🛡️ SerpShield — AI Threat Intelligence from Real-Time Search Data

An AI agent that uses SerpApi real-time search data to detect brand threats, security vulnerabilities, and DeFi protocol risk signals across the live web — exposed as MCP-compatible tools for agent orchestration.

Built for the DevNetwork [API + Cloud + AI] Hackathon 2026 — SerpApi "Best AI Use Case" track.

Problem

Threat intelligence is reactive and slow. Security teams learn about phishing campaigns, brand impersonation, and DeFi exploits after the damage is done — usually from a breach notification or a social media post. By then, the attack has already succeeded.

Meanwhile, the answer is already on Google. Search results contain real-time signals: phishing pages indexed hours ago, vulnerability disclosures trending on forums, rug pull discussions appearing in news. But nobody is systematically converting that search data into structured threat intelligence that an AI agent can act on.

Related MCP server: l402-search-mcp

Solution

SerpShield is an AI agent that queries SerpApi for real-time search results, classifies them into threat signals (phishing, vulnerability, DeFi risk, brand impersonation, reputation), and produces actionable threat intelligence reports — all exposed as MCP-compatible tools that any AI agent can call.

How it works:

1. Agent constructs threat-hunting queries (e.g., "OpenAI" phishing OR scam OR impersonation)

2. Queries SerpApi for real-time Google search results

3. Classifies each result using threat-type keywords and severity heuristics

4. Aggregates into a threat intelligence report with a 0–100 threat score and recommendations

5. Exposes everything as MCP tools so other agents can call them

Unique Angle

Unlike existing SerpApi demos (SEO trackers, price monitors, search aggregators), SerpShield turns search data into security intelligence — and exposes every tool as an MCP-compatible endpoint for AI agent orchestration. It's a threat intel SaaS powered by search data, not a search tool.

Architecture

┌─────────────────────────────────────────────────────┐
│                   Web UI (HTML/CSS/JS)               │
│              Dark dashboard — threat scanner         │
└──────────────────┬──────────────────────────────────┘
                   │ fetch() calls
                   ▼
┌─────────────────────────────────────────────────────┐
│              FastAPI Application (app/main.py)        │
│                                                      │
│  /api/health          → service status                │
│  /api/agent/status    → agent config + tool list     │
│  /api/mcp/tools       → MCP tool discovery endpoint   │
│  /api/mcp (POST)      → MCP tool dispatch endpoint    │
│  /api/demo            → full monitoring cycle (demo) │
│  /api/tools/*         → individual tool endpoints     │
└──────────────────┬──────────────────────────────────┘
                   │ calls
                   ▼
┌─────────────────────────────────────────────────────┐
│              SerpShield Agent (app/agent.py)          │
│                                                      │
│  scan_brand_threats()      → phishing/impersonation  │
│  scan_security_advisories() → CVE/vuln detection      │
│  scan_defi_risks()         → rug pull/exploit scan    │
│  generate_threat_report()  → aggregated report        │
│  list_monitoring_targets() → dashboard summary        │
└──────────────────┬──────────────────────────────────┘
                   │ HTTP GET
                   ▼
┌─────────────────────────────────────────────────────┐
│                    SerpApi                            │
│       Real-time Google search results JSON API       │
│       (falls back to realistic mock data in demo)     │
└─────────────────────────────────────────────────────┘

Deployed on Vercel as a serverless Python function.

Setup (Under 5 Commands)

git clone https://github.com/0xConsole/serpshield.git
cd serpshield
pip install -r requirements.txt
export SERPAPI_API_KEY="your_key"   # optional — demo mode works without it
uvicorn api.index:app --reload       # local dev at http://localhost:8000

Tech Stack

What's Real vs. Mocked

API Endpoints

SerpApi Track Fit

SerpApi's challenge asks for "an innovative AI application using SerpApi APIs to access reliable, structured, real-time web data" that "solves a meaningful real-world problem."

SerpShield delivers:

• Innovation: Security/threat intelligence is an unexpected SerpApi use case (judges favor unexpected applications over incremental tweaks)

• Real-time web data: Every scan queries live Google results via SerpApi

• Meaningful problem: Threat intelligence is a $10B+ market

• AI agent: Not just a search tool — an autonomous agent with MCP-compatible tools

License

Apache 2.0 — See LICENSE