Jeevesus — DugganUSA threat-intel MCP

Connect it to your AI

Claude Code

claude mcp add --transport http dugganusa-threat-intel https://analytics.dugganusa.com/api/v1/mcp

Claude, ChatGPT, Cursor and other apps

Add it as a custom connector with this URL (Streamable HTTP):

https://analytics.dugganusa.com/api/v1/mcp

Cursor, VS Code and other apps (mcp.json)

{
  "mcpServers": {
    "dugganusa-threat-intel": {
      "url": "https://analytics.dugganusa.com/api/v1/mcp"
    }
  }
}

Tools it offers

9 tools, as the server itself reported during our check on Oct 31, 2026.

• searchSearches threat-intelligence records about threat actors, malware, campaigns, CVEs, breaches, vendors and indicators. The default search covers security topics only; a few public-document archives can be searched by nami
• enrich-iocLooks up an IP address, domain, URL or file hash, such as one from a message, log line, SIEM alert or code under review. Look up a single indicator of compromise (IP, domain, URL, or hash) in the DugganUSA corpus. Return
• stix-feed-summarySummarizes what is in the feed right now: useful for "what's active this week", feed freshness, or planning SIEM / blocklist ingestion. Shape report on the most recent 5,000 indicators in the DugganUSA STIX 2.1 feed, bou
• ai-model-priceLooks up what an AI model or an agent session costs at list price. Prices are dated and copied from each provider's own pricing page. Returns the per-1M-token USD rates for a model (input, output, and for Anthropic model
• kev-vendor-riskShows where confirmed exploitation concentrates for a vendor or product (Microsoft, Cisco, Fortinet, an appliance, an ERP), for questions like "what should I patch first". Vendor / product risk matrix built from CISA's K
• kev-exploitation-stickinessMeasures whether a product's exploitation risk is chronic or a one-off, for patch prioritization. Does in-the-wild exploitation risk STICK to proven products, or SPREAD to new ones? Analyzes CISA KEV: correlates each pro
• check-packageChecks whether a dependency (npm, PyPI, RubyGems or Packagist/Composer, or a GitHub Action used in a workflow) is on the DugganUSA malicious-package deny-list or has published advisories. Suited to a pre-install step in
• check-workflowChecks the text of one GitHub Actions workflow file for script injection: places where text an outside user controls (an issue or pull request title or body, a comment, a branch name, a commit message) is pasted into a s
• check-repoBefore you open or run a repository someone else sent you (a recruiter's coding test, a downloaded zip, a proof of concept), pass it the few files that matter and get a verdict. It looks for the places a lure hides that

Questions