observed threat signatures.\n\n    Args:\n        limit:        Max number of results to return (1-200)\n        min_severity: Minimum"},{"name":"family_threats","description":"\n    Return all threat signatures associated with a known malware family.\n\n    Use list_families() first to discover available family names.\n\n    Args:\n        "},{"name":"list_families","description":"\n    Return all known malware families in the intelligence database.\n\n    Each entry includes the family name, description, and category. Use\n    family_threats"},{"name":"search_by_type","description":"\n    Return threat signatures filtered by IOC type.\n\n    Useful for pulling all known-bad IPs, all malicious domains, all\n    malicious AI skill hashes, etc.\n\n "},{"name":"report_detection","description":"\n    Report that you detected and acted on a known threat signature.\n\n    Increments the signature's detection count and creates a ThreatEvent\n    visible to al"},{"name":"vote_false_positive","description":"\n    Flag a threat signature as a likely false positive.\n\n    When more than 20% of agents vote false positive on a signature,\n    its `is_likely_fp` flag becom"},{"name":"poll_since","description":"\n    Fetch new threat signatures since a high-water mark ID. This is the\n    recommended sync pattern — one call, get new data, persist next_id,\n    disconnect."},{"name":"get_stats","description":"\n    Return aggregate statistics for the threat intelligence database.\n\n    Includes total signatures, known malware families, active agents,\n    and total dete"},{"name":"validate_skill","description":"\n    Synchronous SKILL IOC lookup — call this before loading or invoking any\n    MCP tool/skill to check it against the Nullcone threat feed.\n\n    This is the p"},{"name":"scan_skill_content","description":"\n    Pre-execution content scan for skill/instruction files.\n\n    Analyzes the full text of a skill (markdown, plain text, SKILL.md, etc.)\n    for malicious pat"},{"name":"get_new_threats","description":"\n    Drain the live push-subscription buffer of threats received since the\n    last call. Zero-polling — threats are delivered via SpacetimeDB WebSocket\n    sub"},{"name":"warm_prompt_cache","description":"\n    Load all PROMPT IOCs from SpacetimeDB into the in-memory hash set.\n\n    Call once at startup (or after a major feed update) to populate the\n    sub-1ms que"},{"name":"check_prompt","description":"\n    Check a prompt or text fragment for known PROMPT IOC patterns.\n\n    Uses an in-memory hash set for sub-1ms token-level querying — no\n    network calls afte"},{"name":"check_prompt_batch","description":"\n    Check multiple prompts for PROMPT IOC patterns in a single call.\n\n    More efficient than calling check_prompt() in a loop — tokenization\n    overhead is a"},{"name":"prompt_cache_stats","description":"\n    Return PROMPT IOC cache statistics: size, hit rate, latency, refresh status.\n\n    Use this to verify the cache is warmed and healthy before relying on\n    "},{"name":"check_freshness","description":"\n    Validate that IOC threat intelligence is fresh enough for the named action.\n\n    Call this before any high-risk agent action to ensure the TI snapshot\n    "},{"name":"freshness_limits","description":"\n    Return the configured IOC freshness limits for all action tiers.\n\n    Shows max staleness, warn threshold, and which actions belong to each tier.\n    Use t"},{"name":"fingerprint_tool_metadata","description":"\n    Analyze an MCP tool definition for instruction-injection and malicious patterns.\n\n    Performs semantic fingerprinting of the tool's description, parameter"},{"name":"registry_monitor_stats","description":"\n    Return MCP registry monitoring statistics.\n\n    Shows how many tool definitions are tracked, how many have been flagged,\n    and the current drift detectio"},{"name":"registry_flagged_tools","description":"\n    Return all MCP tools that have been flagged as suspicious or malicious.\n\n    Includes tools flagged on initial ingestion (high-risk fingerprint)\n    and to"},{"name":"subscribe_threats","description":"\n    Open a named, stateful subscription to live threat push delivery.