{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_439shw4e67u2","handle":"threatcluster-mcp","url":"https://wellknown.network/agents/threatcluster-mcp","links":{"self":"https://wellknown.network/agents/threatcluster-mcp/record.json","html":"https://wellknown.network/agents/threatcluster-mcp","markdown":"https://wellknown.network/agents/threatcluster-mcp/record.md","api":"https://wellknown.network/api/v1/agents/threatcluster-mcp","status":"https://wellknown.network/api/v1/agents/threatcluster-mcp/status","claim":"https://wellknown.network/agents/threatcluster-mcp/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/threatcluster-mcp/claim.json","badge":"https://wellknown.network/agents/threatcluster-mcp/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/threatcluster-mcp/history","tools":"https://wellknown.network/api/v1/agents/threatcluster-mcp/tools"},"ard":{"identifier":"urn:air:threatcluster.io:server:threatcluster-mcp","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"threatcluster","summary":"Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.","description":"Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.","publisher":{"name":"Jam0k","url":null},"homepage":"https://threatcluster.io/integrations/mcp","repository":"https://github.com/Jam0k/Threat-Intelligence-MCP","version":"0.2.3","license":"GPL-3.0-or-later","protocols":["mcp"],"tags":["mcp","model-context-protocol","mcp-server","threat-intelligence","cti","security","threatcluster","claude","cursor"],"pricing":null,"endpoints":[{"url":"https://threatcluster.io/mcp","type":"mcp_streamable_http","auth":null,"probeable":true},{"url":"npm:threatcluster-mcp","type":"package_npm","auth":null,"probeable":false},{"url":"pypi:threatcluster-mcp","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":{"updatedAt":"2026-09-26T17:19:04.38212Z","npmKeywords":["mcp","model-context-protocol","mcp-server","threat-intelligence","cti","security","threatcluster","claude","cursor"],"publishedAt":"2026-09-26T17:19:04.38212Z","registryName":"io.github.Jam0k/threatcluster"},"attribution":{"kind":"mcp_registry","name":"mcp_registry","license":"npm","repoUrl":"mcp_registry","summary":"mcp_registry","version":"mcp_registry","description":"mcp_registry","homepageUrl":"npm","publisherName":"mcp_registry"}},"derived":{"capabilities":[],"categories":[],"language":"en"},"observed":{"status":"live","statusReason":"Responded 3h ago.","lastOkAt":"2026-10-11T07:22:59.671Z","lastProbedAt":"2026-10-11T07:22:59.671Z","statusComputedAt":"2026-10-11T07:24:37.401Z","reliability30d":{"probes":47,"successRate":1,"p50Ms":87,"basis":"auth_boundary","measures":{"availability":"authentication boundary reached","latency":"time to authentication response","tools":"not measured — authentication required","summary":"Every successful check was an authentication response (401/403). The endpoint exists and enforces authentication; nothing behind that boundary — tools, behaviour, service health — has been observed."},"checks":{"total":47,"ok":47,"authBoundaryOk":47,"serviceOk":0,"note":"Counted from the observation rows for the window, checks of the server only (HTTP, A2A card, MCP initialize). ok = authBoundaryOk + serviceOk. `probes` is the sum of daily rollups and includes registry checks, so it can differ from `total`."}},"latestObservations":[{"at":"2026-10-11T07:22:59.671Z","kind":"mcp_initialize","ok":true,"httpStatus":401,"latencyMs":148,"error":null,"detail":{"authRequired":true,"wwwAuthenticate":"Bearer realm=\"ThreatCluster\", resource_metadata=\"https://threatcluster.io/.well-known/oauth-protected-resource\", scope=\"openid email\""}},{"at":"2026-10-11T00:26:04.857Z","kind":"mcp_initialize","ok":true,"httpStatus":401,"latencyMs":83,"error":null,"detail":{"authRequired":true,"wwwAuthenticate":"Bearer realm=\"ThreatCluster\", resource_metadata=\"https://threatcluster.io/.well-known/oauth-protected-resource\", scope=\"openid email\""}},{"at":"2026-10-10T17:28:38.602Z","kind":"mcp_initialize","ok":true,"httpStatus":401,"latencyMs":108,"error":null,"detail":{"authRequired":true,"wwwAuthenticate":"Bearer realm=\"ThreatCluster\", resource_metadata=\"https://threatcluster.io/.well-known/oauth-protected-resource\", scope=\"openid email\""}},{"at":"2026-10-10T10:27:49.022Z","kind":"mcp_initialize","ok":true,"httpStatus":401,"latencyMs":170,"error":null,"detail":{"authRequired":true,"wwwAuthenticate":"Bearer realm=\"ThreatCluster\", resource_metadata=\"https://threatcluster.io/.well-known/oauth-protected-resource\", scope=\"openid email\""}},{"at":"2026-10-10T03:26:01.990Z","kind":"mcp_initialize","ok":true,"httpStatus":401,"latencyMs":126,"error":null,"detail":{"authRequired":true,"wwwAuthenticate":"Bearer