Next free-source huntWe check for new free data every weekday.
Cyber ThreatMCP serverFirst audited Nov 13, 2026

Nullcone Threat Intelligence

Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threatsThe vendor's description, from its MCP Registry listing.

Passed, with 2 warningsAudited Nov 13, 2026
  • Warning: 30 of 30 tools do not say whether they can change things.
  • Warning: Tool text contains phrasing worth a human review.

Nothing failed, but there is something to know or fix. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit

Does it work?
YesConnected in 111 ms.
Sign-up?
None neededIt answered without any account or key.
Can it change things?
Doesn't sayIts tools do not say whether they only read, so treat them as able to change things.
Endpointhttps://nullcone.ai/mcp

Source code Website Streamable HTTP · protocol 2025-11-25 · server version 1.30.0

What we checked, the evidence, and the tools it offers.

What we checked

Security

  • Warning: Tool text contains phrasing worth a human review.

    • Mentions a file that usually holds secrets (tool scan_skill_content: description): "…n) - Bootstrap file modification (.npmrc, NODE_OPTIONS, LD_PRELOAD) - Encr…"

  • Passed: Connections are encrypted (HTTPS).

Safety labels

  • Warning: 30 of 30 tools do not say whether they can change things.

    MCP lets a server label each tool as read-only or destructive, so clients can ask the user before risky calls. Unlabelled tools are treated as able to change things.

    • submit_ioc
    • submit_batch
    • lookup_ioc
    • recent_threats
    • family_threats
    • list_families
    • search_by_type
    • report_detection
    • and 22 more

Tools

  • Passed: 30 tools listed.

  • Passed: Every tool describes its inputs with a valid schema.

Protocol

  • Passed: The MCP handshake works (Streamable HTTP).

  • Passed: Protocol version 2025-11-25 (latest).

  • Passed: Unknown requests are refused.

Connection

  • Passed: The server responds.

Tools (30)

As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.

