Loading…
Real-time threat intelligence for AI agents — 890K+ IOCs including prompt-injection and AI-skill threats.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The Nullcone Threat Intelligence MCP server exposes 30 tools, focused primarily on AI and developer capabilities. Its published description reads: "Real-time threat intelligence for AI agents — 890K+ IOCs including prompt-injection and AI-skill threats". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates Nullcone Threat Intelligence F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Data-exfiltration parameters" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check Nullcone Threat Intelligence's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add Nullcone Threat Intelligence to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://nullcone.ai/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Submit a threat indicator (IOC) to the shared intelligence network. The IOC is automatically classified into a malware family, metadata is compressed, and deduplication is handled atomically. All subs
Submit multiple IOCs in a single call. Preferred over looping submit_ioc for bulk ingest from honeypots, sandboxes, or feed processing. Each dict in `iocs` follows the same schema as submit_ioc parame
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: submit_ioc
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "context"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: submit_batch
A tool description tries to alter the model’s use of another tool.
ed over looping submit_ioc for bulk ingest from honeypots, sandboxes,RecommendationDescriptions must describe only their own tool.
tool: family_threats
A tool description tries to alter the model’s use of another tool.
amily. Use list_families() first to discover available family names.RecommendationDescriptions must describe only their own tool.
tool: list_families
A tool description tries to alter the model’s use of another tool.
tegory. Use family_threats(family_name) to retrieve the IOCs for a specifiRecommendationDescriptions must describe only their own tool.
tool: report_detection
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "context"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: report_detection
A tool description tries to alter the model’s use of another tool.
Signature (from submit_ioc or lookup_ioc) action: Action takRecommendationDescriptions must describe only their own tool.
tool: validate_skill
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "manifest_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: validate_skill
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
kup — call this before loading or invoking any MCP tool/skill to check it against the Nullcone threat fRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: scan_skill_content
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
skill-mediated credential exfiltration (CodeMax attack class, 2026-03RecommendationRemove side-channel parameters; constrain tool inputs.
tool: scan_skill_content
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
decode pipe to shell) - Multi-stage kill chain correlationRecommendationAnnotate destructive tools and require human approval.
tool: get_new_threats
A tool description tries to alter the model’s use of another tool.
instead of poll_since() when you need sub-second latency without maintRecommendationDescriptions must describe only their own tool.
tool: warm_prompt_cache
A tool description tries to alter the model’s use of another tool.
che. Subsequent check_prompt() calls require no network access. The cachRecommendationDescriptions must describe only their own tool.
tool: check_prompt_batch
A tool description tries to alter the model’s use of another tool.
nt than calling check_prompt() in a loop — tokenization overhead is amorRecommendationDescriptions must describe only their own tool.
tool: prompt_cache_stats
A tool description tries to alter the model’s use of another tool.
relying on check_prompt() for real-time detection.RecommendationDescriptions must describe only their own tool.
tool: freshness_limits
A tool description tries to alter the model’s use of another tool.
understand when check_freshness() will warn or block.RecommendationDescriptions must describe only their own tool.
tool: fingerprint_tool_metadata
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
tes — detecting credential exfiltration vectors, C2 callbacks, base64RecommendationRemove side-channel parameters; constrain tool inputs.
tool: subscribe_threats
A tool description tries to alter the model’s use of another tool.
_id. Pass it to drain_subscription() to collect the IOCs that have arrived sinRecommendationDescriptions must describe only their own tool.
tool: drain_subscription
A tool description tries to alter the model’s use of another tool.
tion created by subscribe_threats(). Returns all IOCs delivered to this subsRecommendationDescriptions must describe only their own tool.
tool: unsubscribe
A tool description tries to alter the model’s use of another tool.
ID returned by subscribe_threats() Returns: status: "ok" if removeRecommendationDescriptions must describe only their own tool.
tool: revoke_ioc
A tool description tries to alter the model’s use of another tool.
their next drain_subscription() call with event_type="revocation". Args:RecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
- Bulk ingest: submit_batch(iocs=[...]) - Incremental sync: poll_since(lastRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: report_detection
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "report_detection"RecommendationScope tools to the minimum needed.
tool: scan_skill_content
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "scan_skill_content"RecommendationScope tools to the minimum needed.
tool: get_new_threats
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get_new_threats"RecommendationScope tools to the minimum needed.
tool: warm_prompt_cache
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "warm_prompt_cache"RecommendationScope tools to the minimum needed.
tool: check_prompt
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "check_prompt"RecommendationScope tools to the minimum needed.
tool: registry_flagged_tools
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "registry_flagged_tools"RecommendationScope tools to the minimum needed.
