KeyboardCrumbs MCP Server
# KeyboardCrumbs MCP Server
mcp-name: com.keyboardcrumbs/mcp
Live threat intelligence tools for Claude Desktop. Free, no API key required.
## Tools
| Tool | Description |
|------|-------------|
| `check_ip` | Threat intel for any IP — risk score, geo, ASN, C2 associations, staging clusters |
| `check_cve` | CVE lookup — CVSS, EPSS, KEV status, exploit availability, patch urgency |
| `check_domain` | Domain intel — DNS records, WHOIS, malware associations, subdomains |
| `check_hash` | Malware hash lookup via VirusTotal (68+ engines) + CIRCL (6.3B files) |
| `active_threats` | Live snapshot — KEV count, active C2s, ransomware victims, data freshness |
| `predict_kev` | KEV Oracle — top CVEs predicted to be added to CISA KEV before it happens |
| `check_staging` | GhostWatch — detect pre-attack infrastructure staging for an IP or domain |
| `check_ransomware` | Ransomware group lookup and victim tracking |
## Install
### Option 1 — uvx (no install needed)
Add to `claude_desktop_config.json`:
```json
{
"mcpServers": {
"keyboardcrumbs": {
"command": "uvx",
"args": ["--from", "git+https://github.com/keyboardcrumbs/mcp", "keyboardcrumbs-mcp"]
}
}
}
```
### Option 2 — Clone and run locally
```bash
git clone https://github.com/keyboardcrumbs/mcp
cd mcp
uv venv && source .venv/bin/activate
uv add "mcp[cli]" httpx
```
Add to `claude_desktop_config.json`:
```json
{
"mcpServers": {
"keyboardcrumbs": {
"command": "uv",
"args": ["--directory", "/path/to/mcp", "run", "server.py"]
}
}
}
```
Restart Claude Desktop.
## Example Usage
Once installed, just ask Claude:
- *"Is 45.141.26.73 malicious?"*
- *"Should I patch CVE-2024-3400 immediately?"*
- *"What CVEs are about to be added to CISA KEV?"*
- *"Is this domain staging for an attack?"*
- *"What's the current threat landscape?"*
Claude will call the live KeyboardCrumbs API and return real-time threat intelligence.
## Data Sources
URLhaus · Feodo Tracker · AlienVault OTX · CISA KEV · NVD · EPSS · ExploitDB ·
VirusTotal · CIRCL · SANS ISC DShield · Shodan · RIPE · crt.sh · Ransomware.live
Data updates every 15 minutes. No API key. No signup. No rate limits for normal use.
## Links
- Dashboard: https://threats.keyboardcrumbs.com
- GhostWatch: https://ghost.keyboardcrumbs.com
- KEV Oracle: https://oracle.keyboardcrumbs.com
- API docs: https://api.keyboardcrumbs.com
TDQS
Scored across 8 tools
Each tool has a clearly distinct purpose targeting different threat intelligence aspects: active threats overview, CVE lookup, domain/IP/hash investigation, ransomware tracking, staging detection, and KEV prediction. The descriptions specify unique use cases (e.g., 'quick situational awareness' vs. 'assess patch urgency'), preventing confusion between tools.
All tools follow a consistent 'check_' or descriptive verb_noun pattern (active_threats, check_cve, check_domain, check_hash, check_ip, check_ransomware, check_staging, predict_kev). The naming is uniform with snake_case throughout, making it predictable and easy to understand.
With 8 tools, the server is well-scoped for its threat intelligence domain. Each tool addresses a specific need (e.g., different indicator types, ransomware, staging clusters), and none feel redundant or missing, providing comprehensive coverage without being overwhelming.
The tool set offers complete coverage for threat intelligence workflows: it includes real-time overviews (active_threats), detailed lookups for various indicators (CVE, domain, hash, IP), specialized checks (ransomware, staging), and predictive analytics (predict_kev). There are no obvious gaps, enabling agents to handle diverse security investigation tasks.