\n\n    Returns a subscription_id. Pass it to drain_subscription() to collect\n    the IOCs t"},{"name":"drain_subscription","description":"\n    Drain the buffer of a stateful subscription created by subscribe_threats().\n\n    Returns all IOCs delivered to this subscription since the last drain.\n    "},{"name":"unsubscribe","description":"\n    Cancel a stateful subscription and free its buffer.\n\n    Call this when you no longer need the subscription to release memory.\n    Subscriptions also auto-"},{"name":"list_subscriptions","description":"\n    List all active stateful push subscriptions on this MCP server instance.\n\n    Returns metadata for each subscription (not the buffered IOCs themselves).\n  "},{"name":"revoke_ioc","description":"\n    Revoke an IOC by its value hash, pushing the expiration event to all\n    active subscriptions in real-time.\n\n    Call this when an IOC is determined to be "},{"name":"is_ioc_revoked","description":"\n    Check whether an IOC has been revoked. O(1) in-process lookup.\n\n    Use this before acting on any cached threat intelligence to ensure the\n    IOC has not "},{"name":"list_revocations","description":"\n    List recent IOC revocations, newest first.\n\n    Args:\n        limit:       Maximum number of revocations to return (default 50).\n        since_hours: Only "}],"toolCount":30,"serverName":"Nullcone Threat Intelligence","capabilities":["experimental","prompts","resources","tools"],"serverVersion":"1.29.0","protocolVersion":"2025-06-18"}},{"at":"2026-09-07T02:25:06.102Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":95,"error":null,"detail":{"tools":[{"name":"submit_ioc","description":"\n    Submit a threat indicator (IOC) to the shared intelligence network.\n\n    The IOC is automatically classified into a malware family, metadata is\n    compres"},{"name":"submit_batch","description":"\n    Submit multiple IOCs in a single call. Preferred over looping submit_ioc\n    for bulk ingest from honeypots, sandboxes, or feed processing.\n\n    Each dict "},{"name":"lookup_ioc","description":"\n    Look up a threat signature by its exact IOC value.\n\n    Returns the full signature record if found, including severity, family,\n    detection count, and fa"},{"name":"recent_threats","description":"\n    Return the most recently observed threat signatures.\n\n    Args:\n        limit:        Max number of results to return (1-200)\n        min_severity: Minimum"},{"name":"family_threats","description":"\n    Return all threat signatures associated with a known malware family.\n\n    Use list_families() first to discover available family names.\n\n    Args:\n        "},{"name":"list_families","description":"\n    Return all known malware families in the intelligence database.\n\n    Each entry includes the family name, description, and category. Use\n    family_threats"},{"name":"search_by_type","description":"\n    Return threat signatures filtered by IOC type.\n\n    Useful for pulling all known-bad IPs, all malicious domains, all\n    malicious AI skill hashes, etc.\n\n "},{"name":"report_detection","description":"\n    Report that you detected and acted on a known threat signature.\n\n    Increments the signature's detection count and creates a ThreatEvent\n    visible to al"},{"name":"vote_false_positive","description":"\n    Flag a threat signature as a likely false positive.\n\n    When more than 20% of agents vote false positive on a signature,\n    its `is_likely_fp` flag becom"},{"name":"poll_since","description":"\n    Fetch new threat signatures since a high-water mark ID. This is the\n    recommended sync pattern — one call, get new data, persist next_id,\n    disconnect."},{"name":"get_stats","description":"\n    Return aggregate statistics for the threat intelligence database.\n\n    Includes total signatures, known malware families, active agents,\n    and total dete"},{"name":"validate_skill","description":"\n    Synchronous SKILL IOC lookup — call this before loading or invoking any\n    MCP tool/skill to check it against the Nullcone threat feed.\n\n    This is the p"},{"name":"scan_skill_content","description":"\n    Pre-execution content scan for skill/instruction files.\n\n    Analyzes the full text of a skill (markdown, plain text, SKILL.md, etc.)