Which integrations are available for this server?

Enables routing AI attribution requests for Common Thread investigations through Cloudflare's AI Gateway.

How do I use @skyphusion/common-thread-mcp?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@@skyphusion/common-thread-mcp Create an investigation and add seed data for tracking a disinformation campaign" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

@skyphusion/common-thread-mcp

Official

by skyphusion-labs

Overview Schema Source Related Servers Discussions Admin

TypeScript

Remote

@skyphusion/common-thread-mcp

MIT Model Context Protocol server for Common Thread: drive the full investigation API from an agent (create cases, seeds, Apify ingest, BYOK attribution, evidence packets).


npm	`@skyphusion/common-thread-mcp`
Repo	https://github.com/skyphusion-labs/common-thread-mcp
Product UI	https://common-thread.skyphusion.org
HTTP contract	common-thread `docs/API.md`
License	MIT (this package). Product: AGPL implementation + CC-BY paper

Documentation

Doc	Audience
docs/mcp.md	Full guide: install, agent config, auth, every tool, troubleshooting
docs/PARITY.md	Website UI vs MCP tools
docs/SECURITY.md	Tokens, BYOK, hosted vs self-host
CLAUDE.md	Agent working notes for this repo

Related MCP server: mcp-osint-server

Quick start

npx -y @skyphusion/common-thread-mcp

Claude Desktop / Claude Code example:

{
  "mcpServers": {
    "common-thread": {
      "command": "npx",
      "args": ["-y", "@skyphusion/common-thread-mcp"],
      "env": {
        "COMMON_THREAD_API_URL": "https://common-thread-backend.skyphusion.org",
        "COMMON_THREAD_AI_GATEWAY_URL": "https://gateway.ai.cloudflare.com/v1/ACCOUNT/GATEWAY/anthropic",
        "COMMON_THREAD_ANTHROPIC_API_KEY": "sk-ant-..."
      }
    }
  }
}

Call create_investigation and store access_token once.
Set COMMON_THREAD_INVESTIGATION_ID + COMMON_THREAD_ACCESS_TOKEN, or pass them on every tool.
Ingest → features → attribute (BYOK on public host) → get_packet.

Environment (summary)

Variable	Purpose
`COMMON_THREAD_API_URL`	Backend base (default hosted backend)
`COMMON_THREAD_ACCESS_TOKEN` / `COMMON_THREAD_INVESTIGATION_ID`	Defaults for tools
`COMMON_THREAD_AI_GATEWAY_URL` + Anthropic key or `COMMON_THREAD_CF_AIG_TOKEN`	BYOK for public attribution

Full table: docs/mcp.md#environment.

Tools (23)

Lifecycle: health, create_investigation, get_investigation, update_investigation_metadata, seal_investigation, delete_investigation, investigation_summary

Seeds: list_seeds, add_seed, remove_seed

Data: list_features, ingest_apify_twitter, get_ingest_job

Attribution: attribute, get_attribution_job, list_runs, get_run

Packets / archive: get_packet, list_manifest, list_signatures, verify_manifest

Debug: debug_ingest, debug_manifest

Hosted API note

The hosted backend is for the public UI and approved integrations. Self-host for unrestricted automation, or contact common-thread@skyphusion.org before productizing against hosted.

Develop

npm ci && npm run typecheck && npm test && npm run build
node dist/index.js

License

MIT. Common Thread product licenses are separate (AGPL-3.0 implementation, CC-BY-4.0 paper).

Available Tools

23 tools

add_seedB

Add a seed account (platform + handle + basis_statement). Active only. Cap: MAX_SEED_ACCOUNTS.

Inputs: account (required), platform (required), basis_statement (required), added_by, +3 more.

attributeB

Run attribution over active seed pairs. Public host requires BYOK (ai_gateway_url + anthropic_api_key or cf_aig_token). May return 200 sync or 202 async jobId.

Inputs: max_retries, skip_triage, access_token, cf_aig_token, +5 more.

create_investigationA

Create a new investigation. Returns access_token ONCE -- store it; it cannot be recovered. New investigations are encrypted at rest; the key is derived from the token.

Inputs: id (required), name (required), description.

debug_ingestC

Dev visibility: extractor vs manifest for the investigation (not a methodology deliverable).

Inputs: access_token, investigation_id.

debug_manifestC

Dev visibility: raw manifest breakdown.

Inputs: access_token, investigation_id.

delete_investigationA

Hard-delete an ACTIVE investigation (MySQL rows + R2 investigation prefix). Sealed/archived refuse. sha256 blobs retained.

Inputs: access_token, investigation_id.

get_attribution_jobC

Poll async attribution job from attribute (202 response).

Inputs: job_id (required), access_token, investigation_id.

get_ingest_jobA

Poll ingest job status by job_id from ingest_apify_twitter.

Inputs: job_id (required), access_token, investigation_id.

get_investigationB

Fetch investigation metadata and practitioner metadata.

Inputs: access_token, investigation_id.

get_packetA

Evidence packet (§8.1). Default JSON for latest run; pass run_id for a specific run. format=markdown returns markdown text; format=pdf returns base64 PDF (needs PDF worker).

