Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "dragonseye": {
      "type": "http",
      "url": "https://api.ransomware-tracker.com/mcp"
    }
  }
}

claude mcp add --transport http dragonseye https://api.ransomware-tracker.com/mcp

[mcp_servers.dragonseye]
url = "https://api.ransomware-tracker.com/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dragonseye": {
      "type": "remote",
      "url": "https://api.ransomware-tracker.com/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "dragonseye": {
      "type": "http",
      "url": "https://api.ransomware-tracker.com/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=dragonseye&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vYXBpLnJhbnNvbXdhcmUtdHJhY2tlci5jb20vbWNwIn0%3D"
}

{
  "servers": {
    "dragonseye": {
      "type": "http",
      "url": "https://api.ransomware-tracker.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "dragonseye": {
      "httpUrl": "https://api.ransomware-tracker.com/mcp"
    }
  }
}

extensions:
  "dragonseye":
    enabled: true
    name: "dragonseye"
    type: streamable_http
    uri: "https://api.ransomware-tracker.com/mcp"
    timeout: 300

Quality 79 / 100good

protocol88 · weight 25

pass
protocol.modernsupports 2026-07-28 (server/discover)
pass
protocol.statelessanswers without a session
pass
protocol.transportstreamable HTTP
warn
protocol.list_ttltools/list declares ttlMs 0, so clients re-fetch it on every use

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene100 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations16 of 16 tools declare readOnlyHint or destructiveHint
pass
tools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
pass
tools.token_costabout 3,110 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability25 · weight 15

warn
stability.changes18 tool changes in 30 days
fail
stability.rug_pull5 tools kept their name but changed most of their description in 30 days; review before trusting them

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

16 tools, about 3,110 tokens to load them all · tool set cf181cefae95 · tools last changed 2026-10-17 · checked 2026-10-20 12:13 UTC

Tool changes

2026-10-17cve_batch_intelchangeddescription
before
cve_intel for up to 50 CVEs in one call. Charged only if at least half are cached; otherwise an error lists the covered ids (not charged). Costs $0.50 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
after · 81% of words in common
cve_intel for up to 50 CVEs in one call. Charged only if every CVE is cached; otherwise an error lists the ids with no data and the covered ids to retry with (not charged). Costs $0.50 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
2026-10-17coverageadded
Free. Indicator-feed freshness and the CVE ids and ransomware groups currently cached for cve_intel and group_intel.
2026-10-17group_inteladded
Threat-hunting profile of one active ransomware group: total and recent leak-site listings with a momentum status, reported tools, malware, campaigns, ATT&CK techniques and CVEs co-mentioned in public reporting (co-mention, not attribution), recent headlines and suggested D3FEND countermeasures. Use group_profile for its claim sample. Uncached groups return an error (queued, not charged). Costs $0.05 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
2026-10-17cve_batch_inteladded
cve_intel for up to 50 CVEs in one call. Charged only if at least half are cached; otherwise an error lists the covered ids (not charged). Costs $0.50 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
2026-10-17cve_inteladded
Everything an agent needs to prioritize one CVE: CVSS, affected vendors/products, vendor advisories, CISA KEV status and known ransomware use, EPSS, recorded public exploit repositories, an AI-generated attack flow with ATT&CK technique ids (flagged as AI-generated) and suggested MITRE D3FEND countermeasures. CVEs not cached yet return an error (queued, not charged); check cve_status (free) first. Costs $0.03 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
2026-10-17cve_statusadded
Free. CISA KEV status (date added, due date, known ransomware campaign use, required action), EPSS when known, and whether paid cve_intel detail is cached for this CVE.
2026-10-17indicator_batch_checkadded
Same as indicator_check for up to 100 domains or IPv4 addresses in one call (one flat price). Costs $0.25 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
2026-10-17indicator_checkadded
Check one domain (or its parent domains) or IPv4 address against ThreatCluster's high-confidence 30-day IOC feed: is it listed as attacker infrastructure (C2, phishing, malware delivery) in recent threat reporting? Returns listed/not_listed, match type, reason, linked reports and clusters. Use it before opening a link, in email triage or SOC enrichment. Not listed is not proof of safety. Served from an hourly cache; a stale feed returns an error and is not charged. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
2026-10-15watch_statusadded
Free. Status of a paid vendor watch (created with HTTP POST /v1/watch): items, expiry, last check, last webhook delivery.
2026-10-15bulk_vendor_checkadded
Check up to 100 vendors (domains or company names) for ransomware leak-site claims in one call: per vendor, matching claims (group, dates, sources), claim count and groups. Raw claims only; use vendor_risk_report for risk levels, a summary and actions. Every result is an unverified claim from a criminal leak site, not a confirmed breach; found=false is not proof of absence. Fails (not charged) if the source is down for more than 25% of vendors. Read-only. Costs $0.50 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.