\n    for malicious pat"},{"name":"get_new_threats","description":"\n    Drain the live push-subscription buffer of threats received since the\n    last call. Zero-polling — threats are delivered via SpacetimeDB WebSocket\n    sub"},{"name":"warm_prompt_cache","description":"\n    Load all PROMPT IOCs from SpacetimeDB into the in-memory hash set.\n\n    Call once at startup (or after a major feed update) to populate the\n    sub-1ms que"},{"name":"check_prompt","description":"\n    Check a prompt or text fragment for known PROMPT IOC patterns.\n\n    Uses an in-memory hash set for sub-1ms token-level querying — no\n    network calls afte"},{"name":"check_prompt_batch","description":"\n    Check multiple prompts for PROMPT IOC patterns in a single call.\n\n    More efficient than calling check_prompt() in a loop — tokenization\n    overhead is a"},{"name":"prompt_cache_stats","description":"\n    Return PROMPT IOC cache statistics: size, hit rate, latency, refresh status.\n\n    Use this to verify the cache is warmed and healthy before relying on\n    "},{"name":"check_freshness","description":"\n    Validate that IOC threat intelligence is fresh enough for the named action.\n\n    Call this before any high-risk agent action to ensure the TI snapshot\n    "},{"name":"freshness_limits","description":"\n    Return the configured IOC freshness limits for all action tiers.\n\n    Shows max staleness, warn threshold, and which actions belong to each tier.\n    Use t"},{"name":"fingerprint_tool_metadata","description":"\n    Analyze an MCP tool definition for instruction-injection and malicious patterns.\n\n    Performs semantic fingerprinting of the tool's description, parameter"},{"name":"registry_monitor_stats","description":"\n    Return MCP registry monitoring statistics.\n\n    Shows how many tool definitions are tracked, how many have been flagged,\n    and the current drift detectio"},{"name":"registry_flagged_tools","description":"\n    Return all MCP tools that have been flagged as suspicious or malicious.\n\n    Includes tools flagged on initial ingestion (high-risk fingerprint)\n    and to"},{"name":"subscribe_threats","description":"\n    Open a named, stateful subscription to live threat push delivery.\n\n    Returns a subscription_id. Pass it to drain_subscription() to collect\n    the IOCs t"},{"name":"drain_subscription","description":"\n    Drain the buffer of a stateful subscription created by subscribe_threats().\n\n    Returns all IOCs delivered to this subscription since the last drain.\n    "},{"name":"unsubscribe","description":"\n    Cancel a stateful subscription and free its buffer.\n\n    Call this when you no longer need the subscription to release memory.\n    Subscriptions also auto-"},{"name":"list_subscriptions","description":"\n    List all active stateful push subscriptions on this MCP server instance.\n\n    Returns metadata for each subscription (not the buffered IOCs themselves).\n  "},{"name":"revoke_ioc","description":"\n    Revoke an IOC by its value hash, pushing the expiration event to all\n    active subscriptions in real-time.\n\n    Call this when an IOC is determined to be "},{"name":"is_ioc_revoked","description":"\n    Check whether an IOC has been revoked. O(1) in-process lookup.\n\n    Use this before acting on any cached threat intelligence to ensure the\n    IOC has not "},{"name":"list_revocations","description":"\n    List recent IOC revocations, newest first.\n\n    Args:\n        limit:       Maximum number of revocations to return (default 50).\n        since_hours: Only "}],"toolCount":30,"serverName":"Nullcone Threat Intelligence","capabilities":["experimental","prompts","resources","tools"],"serverVersion":"1.29.0","protocolVersion":"2025-06-18"}},{"at":"2026-09-06T19:21:25.074Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":86,"error":null,"detail":{"tools":[{"name":"submit_ioc","description":"\n    Submit a threat indicator (IOC) to the shared intelligence network.\n\n    The IOC is automatically classified into a malware family, metadata is\n    compres"},{"name":"submit_batch","description":"\n    Submit multiple IOCs in a single call. Preferred over looping submit_ioc\n    for bulk ingest from honeypots, sandboxes, or feed processing.