Jeevesus — DugganUSA threat-intel MCP

Searches threat-intelligence records about threat actors, malware, campaigns, CVEs, breaches, vendors and indicators. The default search covers security topics only; a few public-document archives can be searched by naming them (listed below). It holds no general programming o...

Looks up an IP address, domain, URL or file hash, such as one from a message, log line, SIEM alert or code under review. Look up a single indicator of compromise (IP, domain, URL, or hash) in the DugganUSA corpus. Returns the threat type, malware family, confidence and referen...

Summarizes what is in the feed right now: useful for "what's active this week", feed freshness, or planning SIEM / blocklist ingestion. Shape report on the most recent 5,000 indicators in the DugganUSA STIX 2.1 feed, bounded to a 1-7 day window. Returns how many of those fall...

Looks up what an AI model or an agent session costs at list price. Prices are dated and copied from each provider's own pricing page. Returns the per-1M-token USD rates for a model (input, output, and for Anthropic models the 5-minute and 1-hour cache write, cache read and fas...

Shows where confirmed exploitation concentrates for a vendor or product (Microsoft, Cisco, Fortinet, an appliance, an ERP), for questions like "what should I patch first". Vendor / product risk matrix built from CISA's Known Exploited Vulnerabilities (KEV) catalog — where real...

Measures whether a product's exploitation risk is chronic or a one-off, for patch prioritization. Does in-the-wild exploitation risk STICK to proven products, or SPREAD to new ones? Analyzes CISA KEV: correlates each product's historical known-exploited count against its RECEN...

Checks whether a dependency (npm, PyPI, RubyGems or Packagist/Composer, or a GitHub Action used in a workflow) is on the DugganUSA malicious-package deny-list or has published advisories. Suited to a pre-install step in an agent or a CI pipeline, against slopsquatting and hija...

Checks the text of one GitHub Actions workflow file for script injection: places where text an outside user controls (an issue or pull request title or body, a comment, a branch name, a commit message) is pasted into a shell script or a github-script body, a privileged trigger...

Before you open or run a repository someone else sent you (a recruiter's coding test, a downloaded zip, a proof of concept), pass it the few files that matter and get a verdict. It looks for the places a lure hides that a dependency check never reads: npm install hooks that fe...