tool: drain_subscription
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "drain_subscription"RecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Look up a threat signature by its exact IOC value. Returns the full signature record if found, including severity, family, detection count, and false positive votes. Args: value: The exact IOC value t
Return the most recently observed threat signatures. Args: limit: Max number of results to return (1-200) min_severity: Minimum severity level (0-10). Default 5 (medium+)
Return all threat signatures associated with a known malware family. Use list_families() first to discover available family names. Args: family_name: Exact malware family name (e.g. "emotet", "qbot",
Return all known malware families in the intelligence database. Each entry includes the family name, description, and category. Use family_threats(family_name) to retrieve the IOCs for a specific fami
Return threat signatures filtered by IOC type. Useful for pulling all known-bad IPs, all malicious domains, all malicious AI skill hashes, etc. Args: ioc_type: One of: hash_md5, hash_sha1, hash_sha256
Report that you detected and acted on a known threat signature. Increments the signature's detection count and creates a ThreatEvent visible to all other agents in real-time. Args: signature_id: ID of
Flag a threat signature as a likely false positive. When more than 20% of agents vote false positive on a signature, its `is_likely_fp` flag becomes True — a signal to review before blocking. Args: si
Fetch new threat signatures since a high-water mark ID. This is the recommended sync pattern — one call, get new data, persist next_id, disconnect. No persistent connection required. Call with last_id
Return aggregate statistics for the threat intelligence database. Includes total signatures, known malware families, active agents, and total detection events.
Synchronous SKILL IOC lookup — call this before loading or invoking any MCP tool/skill to check it against the Nullcone threat feed. This is the pre-invocation enforcement hook. Returns an allow/warn/
Pre-execution content scan for skill/instruction files. Analyzes the full text of a skill (markdown, plain text, SKILL.md, etc.) for malicious patterns BEFORE the agent follows the instructions. This
Drain the live push-subscription buffer of threats received since the last call. Zero-polling — threats are delivered via SpacetimeDB WebSocket subscription and buffered server-side. Use this instead
Load all PROMPT IOCs from SpacetimeDB into the in-memory hash set. Call once at startup (or after a major feed update) to populate the sub-1ms query cache. Subsequent check_prompt() calls require no n
Check a prompt or text fragment for known PROMPT IOC patterns. Uses an in-memory hash set for sub-1ms token-level querying — no network calls after the cache is warmed. Slides a window of 3, 5, 8, and
Check multiple prompts for PROMPT IOC patterns in a single call. More efficient than calling check_prompt() in a loop — tokenization overhead is amortized and the cache reference is shared. Args: text
Return PROMPT IOC cache statistics: size, hit rate, latency, refresh status. Use this to verify the cache is warmed and healthy before relying on check_prompt() for real-time detection.
Validate that IOC threat intelligence is fresh enough for the named action. Call this before any high-risk agent action to ensure the TI snapshot is not stale. The check itself completes in <1ms (no n
Return the configured IOC freshness limits for all action tiers. Shows max staleness, warn threshold, and which actions belong to each tier. Use this to understand when check_freshness() will warn or
Analyze an MCP tool definition for instruction-injection and malicious patterns. Performs semantic fingerprinting of the tool's description, parameter schemas, and error templates — detecting credenti
Return MCP registry monitoring statistics. Shows how many tool definitions are tracked, how many have been flagged, and the current drift detection rate.
Return all MCP tools that have been flagged as suspicious or malicious. Includes tools flagged on initial ingestion (high-risk fingerprint) and tools that showed significant semantic drift on update.
Open a named, stateful subscription to live threat push delivery. Returns a subscription_id. Pass it to drain_subscription() to collect the IOCs that have arrived since your last drain — zero polling,
Drain the buffer of a stateful subscription created by subscribe_threats(). Returns all IOCs delivered to this subscription since the last drain. Each subscription is independent — draining yours does
Cancel a stateful subscription and free its buffer. Call this when you no longer need the subscription to release memory. Subscriptions also auto-expire after 1 hour of inactivity. Args: subscription_
List all active stateful push subscriptions on this MCP server instance. Returns metadata for each subscription (not the buffered IOCs themselves). Useful for inspecting what agents are currently subs
Revoke an IOC by its value hash, pushing the expiration event to all active subscriptions in real-time. Call this when an IOC is determined to be a false positive, expired, or superseded. Subscribed a
Check whether an IOC has been revoked. O(1) in-process lookup. Use this before acting on any cached threat intelligence to ensure the IOC has not been retracted since it was loaded. Args: value_hash:
List recent IOC revocations, newest first. Args: limit: Maximum number of revocations to return (default 50). since_hours: Only return revocations newer than this many hours ago. 0 = no time filter (r