Showing the latest 10. Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 82 / 100

no-repository

provenance55

liveness98

freshness100

hygiene80

+dns-namespace +website +reachable +uptime-95% +updated-3d-ago -no-repository

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://api.ransomware-tracker.com/mcp` streamable-http	none	yes	95%	341 ms	2026-07-28	2026-10-20

Tools (16)

`batch_exposure_check`read-only	Check up to 25 vendor or supplier domains in one call for ransomware leak-site claims, for third-party-risk reviews. Returns one result per domain (found, claim count, claims with group, dates and sources). Domains only; use lookup_victim for company names. At most 15 claim records are read per batch, so a domain with many matches is marked partial. Every result is an unverified claim from a criminal leak site, not a confirmed breach; found=false is not proof of absence. Read-only; one flat price. Costs $0.05 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`bulk_vendor_check`read-only	Check up to 100 vendors (domains or company names) for ransomware leak-site claims in one call: per vendor, matching claims (group, dates, sources), claim count and groups. Raw claims only; use vendor_risk_report for risk levels, a summary and actions. Every result is an unverified claim from a criminal leak site, not a confirmed breach; found=false is not proof of absence. Fails (not charged) if the source is down for more than 25% of vendors. Read-only. Costs $0.50 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`coverage`read-only	Free. Indicator-feed freshness and the CVE ids and ransomware groups currently cached for cve_intel and group_intel.
`cve_batch_intel`read-only	cve_intel for up to 50 CVEs in one call. Charged only if every CVE is cached; otherwise an error lists the ids with no data and the covered ids to retry with (not charged). Costs $0.50 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`cve_intel`read-only	Everything an agent needs to prioritize one CVE: CVSS, affected vendors/products, vendor advisories, CISA KEV status and known ransomware use, EPSS, recorded public exploit repositories, an AI-generated attack flow with ATT&CK technique ids (flagged as AI-generated) and suggested MITRE D3FEND countermeasures. CVEs not cached yet return an error (queued, not charged); check cve_status (free) first. Costs $0.03 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`cve_status`read-only	Free. CISA KEV status (date added, due date, known ransomware campaign use, required action), EPSS when known, and whether paid cve_intel detail is cached for this CVE.
`group_intel`read-only	Threat-hunting profile of one active ransomware group: total and recent leak-site listings with a momentum status, reported tools, malware, campaigns, ATT&CK techniques and CVEs co-mentioned in public reporting (co-mention, not attribution), recent headlines and suggested D3FEND countermeasures. Use group_profile for its claim sample. Uncached groups return an error (queued, not charged). Costs $0.05 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`group_profile`read-only	Get a profile of one ransomware group: aliases, when RansomLook first observed it, and a sample of its newest claims. Use it to understand who a group is; use recent_claims for a longer list of its latest claims. Unknown groups return an error and are not charged. Every claim is an unverified claim from a criminal leak site, not a confirmed breach. Read-only. Costs $0.02 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`indicator_batch_check`read-only	Same as indicator_check for up to 100 domains or IPv4 addresses in one call (one flat price). Costs $0.25 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`indicator_check`read-only	Check one domain (or its parent domains) or IPv4 address against ThreatCluster's high-confidence 30-day IOC feed: is it listed as attacker infrastructure (C2, phishing, malware delivery) in recent threat reporting? Returns listed/not_listed, match type, reason, linked reports and clusters. Use it before opening a link, in email triage or SOC enrichment. Not listed is not proof of safety. Served from an hourly cache; a stale feed returns an error and is not charged. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`lookup_victim`read-only	Search ransomware leak-site claims for one company name or domain: has a group claimed it? Returns matching claims with group, claimed date, first-observed date, country, sector and licensed sources. Use it for a single vendor or target; use batch_exposure_check for a list of up to 25 vendor domains, and recent_claims for the newest claims overall. Every result is an unverified claim from a criminal leak site, not a confirmed breach, and found=false is not proof of absence (only commercially reusable sources are covered). Read-only, live lookup. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`pricing`read-only	Free. Return the price of every paid tool, the payment network (Base) and address, the licensed data sources, and the 'unverified claim' label every result carries. No input, no network request, no payment.
`recent_claims`read-only	List the newest ransomware leak-site claims (1-10), optionally filtered to one group such as akira or qilin. Use it to watch recent activity; use lookup_victim to search for a specific company. Only commercially reusable sources are used, so country and sector are often null. Every result is an unverified claim from a criminal leak site, not a confirmed breach. Read-only. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`validate_query`read-only	Free. Check and normalize a company name or domain before calling lookup_victim; tells you whether it will be searched as a domain or a name. Offline: no network request, no payment.
`vendor_risk_report`read-only	Build a third-party ransomware risk report for up to 100 vendors (domains or company names). For each vendor: matching leak-site claims (group, claimed and first-observed dates, sources), a risk level (high = claim in the last 90 days, elevated = last 12 months, historical, none_found, unknown) and follow-up actions; plus a portfolio summary with priority vendors and the groups involved. Use it for vendor reviews and audits; use batch_exposure_check for a cheaper raw check of up to 25 domains. Every result is an unverified claim from a criminal leak site, not a confirmed breach; none_found is not proof of absence. Fails (not charged) if the source is down for more than 25% of vendors. Read-only; one flat price. Costs $3 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged.
`watch_status`read-only	Free. Status of a paid vendor watch (created with HTTP POST /v1/watch): items, expiry, last check, last webhook delivery.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "com.ransomware-tracker.api/dragonseye",
  "icons": [
    {
      "src": "https://api.ransomware-tracker.com/favicon.svg",
      "sizes": [
        "any"
      ],
      "mimeType": "image/svg+xml"
    }
  ],
  "title": "Dragons Eye Ransomware Claims",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://api.ransomware-tracker.com/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "1.5.0",
  "websiteUrl": "https://api.ransomware-tracker.com/llms.txt",
  "description": "Ransomware claim lookups, IOC and CVE intel, group intel, bulk checks and watch alerts (x402 USDC)."
}