  • submit_ioc Submit a threat indicator (IOC) to the shared intelligence network. The IOC is automatically classified into a malware family, metadata is compressed, and deduplication is handled atomi…Doesn't say
  • submit_batch Submit multiple IOCs in a single call. Preferred over looping submit_ioc for bulk ingest from honeypots, sandboxes, or feed processing. Each dict in `iocs` follows the same schema as su…Doesn't say
  • lookup_ioc Look up a threat signature by its exact IOC value. Returns the full signature record if found, including severity, family, detection count, and false positive votes. Args:…Doesn't say
  • recent_threats Return the most recently observed threat signatures. Args: limit: Max number of results to return (1-200) min_severity: Minimum severity level (0-10). Default 5 (medi…Doesn't say
  • family_threats Return all threat signatures associated with a known malware family. Use list_families() first to discover available family names. Args: family_name: Exact malware family name…Doesn't say
  • list_families Return all known malware families in the intelligence database. Each entry includes the family name, description, and category. Use family_threats(family_name) to retrieve the IOCs for…Doesn't say
  • search_by_type Return threat signatures filtered by IOC type. Useful for pulling all known-bad IPs, all malicious domains, all malicious AI skill hashes, etc. Args: ioc_type: One of:…Doesn't say
  • report_detection Report that you detected and acted on a known threat signature. Increments the signature's detection count and creates a ThreatEvent visible to all other agents in real-time. Args:…Doesn't say
  • vote_false_positive Flag a threat signature as a likely false positive. When more than 20% of agents vote false positive on a signature, its `is_likely_fp` flag becomes True — a signal to review before blo…Doesn't say
  • poll_since Fetch new threat signatures since a high-water mark ID. This is the recommended sync pattern — one call, get new data, persist next_id, disconnect. No persistent connection required.…Doesn't say
  • get_stats Return aggregate statistics for the threat intelligence database. Includes total signatures, known malware families, active agents, and total detection events. Doesn't say
  • validate_skill Synchronous SKILL IOC lookup — call this before loading or invoking any MCP tool/skill to check it against the Nullcone threat feed. This is the pre-invocation enforcement hook. Returns…Doesn't say
  • scan_skill_content Pre-execution content scan for skill/instruction files. Analyzes the full text of a skill (markdown, plain text, SKILL.md, etc.) for malicious patterns BEFORE the agent follows the inst…Doesn't say
  • get_new_threats Drain the live push-subscription buffer of threats received since the last call. Zero-polling — threats are delivered via SpacetimeDB WebSocket subscription and buffered server-side.…Doesn't say
  • warm_prompt_cache Load all PROMPT IOCs from SpacetimeDB into the in-memory hash set. Call once at startup (or after a major feed update) to populate the sub-1ms query cache. Subsequent check_prompt() cal…Doesn't say
  • check_prompt Check a prompt or text fragment for known PROMPT IOC patterns. Uses an in-memory hash set for sub-1ms token-level querying — no network calls after the cache is warmed. Slides a window…Doesn't say
  • check_prompt_batch Check multiple prompts for PROMPT IOC patterns in a single call. More efficient than calling check_prompt() in a loop — tokenization overhead is amortized and the cache reference is sha…Doesn't say
  • prompt_cache_stats Return PROMPT IOC cache statistics: size, hit rate, latency, refresh status. Use this to verify the cache is warmed and healthy before relying on check_prompt() for real-time detection.…Doesn't say
  • check_freshness Validate that IOC threat intelligence is fresh enough for the named action. Call this before any high-risk agent action to ensure the TI snapshot is not stale. The check itself complete…Doesn't say
  • freshness_limits Return the configured IOC freshness limits for all action tiers. Shows max staleness, warn threshold, and which actions belong to each tier. Use this to understand when check_freshness(…Doesn't say
  • fingerprint_tool_metadata Analyze an MCP tool definition for instruction-injection and malicious patterns. Performs semantic fingerprinting of the tool's description, parameter schemas, and error templates — det…Doesn't say
  • registry_monitor_stats Return MCP registry monitoring statistics. Shows how many tool definitions are tracked, how many have been flagged, and the current drift detection rate. Doesn't say
  • registry_flagged_tools Return all MCP tools that have been flagged as suspicious or malicious. Includes tools flagged on initial ingestion (high-risk fingerprint) and tools that showed significant semantic dr…Doesn't say
  • subscribe_threats Open a named, stateful subscription to live threat push delivery. Returns a subscription_id. Pass it to drain_subscription() to collect the IOCs that have arrived since your last drain…Doesn't say
  • drain_subscription Drain the buffer of a stateful subscription created by subscribe_threats(). Returns all IOCs delivered to this subscription since the last drain. Each subscription is independent — drai…Doesn't say
  • unsubscribe Cancel a stateful subscription and free its buffer. Call this when you no longer need the subscription to release memory. Subscriptions also auto-expire after 1 hour of inactivity.…Doesn't say
  • list_subscriptions List all active stateful push subscriptions on this MCP server instance. Returns metadata for each subscription (not the buffered IOCs themselves). Useful for inspecting what agents are…Doesn't say
  • revoke_ioc Revoke an IOC by its value hash, pushing the expiration event to all active subscriptions in real-time. Call this when an IOC is determined to be a false positive, expired, or super…Doesn't say
  • is_ioc_revoked Check whether an IOC has been revoked. O(1) in-process lookup. Use this before acting on any cached threat intelligence to ensure the IOC has not been retracted since it was loaded.…Doesn't say
  • list_revocations List recent IOC revocations, newest first. Args: limit: Maximum number of revocations to return (default 50). since_hours: Only return revocations newer than this many…Doesn't say

Audit history

  1. Nov 13Warnings

What we sent

Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.

RequestAnswerTime
initializeHTTP 200111 ms
initializedHTTP 20261 ms
tools/listHTTP 20042 ms
resources/listHTTP 20022 ms
prompts/listHTTP 20028 ms
unknown-methodHTTP 20027 ms

Run this server, or disagree with the result?

Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.