Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@tweetfeed-mcp Check if http://example.com appears in the feed"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Model Context Protocol (MCP) server for tweetfeed.live.
Exposes the public IOC feed (URLs, domains, IPs, SHA256/MD5 hashes shared by the infosec community on Twitter/X) as MCP tools so AI agents can query threat intel programmatically.
Endpoint: https://mcp.tweetfeed.live/ (HTTP JSON-RPC 2.0, POST)
Protocol version: 2025-11-25 (negotiated; older clients fall back automatically)
Auth: none (all IOC data is CC0)
License (data): CC0-1.0 · License (code): MIT
Name | Purpose |
| Query IOCs by time window (today/week/month) with optional user, tag, and type filters. |
| Check whether a specific URL appears in the feed. |
| Check whether an IPv4/IPv6 address appears in the feed. |
| Check whether an MD5 or SHA-256 hash appears in the feed (type auto-detected). |
| List IOCs added since a given date, with optional type/tag filters. |
| Window aggregates plus recent IOCs for a tag (leading |
| Top tags and IOC-type distribution for a window (today/week/month/year). |
| Exact lookup of an IOC (auto-detected type: url/domain/ip/md5/sha256) over the past 365 days, with AI/external-corroboration/net/domain-registration (reg, including the domain's age in days at first report and a |
| AI-clustered campaign groupings from the last 30 days, with optional brand and min-confidence filters. |
| Full IOC membership (header + rows) of one campaign by id, with optional type filter and limit. |
| 31-day IOC trend analytics: daily volume by type, top moving tags week-over-week, most-abused TLDs, new vs recurring ratio, producer concentration. |
| ChatGPT connector interface: find document ids ( |
| ChatGPT connector interface: full document ( |
Related MCP server: misp-mcp
{
"mcpServers": {
"tweetfeed": {
"url": "https://mcp.tweetfeed.live/"
}
}
}Or from the Claude Code CLI:
claude mcp add tweetfeed https://mcp.tweetfeed.live/ChatGPT (Settings > Connectors > Create, or a Deep research custom connector)
accepts https://mcp.tweetfeed.live/ with no authentication. The server
exposes the required search and fetch tools alongside the others, and
every result carries a tweetfeed.live URL so ChatGPT can cite it.
curl -sX POST https://mcp.tweetfeed.live/ \
-H 'content-type: application/json' \
-d '{"jsonrpc":"2.0","method":"tools/list","id":1}' | jq .
# Example tool call:
curl -sX POST https://mcp.tweetfeed.live/ \
-H 'content-type: application/json' \
-d '{"jsonrpc":"2.0","method":"tools/call","id":2,
"params":{"name":"query_iocs",
"arguments":{"time":"today","tag":"phishing","type":"url","limit":5}}}' | jq .npm install
npm run dev # wrangler dev on http://localhost:8787
MCP_URL=http://localhost:8787 npm testnpm run deploy # wrangler deploy (routes mcp.tweetfeed.live/*)
MCP_URL=https://mcp.tweetfeed.live npm testThis server cannot be deployed
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
Cybersecurity MCP server for URL scanning, threat intelligence, and domain reputation.
ThreatFox MCP — abuse.ch indicator-of-compromise feed (free, key required)
Pulsedive MCP — threat-intelligence IOC enrichment (pulsedive.com)
