Threatcheck
Check URLs, indicators and CVEs against threat intelligence before you act on them.
- tools
- 12
- transport
- STDIO
- last updated
- Nov 10, 2026
Tools
12 toolsPublic tool metadata for what this MCP can expose to an agent.
scan_before_usescan untrusted content for prompt injection and check the URLs, domains and IPs it contains before acting on it.
scan untrusted content for prompt injection and check the URLs, domains and IPs it contains before acting on it.
No parameter schema in public metadata yet.
check_urlthe cheap pre-fetch gate for one URL, domain or IP.
the cheap pre-fetch gate for one URL, domain or IP.
No parameter schema in public metadata yet.
check_indicatorthe full reputation picture for one indicator: an IP, domain, URL, file hash (MD5, SHA-1 or SHA-256), email address or phone number, with defanged forms accepted.
the full reputation picture for one indicator: an IP, domain, URL, file hash (MD5, SHA-1 or SHA-256), email address or phone number, with defanged forms accepted.
No parameter schema in public metadata yet.
get_cveone CVE in full: description, severity, CVSS, EPSS, CISA KEV status, exploitation evidence, affected packages and vendor advisories.
one CVE in full: description, severity, CVSS, EPSS, CISA KEV status, exploitation evidence, affected packages and vendor advisories.
No parameter schema in public metadata yet.
recent_cvesthe most recently published CVEs, newest first, at most 20.
the most recently published CVEs, newest first, at most 20.
No parameter schema in public metadata yet.
search_indicatorsfind listed domains that look like a brand or domain: typosquats, homoglyphs, the same name on other TLDs, phishing-word wrappers.
find listed domains that look like a brand or domain: typosquats, homoglyphs, the same name on other TLDs, phishing-word wrappers.
No parameter schema in public metadata yet.
check_indicatorsreputation for up to 100 indicators in one call, mixed kinds, defanged forms accepted.
reputation for up to 100 indicators in one call, mixed kinds, defanged forms accepted.
No parameter schema in public metadata yet.
scan_emailscan one email message for phishing and malware before delivering or opening it.
scan one email message for phishing and malware before delivering or opening it.
No parameter schema in public metadata yet.
exploited_cvesCVEs with attested exploitation in a recent window.
CVEs with attested exploitation in a recent window.
No parameter schema in public metadata yet.
watch_domainstart daily vulnerability monitoring of one public website you run.
start daily vulnerability monitoring of one public website you run.
No parameter schema in public metadata yet.
watch_dependenciesstart vulnerability monitoring of a project from the text of its lockfile or SBOM (pass the content, not a path).
start vulnerability monitoring of a project from the text of its lockfile or SBOM (pass the content, not a path).
No parameter schema in public metadata yet.
ack_findingset the status of one of your own monitoring findings: ACKNOWLEDGED, PATCHED, NOT_AFFECTED, or SNOOZED (with snoozedUntil, at most 90 days ahead).
set the status of one of your own monitoring findings: ACKNOWLEDGED, PATCHED, NOT_AFFECTED, or SNOOZED (with snoozedUntil, at most 90 days ahead).
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
threatcheck
threatcheck puts a threat-intelligence gate in front of the things an agent is about to touch. Before a fetched page, email, ticket or tool result gets acted on, it can be scanned for prompt injection and for the URLs, domains and IPs buried in it. Before a link gets opened, a single indicator — an address, a hash, an email, a phone number — can be looked up for a reputation verdict with a risk score and the blocklists citing it. CVEs can be read in detail, listed fresh off the press, or listed by confirmed exploitation in the wild. And a site you run, or a project's dependency file, can be put under daily watch so new findings arrive as they open.
Details
- Repository
- github.com/cloudcorprecords/threatcheck
- Package
@reneturcios/threatcheck- Transport
- STDIO
- Registry
- MCP registry, active