Scry

tunnelmind/scry-mcp

Wraps the Scry distributed attacker observation corpus as a single MCP tool. Right now it exposes scry_check, which queries GET /v1/check/{ip} for free IPv4 reputation lookups. Future tools like scry_watch, scry_actor, and scry_campaign are planned but require ATAP attestation and a defender tier subscription. The server runs on Cloudflare Workers at mcp.tunnelmind.ai, implements MCP spec 2025-03-26 over streamable HTTP, and acts as a stateless JSON-RPC 2.0 proxy with no bindings or secrets. Reach for this when you need threat intelligence on an IP address during incident triage or security workflows.

tool: 1
transport: HTTP
last updated: May 25, 2026

View on GitHub

Tools

1 tools

Public tool metadata for what this MCP can expose to an agent.

scry_checkWraps GET /v1/check/{ip} and is available on the Free tier.

Wraps GET /v1/check/{ip} and is available on the Free tier.

No parameter schema in public metadata yet.

Readme

scry-mcp

MCP (Model Context Protocol) server for the Scry corpus. Wraps the scry-api public endpoints as agent-callable tools.

Hosted at mcp.tunnelmind.ai. MCP spec version 2025-03-26. Streamable HTTP transport.

Tools (v0.1)

Tool	Wraps	Tier
`scry_check`	`GET /v1/check/{ip}`	Free

Future tools (deferred to defender tier; need ATAP attestation):

scry_watch — subscribe to state changes for an IP/domain
scry_actor — full actor profile
scry_campaign — campaign detail

Wire protocol

POST https://mcp.tunnelmind.ai/mcp
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"initialize"}

Methods:

initialize — handshake, returns { protocolVersion, capabilities, serverInfo }
notifications/initialized — client → server notification (returns 204)
tools/list — returns { tools: [...] }
tools/call — { name, arguments } → { content: [{ type: "text", text }] }
ping — returns {}

View the full README on GitHub

Details

Repository: github.com/tunnelmind/scry-mcp
Website: api.tunnelmind.ai
Transport: HTTP
Registry: MCP registry, active