\n\n    Each dict "},{"name":"lookup_ioc","description":"\n    Look up a threat signature by its exact IOC value.\n\n    Returns the full signature record if found, including severity, family,\n    detection count, and fa"},{"name":"recent_threats","description":"\n    Return the most recently observed threat signatures.\n\n    Args:\n        limit:        Max number of results to return (1-200)\n        min_severity: Minimum"},{"name":"family_threats","description":"\n    Return all threat signatures associated with a known malware family.\n\n    Use list_families() first to discover available family names.\n\n    Args:\n        "},{"name":"list_families","description":"\n    Return all known malware families in the intelligence database.\n\n    Each entry includes the family name, description, and category. Use\n    family_threats"},{"name":"search_by_type","description":"\n    Return threat signatures filtered by IOC type.\n\n    Useful for pulling all known-bad IPs, all malicious domains, all\n    malicious AI skill hashes, etc.\n\n "},{"name":"report_detection","description":"\n    Report that you detected and acted on a known threat signature.\n\n    Increments the signature's detection count and creates a ThreatEvent\n    visible to al"},{"name":"vote_false_positive","description":"\n    Flag a threat signature as a likely false positive.\n\n    When more than 20% of agents vote false positive on a signature,\n    its `is_likely_fp` flag becom"},{"name":"poll_since","description":"\n    Fetch new threat signatures since a high-water mark ID. This is the\n    recommended sync pattern — one call, get new data, persist next_id,\n    disconnect."},{"name":"get_stats","description":"\n    Return aggregate statistics for the threat intelligence database.\n\n    Includes total signatures, known malware families, active agents,\n    and total dete"},{"name":"validate_skill","description":"\n    Synchronous SKILL IOC lookup — call this before loading or invoking any\n    MCP tool/skill to check it against the Nullcone threat feed.\n\n    This is the p"},{"name":"scan_skill_content","description":"\n    Pre-execution content scan for skill/instruction files.\n\n    Analyzes the full text of a skill (markdown, plain text, SKILL.md, etc.)\n    for malicious pat"},{"name":"get_new_threats","description":"\n    Drain the live push-subscription buffer of threats received since the\n    last call. Zero-polling — threats are delivered via SpacetimeDB WebSocket\n    sub"},{"name":"warm_prompt_cache","description":"\n    Load all PROMPT IOCs from SpacetimeDB into the in-memory hash set.\n\n    Call once at startup (or after a major feed update) to populate the\n    sub-1ms que"},{"name":"check_prompt","description":"\n    Check a prompt or text fragment for known PROMPT IOC patterns.\n\n    Uses an in-memory hash set for sub-1ms token-level querying — no\n    network calls afte"},{"name":"check_prompt_batch","description":"\n    Check multiple prompts for PROMPT IOC patterns in a single call.\n\n    More efficient than calling check_prompt() in a loop — tokenization\n    overhead is a"},{"name":"prompt_cache_stats","description":"\n    Return PROMPT IOC cache statistics: size, hit rate, latency, refresh status.\n\n    Use this to verify the cache is warmed and healthy before relying on\n    "},{"name":"check_freshness","description":"\n    Validate that IOC threat intelligence is fresh enough for the named action.\n\n    Call this before any high-risk agent action to ensure the TI snapshot\n    "},{"name":"freshness_limits","description":"\n    Return the configured IOC freshness limits for all action tiers.\n\n    Shows max staleness, warn threshold, and which actions belong to each tier.\n    Use t"},{"name":"fingerprint_tool_metadata","description":"\n    Analyze an MCP tool definition for instruction-injection and malicious patterns.\n\n    Performs semantic fingerprinting of the tool's description, parameter"},{"name":"registry_monitor_stats","description":"\n    Return MCP registry monitoring statistics.\n\n    Shows how many tool definitions are tracked, how many have been flagged,\n    and the current drift detectio"},{"name":"registry_flagged_tools","description":"\n    Return all MCP tools that have been flagged as suspicious or malicious.