subscribe_threats
Open a named, stateful subscription to live threat push delivery.
Returns a subscription_id. Pass it to drain_subscription() to collect
the IOCs that have arrived since your last drain — zero polling, each
caller gets their own isolated stream.
Multiple subscribers receive independent copies of every matching IOC.
Subscriptions expire after 1 hour of inactivity (no drain calls).
Composition filters let you narrow the stream:
- ioc_types: only deliver these IOC types (empty = all)
- families: only deliver IOCs from these malware families (empty = all)
- tags: only deliver IOCs with at least one of these tags (empty = all)
Requires the MCP server to be running in SSE mode (MCP_TRANSPORT=sse)
with a live SpacetimeDB push subscription active.
Args:
min_severity: Minimum severity to deliver (0-10). Default 5 (medium+).
ioc_types: List of IOC types to include. E.g. ["skill","prompt","ip"].
Valid: hash_md5, hash_sha1, hash_sha256, ip, ip_port,
domain, url, yara, email, mutex, filepath, asn, ja3,
imphash, cve, prompt, skill. Empty = all types.
families: List of malware family names to include. Empty = all.
tags: List of tags — IOC must match at least one. Empty = all.
Returns:
subscription_id: Opaque ID — pass to drain_subscription() / unsubscribe()
push_active: Whether the background push subscription is running
filters: Echo of the composition filters applied
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | ||
| families | No | ||
| ioc_types | No | ||
| min_severity | No |