realm=\"ThreatCluster\", resource_metadata=\"https://threatcluster.io/.well-known/oauth-protected-resource\", scope=\"openid email\""}},{"at":"2026-10-09T21:25:59.967Z","kind":"mcp_initialize","ok":true,"httpStatus":401,"latencyMs":75,"error":null,"detail":{"authRequired":true,"wwwAuthenticate":"Bearer realm=\"ThreatCluster\", resource_metadata=\"https://threatcluster.io/.well-known/oauth-protected-resource\", scope=\"openid email\""}},{"at":"2026-10-09T14:30:40.653Z","kind":"mcp_initialize","ok":true,"httpStatus":401,"latencyMs":114,"error":null,"detail":{"authRequired":true,"wwwAuthenticate":"Bearer realm=\"ThreatCluster\", resource_metadata=\"https://threatcluster.io/.well-known/oauth-protected-resource\", scope=\"openid email\""}},{"at":"2026-10-09T07:26:05.118Z","kind":"mcp_initialize","ok":true,"httpStatus":401,"latencyMs":73,"error":null,"detail":{"authRequired":true,"wwwAuthenticate":"Bearer realm=\"ThreatCluster\", resource_metadata=\"https://threatcluster.io/.well-known/oauth-protected-resource\", scope=\"openid email\""}},{"at":"2026-10-09T01:25:09.887Z","kind":"mcp_initialize","ok":true,"httpStatus":401,"latencyMs":110,"error":null,"detail":{"authRequired":true,"wwwAuthenticate":"Bearer realm=\"ThreatCluster\", resource_metadata=\"https://threatcluster.io/.well-known/oauth-protected-resource\", scope=\"openid email\""}},{"at":"2026-10-08T18:27:30.625Z","kind":"mcp_initialize","ok":true,"httpStatus":401,"latencyMs":86,"error":null,"detail":{"authRequired":true,"wwwAuthenticate":"Bearer realm=\"ThreatCluster\", resource_metadata=\"https://threatcluster.io/.well-known/oauth-protected-resource\", scope=\"openid email\""}}],"tools":null,"package":{"name":"threatcluster-mcp","registry":"npm","observedAt":"2026-10-11T00:19:45.994Z","publishedAt":"2026-09-26T17:14:43.065Z","latestVersion":"0.2.3","weeklyDownloads":47},"toolSurface":null,"endpointFacts":[{"id":"ep_5b7wcz27s835","url":"https://threatcluster.io/mcp","type":"mcp_streamable_http","factsCheckedAt":"2026-10-11T00:26:06.814Z","auth":{"observedAt":"2026-10-11T00:26:07.121Z","authRequired":true,"scheme":"Bearer","resourceMetadata":{"url":"https://threatcluster.io/.well-known/oauth-protected-resource","resource":"https://threatcluster.io/mcp","authorizationServers":["https://login.threatcluster.io/"],"scopesSupported":["openid","email"]},"authorizationServer":{"url":"https://login.threatcluster.io/.well-known/oauth-authorization-server","issuer":"https://login.threatcluster.io/","grantTypesSupported":["client_credentials","authorization_code","refresh_token","password","implicit","urn:ietf:params:oauth:grant-type:device_code","urn:ietf:params:oauth:grant-type:token-exchange","http://auth0.com/oauth/grant-type/password-realm","http://auth0.com/oauth/grant-type/passwordless/otp","http://auth0.com/oauth/grant-type/mfa-oob","http://auth0.com/oauth/grant-type/mfa-otp","http://auth0.com/oauth/grant-type/mfa-recovery-code","urn:ietf:params:oauth:grant-type:jwt-bearer"],"codeChallengeMethodsSupported":["S256","plain"],"tokenEndpointAuthMethodsSupported":["client_secret_basic","client_secret_post","private_key_jwt","none"],"dynamicClientRegistration":true,"dpopSigningAlgValuesSupported":["ES256"],"clientIdMetadataDocumentSupported":true},"conformance":{"dpop":true,"rfc8414":true,"rfc9728":true,"pkceS256":true,"clientIdMetadataDocument":true,"dynamicClientRegistration":true}},"tls":{"observedAt":"2026-10-11T00:26:07.130Z","protocol":"TLSv1.3","chainValid":true,"chainError":null,"hostMatches":true,"subject":"threatcluster.io","issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validFrom":"2026-08-25T02:34:24.000Z","validTo":"2026-11-23T03:34:19.000Z","daysToExpiry":42,"sanCount":1,"fingerprint256":"EA:56:5E:16:2F:FB:18:85:6B:5B:E9:10:2F:1E:C0:77:69:A2:0C:02:81:F3:F4:0E:D2:62:73:74:15:84:A0:4A"}}]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"npm","key":"threatcluster-mcp","url":"https://www.npmjs.com/package/threatcluster-mcp","firstSeenAt":"2026-09-14T00:20:28.381Z","fetchedAt":"2026-10-11T00:19:40.581Z","normalizedAt":"2026-10-11T00:19:40.581Z"},{"source":"pypi","key":"threatcluster-mcp","url":"https://pypi.org/project/threatcluster-mcp/","firstSeenAt":"2026-09-30T11:25:01.077Z","fetchedAt":"2026-10-09T16:22:27.673Z","normalizedAt":"2026-10-09T16:22:27.673Z"},{"source":"mcp_registry","key":"io.github.Jam0k/threatcluster","url":"https://registry.modelcontextprotocol.io/v0/servers/io.github.Jam0k%2Fthreatcluster","firstSeenAt":"2026-09-28T13:19:58.914Z","fetchedAt":"2026-10-09T22:20:26.515Z","normalizedAt":"2026-10-09T22:20:26.515Z"}]},"firstSeenAt":"2026-09-14T00:20:28.381Z","updatedAt":"2026-10-11T00:19:45.994Z"}