\n\n    Includes tools flagged on initial ingestion (high-risk fingerprint)\n    and to"},{"name":"subscribe_threats","description":"\n    Open a named, stateful subscription to live threat push delivery.\n\n    Returns a subscription_id. Pass it to drain_subscription() to collect\n    the IOCs t"},{"name":"drain_subscription","description":"\n    Drain the buffer of a stateful subscription created by subscribe_threats().\n\n    Returns all IOCs delivered to this subscription since the last drain.\n    "},{"name":"unsubscribe","description":"\n    Cancel a stateful subscription and free its buffer.\n\n    Call this when you no longer need the subscription to release memory.\n    Subscriptions also auto-"},{"name":"list_subscriptions","description":"\n    List all active stateful push subscriptions on this MCP server instance.\n\n    Returns metadata for each subscription (not the buffered IOCs themselves).\n  "},{"name":"revoke_ioc","description":"\n    Revoke an IOC by its value hash, pushing the expiration event to all\n    active subscriptions in real-time.\n\n    Call this when an IOC is determined to be "},{"name":"is_ioc_revoked","description":"\n    Check whether an IOC has been revoked. O(1) in-process lookup.\n\n    Use this before acting on any cached threat intelligence to ensure the\n    IOC has not "},{"name":"list_revocations","description":"\n    List recent IOC revocations, newest first.\n\n    Args:\n        limit:       Maximum number of revocations to return (default 50).\n        since_hours: Only "}],"toolCount":30,"serverName":"Nullcone Threat Intelligence","capabilities":["experimental","prompts","resources","tools"],"serverVersion":"1.29.0","protocolVersion":"2025-06-18"}}],"tools":[{"name":"submit_ioc","description":"\n    Submit a threat indicator (IOC) to the shared intelligence network.\n\n    The IOC is automatically classified into a malware family, metadata is\n    compres"},{"name":"submit_batch","description":"\n    Submit multiple IOCs in a single call. Preferred over looping submit_ioc\n    for bulk ingest from honeypots, sandboxes, or feed processing.\n\n    Each dict "},{"name":"lookup_ioc","description":"\n    Look up a threat signature by its exact IOC value.\n\n    Returns the full signature record if found, including severity, family,\n    detection count, and fa"},{"name":"recent_threats","description":"\n    Return the most recently observed threat signatures.\n\n    Args:\n        limit:        Max number of results to return (1-200)\n        min_severity: Minimum"},{"name":"family_threats","description":"\n    Return all threat signatures associated with a known malware family.\n\n    Use list_families() first to discover available family names.\n\n    Args:\n        "},{"name":"list_families","description":"\n    Return all known malware families in the intelligence database.\n\n    Each entry includes the family name, description, and category. Use\n    family_threats"},{"name":"search_by_type","description":"\n    Return threat signatures filtered by IOC type.\n\n    Useful for pulling all known-bad IPs, all malicious domains, all\n    malicious AI skill hashes, etc.\n\n "},{"name":"report_detection","description":"\n    Report that you detected and acted on a known threat signature.\n\n    Increments the signature's detection count and creates a ThreatEvent\n    visible to al"},{"name":"vote_false_positive","description":"\n    Flag a threat signature as a likely false positive.\n\n    When more than 20% of agents vote false positive on a signature,\n    its `is_likely_fp` flag becom"},{"name":"poll_since","description":"\n    Fetch new threat signatures since a high-water mark ID. This is the\n    recommended sync pattern — one call, get new data, persist next_id,\n    disconnect."},{"name":"get_stats","description":"\n    Return aggregate statistics for the threat intelligence database.\n\n    Includes total signatures, known malware families, active agents,\n    and total dete"},{"name":"validate_skill","description":"\n    Synchronous SKILL IOC lookup — call this before loading or invoking any\n    MCP tool/skill to check it against the Nullcone threat feed.