Keyboardcrumbs Threat Intel
About
Live threat intelligence for Claude — check IPs, CVEs, KEV predictions, malware hashes, and pre-attack
Explore
- Free, no API key or signup required.
- Live threat intelligence with data updates every 15 minutes.
- Tools for IP, CVE, domain, hash, and ransomware analysis.
- KEV Oracle predicts CVEs before CISA adds them.
- GhostWatch detects pre-attack infrastructure staging.
- Integrates multiple sources: URLhaus, VirusTotal, CIRCL, Shodan, etc.
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Keyboardcrumbs Threat IntelCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Add to claude_desktop_config.json:
{
"mcpServers": {
"keyboardcrumbs": {
"command": "uvx",
"args": ["--from", "git+https://github.com/keyboardcrumbs/mcp", "keyboardcrumbs-mcp"]
}
}
}
Once installed, just ask Claude:
- "Is 45.141.26.73 malicious?"
- "Should I patch CVE-2024-3400 immediately?"
- "What CVEs are about to be added to CISA KEV?"
- "Is this domain staging for an attack?"
- "What's the current threat landscape?"
Claude will call the live KeyboardCrumbs API and return real-time threat intelligence.
check_ip
Threat intel for any IP — risk score, geo, ASN, C2 associations, staging clusters
check_cve
CVE lookup — CVSS, EPSS, KEV status, exploit availability, patch urgency
check_domain
Domain intel — DNS records, WHOIS, malware associations, subdomains
check_hash
Malware hash lookup via VirusTotal (68+ engines) + CIRCL (6.3B files)
active_threats
Live snapshot — KEV count, active C2s, ransomware victims, data freshness
predict_kev
KEV Oracle — top CVEs predicted to be added to CISA KEV before it happens
check_staging
GhostWatch — detect pre-attack infrastructure staging for an IP or domain
check_ransomware
Ransomware group lookup and victim tracking
| Tool | Description |
|------|-------------|
| check_ip | Threat intel for any IP — risk score, geo, ASN, C2 associations, staging clusters |
| check_cve | CVE lookup — CVSS, EPSS, KEV status, exploit availability, patch urgency |
| check_domain | Domain intel — DNS records, WHOIS, malware associations, subdomains |
| check_hash | Malware hash lookup via VirusTotal (68+ engines) + CIRCL (6.3B files) |
| active_threats | Live snapshot — KEV count, active C2s, ransomware victims, data freshness |
| predict_kev | KEV Oracle — top CVEs predicted to be added to CISA KEV before it happens |
| check_staging | GhostWatch — detect pre-attack infrastructure staging for an IP or domain |
| check_ransomware | Ransomware group lookup and victim tracking |
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"keyboardcrumbs threat intel": {
"keyboardcrumbs": {
"command": "uvx",
"args": [
"--from",
"keyboardcrumbs-mcp",
"keyboardcrumbs-mcp"
]
}
}
}
}McpServers
{
"keyboardcrumbs": {
"command": "uvx",
"args": [
"--from",
"keyboardcrumbs-mcp",
"keyboardcrumbs-mcp"
]
}
}KeyboardCrumbs MCP Server
mcp-name: com.keyboardcrumbs/mcp
Live threat intelligence tools for Claude Desktop. Free, no API key required.
Tools
| Tool | Description |
|------|-------------|
| check_ip | Threat intel for any IP — risk score, geo, ASN, C2 associations, staging clusters |
| check_cve | CVE lookup — CVSS, EPSS, KEV status, exploit availability, patch urgency |
| check_domain | Domain intel — DNS records, WHOIS, malware associations, subdomains |
| check_hash | Malware hash lookup via VirusTotal (68+ engines) + CIRCL (6.3B files) |
| active_threats | Live snapshot — KEV count, active C2s, ransomware victims, data freshness |
| predict_kev | KEV Oracle — top CVEs predicted to be added to CISA KEV before it happens |
| check_staging | GhostWatch — detect pre-attack infrastructure staging for an IP or domain |
| check_ransomware | Ransomware group lookup and victim tracking |
Install
Option 1 — uvx (no install needed)
Add to claude_desktop_config.json:
{
"mcpServers": {
"keyboardcrumbs": {
"command": "uvx",
"args": ["--from", "git+https://github.com/keyboardcrumbs/mcp", "keyboardcrumbs-mcp"]
}
}
}
Option 2 — Clone and run locally
git clone https://github.com/keyboardcrumbs/mcp
cd mcp
uv venv && source .venv/bin/activate
uv add "mcp[cli]" httpx
Add to claude_desktop_config.json:
{
"mcpServers": {
"keyboardcrumbs": {
"command": "uv",
"args": ["--directory", "/path/to/mcp", "run", "server.py"]
}
}
}
Restart Claude Desktop.
Example Usage
Once installed, just ask Claude:
- "Is 45.141.26.73 malicious?"
- "Should I patch CVE-2024-3400 immediately?"
- "What CVEs are about to be added to CISA KEV?"
- "Is this domain staging for an attack?"
- "What's the current threat landscape?"
Claude will call the live KeyboardCrumbs API and return real-time threat intelligence.
Data Sources
URLhaus · Feodo Tracker · AlienVault OTX · CISA KEV · NVD · EPSS · ExploitDB ·
VirusTotal · CIRCL · SANS ISC DShield · Shodan · RIPE · crt.sh · Ransomware.live
Data updates every 15 minutes. No API key. No signup. No rate limits for normal use.
Links
- Dashboard: https://threats.keyboardcrumbs.com
- GhostWatch: https://ghost.keyboardcrumbs.com
- KEV Oracle: https://oracle.keyboardcrumbs.com
- API docs: https://api.keyboardcrumbs.com
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
