Skip to main content
Glama
0xDanielLopez

tweetfeed-mcp

by 0xDanielLopez
OverviewSchemaRelated ServersScoreDiscussions
TypeScript
Remote

tweetfeed-mcp

Model Context Protocol (MCP) server for tweetfeed.live.

Exposes the public IOC feed (URLs, domains, IPs, SHA256/MD5 hashes shared by the infosec community on Twitter/X) as MCP tools so AI agents can query threat intel programmatically.

  • Endpoint: https://mcp.tweetfeed.live/ (HTTP JSON-RPC 2.0, POST)

  • Protocol version: 2025-11-25 (negotiated; older clients fall back automatically)

  • Auth: none (all IOC data is CC0)

  • License (data): CC0-1.0 · License (code): MIT

Tools

Name

Purpose

query_iocs

Query IOCs by time window (today/week/month) with optional user, tag, and type filters.

check_url

Check whether a specific URL appears in the feed.

check_ip

Check whether an IPv4/IPv6 address appears in the feed.

check_hash

Check whether an MD5 or SHA-256 hash appears in the feed (type auto-detected).

list_recent_iocs

List IOCs added since a given date, with optional type/tag filters.

get_tag_info

Window aggregates plus recent IOCs for a tag (leading # optional).

get_trending

Top tags and IOC-type distribution for a window (today/week/month/year).

enrich_ioc

Exact lookup of an IOC (auto-detected type: url/domain/ip/md5/sha256) over the past 365 days, with AI/external-corroboration/net/domain-registration (reg) context when available; falls back to a 30-day substring scan on a miss.

get_campaigns

AI-clustered campaign groupings from the last 30 days, with optional brand and min-confidence filters.

get_trends

31-day IOC trend analytics: daily volume by type, top moving tags week-over-week, most-abused TLDs, new vs recurring ratio, producer concentration.

Related MCP server: misp-mcp

Use with Claude Desktop / Claude.ai / other MCP clients

{
  "mcpServers": {
    "tweetfeed": {
      "url": "https://mcp.tweetfeed.live/"
    }
  }
}

Or from the Claude Code CLI:

claude mcp add tweetfeed https://mcp.tweetfeed.live/

Quick test

curl -sX POST https://mcp.tweetfeed.live/ \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}' | jq .

# Example tool call:
curl -sX POST https://mcp.tweetfeed.live/ \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/call","id":2,
       "params":{"name":"query_iocs",
                 "arguments":{"time":"today","tag":"phishing","type":"url","limit":5}}}' | jq .

Develop

npm install
npm run dev          # wrangler dev on http://localhost:8787
MCP_URL=http://localhost:8787 npm test

Deploy

npm run deploy       # wrangler deploy (routes mcp.tweetfeed.live/*)
MCP_URL=https://mcp.tweetfeed.live npm test

This server cannot be installed

A
license - permissive license
Not graded
quality - not tested
B
maintenance

How are these scores calculated?

Maintenance

–Maintainers
–Response time
–Release cycle
–Releases (12mo)
Commit activity

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

  • Cyberbro MCP Server

    stanfrbd
    A
    license
    A
    quality
    A
    maintenance
    An MCP server that extracts Indicators of Compromise (IoCs) from unstructured text and checks their reputation across multiple threat intelligence services. It enables real-time analysis of IPs, domains, hashes, and URLs, providing enriched context for security workflows within LLMs.
    5
    19
    MIT

  • misp-mcp

    lidless-labs
    A
    license
    A
    quality
    A
    maintenance
    An MCP server that enables LLMs to interact with MISP for threat intelligence sharing, IOC lookups, and event management. It provides tools for investigating indicators, discovering correlations, and exporting intelligence in formats like STIX and Suricata.
    36
    31
    2
    MIT

  • OSINT MCP Server

    CloudWaddie
    A
    license
    D
    quality
    D
    maintenance
    A comprehensive MCP server providing tools for IP, domain, email, and image-based open-source intelligence. It integrates services like Shodan, VirusTotal, and HaveIBeenPwned to facilitate advanced security research and data gathering.
    56
    20
    ISC

  • virustotal-mcp-server

    barvhaim
    F
    license
    A
    quality
    D
    maintenance
    MCP server for security analysis using VirusTotal API, enabling AI assistants to analyze URLs, files, IP addresses, and domains with automatic relationship fetching.
    8
    1

View all related MCP servers

Related MCP Connectors

  • Threatfox

    ThreatFox MCP — abuse.ch indicator-of-compromise feed (free, key required)

  • Pulsedive

    Pulsedive MCP — threat-intelligence IOC enrichment (pulsedive.com)

  • ScanMalware.com URL Scanner

    MCP server for ScanMalware.com URL scanning, malware detection, and analysis.

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/0xDanielLopez/tweetfeed-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server