\n\n    This is the p"},{"name":"scan_skill_content","description":"\n    Pre-execution content scan for skill/instruction files.\n\n    Analyzes the full text of a skill (markdown, plain text, SKILL.md, etc.)\n    for malicious pat"},{"name":"get_new_threats","description":"\n    Drain the live push-subscription buffer of threats received since the\n    last call. Zero-polling — threats are delivered via SpacetimeDB WebSocket\n    sub"},{"name":"warm_prompt_cache","description":"\n    Load all PROMPT IOCs from SpacetimeDB into the in-memory hash set.\n\n    Call once at startup (or after a major feed update) to populate the\n    sub-1ms que"},{"name":"check_prompt","description":"\n    Check a prompt or text fragment for known PROMPT IOC patterns.\n\n    Uses an in-memory hash set for sub-1ms token-level querying — no\n    network calls afte"},{"name":"check_prompt_batch","description":"\n    Check multiple prompts for PROMPT IOC patterns in a single call.\n\n    More efficient than calling check_prompt() in a loop — tokenization\n    overhead is a"},{"name":"prompt_cache_stats","description":"\n    Return PROMPT IOC cache statistics: size, hit rate, latency, refresh status.\n\n    Use this to verify the cache is warmed and healthy before relying on\n    "},{"name":"check_freshness","description":"\n    Validate that IOC threat intelligence is fresh enough for the named action.\n\n    Call this before any high-risk agent action to ensure the TI snapshot\n    "},{"name":"freshness_limits","description":"\n    Return the configured IOC freshness limits for all action tiers.\n\n    Shows max staleness, warn threshold, and which actions belong to each tier.\n    Use t"},{"name":"fingerprint_tool_metadata","description":"\n    Analyze an MCP tool definition for instruction-injection and malicious patterns.\n\n    Performs semantic fingerprinting of the tool's description, parameter"},{"name":"registry_monitor_stats","description":"\n    Return MCP registry monitoring statistics.\n\n    Shows how many tool definitions are tracked, how many have been flagged,\n    and the current drift detectio"},{"name":"registry_flagged_tools","description":"\n    Return all MCP tools that have been flagged as suspicious or malicious.\n\n    Includes tools flagged on initial ingestion (high-risk fingerprint)\n    and to"},{"name":"subscribe_threats","description":"\n    Open a named, stateful subscription to live threat push delivery.\n\n    Returns a subscription_id. Pass it to drain_subscription() to collect\n    the IOCs t"},{"name":"drain_subscription","description":"\n    Drain the buffer of a stateful subscription created by subscribe_threats().\n\n    Returns all IOCs delivered to this subscription since the last drain.\n    "},{"name":"unsubscribe","description":"\n    Cancel a stateful subscription and free its buffer.\n\n    Call this when you no longer need the subscription to release memory.\n    Subscriptions also auto-"},{"name":"list_subscriptions","description":"\n    List all active stateful push subscriptions on this MCP server instance.\n\n    Returns metadata for each subscription (not the buffered IOCs themselves).\n  "},{"name":"revoke_ioc","description":"\n    Revoke an IOC by its value hash, pushing the expiration event to all\n    active subscriptions in real-time.\n\n    Call this when an IOC is determined to be "},{"name":"is_ioc_revoked","description":"\n    Check whether an IOC has been revoked. O(1) in-process lookup.\n\n    Use this before acting on any cached threat intelligence to ensure the\n    IOC has not "},{"name":"list_revocations","description":"\n    List recent IOC revocations, newest first.\n\n    Args:\n        limit:       Maximum number of revocations to return (default 50).\n        since_hours: Only "}],"package":null},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"mcp_registry","key":"io.github.maco144/nullcone","url":"https://registry.modelcontextprotocol.io/v0/servers/io.github.maco144%2Fnullcone","firstSeenAt":"2026-09-06T18:19:26.406Z","fetchedAt":"2026-09-06T18:19:26.406Z","normalizedAt":"2026-09-06T18:19:26.406Z"}]},"firstSeenAt":"2026-09-06T18:19:26.406Z","updatedAt":"2026-09-07T23:35:00.845Z"}