Search / ai.tunnelmind/scry
Free IPv4 lookups against a distributed attacker-observation corpus.
v0.5.0 · active · repository · website · descriptor JSON · versions
protogrid{
"mcpServers": {
"scry": {
"type": "http",
"url": "https://mcp.tunnelmind.ai/mcp"
}
}
}claude mcp add --transport http scry https://mcp.tunnelmind.ai/mcp[mcp_servers.scry]
url = "https://mcp.tunnelmind.ai/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"scry": {
"type": "remote",
"url": "https://mcp.tunnelmind.ai/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"scry": {
"type": "http",
"url": "https://mcp.tunnelmind.ai/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=scry&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWNwLnR1bm5lbG1pbmQuYWkvbWNwIn0%3D"
}{
"servers": {
"scry": {
"type": "http",
"url": "https://mcp.tunnelmind.ai/mcp"
}
}
}{
"mcpServers": {
"scry": {
"httpUrl": "https://mcp.tunnelmind.ai/mcp"
}
}
}extensions:
"scry":
enabled: true
name: "scry"
type: streamable_http
uri: "https://mcp.tunnelmind.ai/mcp"
timeout: 300
protocol.modernnewest supported version is 2025-03-26; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_lengthdescriptions are concisetools.schemasevery tool has an object input schematools.annotationsno tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky onestools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: scry_check (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); scry_check_bulk (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); scry_asn (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …tools.token_costabout 1,133 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changesno tool changes in 30 daysstability.rug_pullno tool changed its meaning under the same namedeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageNo tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +namespace-matches-repo +dns-namespace +website -unreachable(1 failures) ~updated-147d-ago
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://mcp.tunnelmind.ai/mcp streamable-http | none | no (1 failures) | 90% | 510 ms | 2025-03-26 | 2026-10-18 |
scry_asn | Roll-up of corpus activity for a single ASN — observation count, distinct source IPs, actor count, scanner count, high-confidence actor count, and per-protocol breakdown. |
scry_campaign | Single campaign detail by id (format: c[0-9a-f]{15}). |
scry_campaigns | Active threat campaigns — coordinated attacker activity that exceeds the noise floor. ≥5 distinct actors, ≥3 ASNs, ≤5 destination ports, ≥1h history. |
scry_check | Returns Scry's corpus knowledge for a single IPv4 address: when it was first/last observed, observation count, protocols and ports targeted, ASN, country, category (actor/scanner/not_observed), and confidence_bucket (low/medium/high). Use when an agent needs IP triage, hostility assessment, or risk signaling. Do NOT use for raw payloads (never exposed) or IPv6 (corpus is v4-only at v0.1). |
scry_check_bulk | Look up many IPv4 addresses in one request. Up to 100 IPs per call. Same per-IP shape as scry_check, keyed by IP. |
scry_country | Roll-up of corpus activity by ISO country code. Same shape as scry_asn. |
scry_recent | Recent observations feed — aggregated by source IP within a time window. Cursor-paginated via since_ms. |
scry_stats | Returns aggregate Scry corpus telemetry: total observation count, distinct source IPs, first/last observation timestamps, last-24h activity, and per-protocol breakdowns. Useful as a liveness/density check before issuing per-IP queries — lets an agent decide whether the corpus has enough data to be authoritative. Use this tool when: - An agent is planning a multi-step investigation and wants to know if Scry has corpus density worth querying. - You want a 'corpus health' signal in a dashboard or report. Do NOT use this tool when: - You want details about a specific IP — use `scry_check`. - You want sensor fleet size or node identities — never exposed at any tier. Inputs: none. Returns: total_observations, distinct_source_ips, first_seen_ms, last_seen_ms, observations_last_24h, distinct_source_ips_last_24h, by_protocol, as_of_ms. Cost: free, anonymous, rate-limited. Latency: <100ms typical. |
scry_timeseries | Bucketed observation counts over time. Detect bursts, plot trends, sanity-check whether attacker activity is rising or falling. |
scry_tool | Single tool detail by 16-char hex id from scry_tools. |
scry_tools | List detected attack tools — (protocol, payload, path) tuples sent by 3+ distinct source IPs. Aggregate metadata only; never lists member actors. |
scry_top | Top-N source dimensions over a time window. Useful for situational awareness — 'where is the noise coming from right now?' |
Schemas: list_tools.
{
"name": "ai.tunnelmind/scry",
"title": "Scry",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://mcp.tunnelmind.ai/mcp",
"type": "streamable-http"
}
],
"version": "0.5.0",
"repository": {
"url": "https://github.com/TunnelMind/scry-mcp",
"source": "github"
},
"websiteUrl": "https://api.tunnelmind.ai",
"description": "Free IPv4 lookups against a distributed attacker-observation corpus."
}