Inputs: format, redact, run_id, access_token, +3 more.

get_runA

Single attribution run with parsed output (claims, alternatives, declined pairs, triage).

Inputs: run_id (required), access_token, investigation_id.

healthA

Backend health check (GET /). Confirms API URL, version, and hosted-API notice.

Inputs: no named parameters.

ingest_apify_twitterA

Upload Apify Twitter export JSON (array or {items|data}). Archives + runs extractors. Returns jobId; poll get_ingest_job until completed. Active only.

Inputs: items (required), access_token, investigation_id.

investigation_summaryC

Active seed count and manifest artifact count.

Inputs: access_token, investigation_id.

list_featuresB

Query extracted features (account / pair / event) after ingest+extract.

Inputs: pair, scope, account, category, +6 more.

list_manifestB

List archive manifest entries for the investigation.

Inputs: access_token, investigation_id.

list_runsB

List attribution runs (summaries) for the investigation.

Inputs: access_token, investigation_id.

list_seedsC

List seed accounts for the investigation.

Inputs: access_token, include_removed, investigation_id.

list_signaturesC

List manifest signature records.

Inputs: access_token, investigation_id.

remove_seedA

Soft-delete an active seed (audit row retained).

Inputs: account (required), platform (required), access_token, removed_reason, +1 more.

seal_investigationA

Mark investigation read-only (sealed). Ingest and attribution disabled; data stays readable with the token.

Inputs: access_token, investigation_id.

update_investigation_metadataA

PATCH practitioner metadata: triggering_events and/or time_bounds (paper §4.2.2 / §5.2.1). Active only.

Inputs: time_bounds, access_token, investigation_id, triggering_events.

verify_manifestC

Verify manifest signatures for the investigation.

Inputs: access_token, investigation_id.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

B3.2/5.0

Scored 2026-08-07 13:30 across 23 tools

Disambiguation5/5

Each tool targets a distinct resource or action within the investigation lifecycle, seed management, ingest, attribution, and manifest verification. The async job polling pairs (ingest_apify_twitter/get_ingest_job, attribute/get_attribution_job) are clearly separated. No two tools have overlapping responsibilities.

Naming Consistency4/5

Most tools follow a consistent verb_noun pattern (list_, create_, get_, update_, delete_, add_, remove_, verify_, debug_). Minor deviations include 'health', 'investigation_summary', and 'attribute', which lack the standard verb prefix or object, but overall the naming is predictable.

Tool Count3/5

23 tools is at the heavy end for a single server, covering a full investigation pipeline with ingest, attribution, and manifest verification. While each tool has a specific purpose, the sheer number may overwhelm agents and suggests some tools (e.g., debug_* utilities) could be split into a separate server.

Completeness4/5

The tool surface covers the core workflow: create investigation, manage seeds, ingest data, run attribution, view runs, retrieve packets, and verify manifests. Missing features like listing all investigations or updating seeds are minor and can be worked around.

Maintenance

ActivityActive

ResponsivenessNo recent community issues

Resources

Related MCP Connectors

Riveter
io.github.CodyWatters
MCP server for Riveter's enrichment, scraping, and monitoring API
Web Scraping Monitoring Data Platforms
1
https://mcp.riveterhq.com/mcp
ClearPolicy
app.clearpolicy
Authenticated MCP server for ClearPolicy policy and compliance workflows.
Legal & Compliance Security
2
https://api.clearpolicy.app/mcp
MANDATE Credential BrokerB
io.github.projetnanocorp
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Security
111
https://mandate.nanocorp.app/mcp
Crimson Crawler
com.crimsoncrawler
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
Security Search Research & Data
1
https://crimsoncrawler.com/mcp/v1

Related MCP Servers

Huntress-MCP-Server
Security Monitoring Developer Tools
DynamicEndpoints
A
license
Not graded
quality
Not graded
maintenance
MCP server for Huntress API integration
Updated a year ago (2025-07-16 05:30 UTC)
1
MIT
mcp-osint-server
Search Web Scraping Shell Access
himanshusanecha
F
license
Not graded
quality
D
maintenance
MCP server to perform various OSINT tasks by leveraging common network reconnaissance tools.
Updated 2 years ago (2025-03-12 16:44 UTC)
48
-
Pharus MCP
Finance Search Research & Data
rfalexandre
F
license
C
quality
Not graded
maintenance
A Python MCP server for integrated discovery and querying of investigative services in the Pharus ecosystem. It exposes specialized tools for analyzing RIF, SIMBA, Telefônica, Telemática, KYT, and Graph data through a decoupled service architecture.
Updated 7 months ago (2026-04-21 15:16 UTC)
63
-
production-master-mcpofficial
Monitoring Observability
ProductionMasterAI
A
license
Not graded
quality
B
maintenance
MCP server for the Production Master incident-investigation service, enabling any MCP client to drive investigations via tool calls with pass-through authentication.
Updated 4 days ago (2026-11-06 16:22 UTC)
1
MIT

@skyphusion/common-thread-mcp

Documentation

Quick start

Environment (summary)

Tools (23)

Hosted API note

Develop

License

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

Huntress-MCP-Server

mcp-osint-server

Pharus MCP

production-master-mcpofficial