About Isc Sans
Isc Sans is an MCP server published by pipeworx-io in the Other category: sANS Internet Storm Center (ISC) MCP.
Recent commit activity is the strongest signal that reported issues will get attention.
Install
git clone https://github.com/pipeworx-io/mcp-isc-sansThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (3)
ip_reputationLook up an IPv4 address in the SANS ISC DShield database — its attack-report history, ASN/owner, abuse contact, and risk. A high report_count means the IP is an active attack source (firewall logs submitted by sensors worldwide). report_count null/0 = no malicious activity reported. The comment field often names known infrastructure (e.g. "Google public recursive name server"). Keyless.
Parameters not published.
port_activityGet recent attack/probe activity for a TCP/UDP port from SANS ISC — daily counts of report records, distinct target IPs, and distinct source IPs hitting the port. Useful for spotting scanning surges against services like SSH (22), RDP (3389), SMB (445), or Telnet (23). Keyless.
Parameters not published.
threat_levelGet the global SANS ISC InfoCon threat level — the internet-wide "weather report" for malicious activity. Returns one of green/yellow/orange/red with a plain-English meaning. An at-a-glance signal of whether a major internet-scale event is underway. Keyless, no arguments.
Parameters not published.
Ask AI
Ask AI about Isc Sans
Powered by Claude · Grounded in docs
Security checks
6 checks have not been run yet.