README.md
Live threat intelligence tools for Claude Desktop.
KeyboardCrumbs MCP Server
mcp-name: com.keyboardcrumbs/mcp
Live threat intelligence tools for Claude Desktop. Free, no API key required.
Tools
| Tool | Description |
|---|---|
check_ip |
Threat intel for any IP — risk score, geo, ASN, C2 associations, staging clusters |
check_cve |
CVE lookup — CVSS, EPSS, KEV status, exploit availability, patch urgency |
check_domain |
Domain intel — DNS records, WHOIS, malware associations, subdomains |
check_hash |
Malware hash lookup via VirusTotal (68+ engines) + CIRCL (6.3B files) |
active_threats |
Live snapshot — KEV count, active C2s, ransomware victims, data freshness |
predict_kev |
KEV Oracle — top CVEs predicted to be added to CISA KEV before it happens |
check_staging |
GhostWatch — detect pre-attack infrastructure staging for an IP or domain |
check_ransomware |
Ransomware group lookup and victim tracking |
Install
Option 1 — uvx (no install needed)
Add to claude_desktop_config.json:
{
"mcpServers": {
"keyboardcrumbs": {
"command": "uvx",
"args": ["--from", "git+https://github.com/keyboardcrumbs/mcp", "keyboardcrumbs-mcp"]
}
}
}
Option 2 — Clone and run locally
git clone https://github.com/keyboardcrumbs/mcp
cd mcp
uv venv && source .venv/bin/activate
uv add "mcp[cli]" httpx
Add to claude_desktop_config.json:
{
"mcpServers": {
"keyboardcrumbs": {
"command": "uv",
"args": ["--directory", "/path/to/mcp", "run", "server.py"]
}
}
}
Restart Claude Desktop.
Example Usage
Once installed, just ask Claude:
- "Is 45.141.26.73 malicious?"
- "Should I patch CVE-2024-3400 immediately?"
- "What CVEs are about to be added to CISA KEV?"
- "Is this domain staging for an attack?"
- "What's the current threat landscape?"
Claude will call the live KeyboardCrumbs API and return real-time threat intelligence.
Data Sources
URLhaus · Feodo Tracker · AlienVault OTX · CISA KEV · NVD · EPSS · ExploitDB · VirusTotal · CIRCL · SANS ISC DShield · Shodan · RIPE · crt.sh · Ransomware.live
Data updates every 15 minutes. No API key. No signup. No rate limits for normal use.
Links
- Dashboard: https://threats.keyboardcrumbs.com
- GhostWatch: https://ghost.keyboardcrumbs.com
- KEV Oracle: https://oracle.keyboardcrumbs.com
- API docs: https://api.keyboardcrumbs.com
Tools (8)
check_ipProvides threat intel for any IP including risk score, geo, ASN, C2 associations, and staging clusters.check_cvePerforms CVE lookup including CVSS, EPSS, KEV status, exploit availability, and patch urgency.check_domainProvides domain intel including DNS records, WHOIS, malware associations, and subdomains.check_hashPerforms malware hash lookup via VirusTotal and CIRCL.active_threatsProvides a live snapshot of KEV counts, active C2s, ransomware victims, and data freshness.predict_kevPredicts top CVEs likely to be added to the CISA KEV list.check_stagingDetects pre-attack infrastructure staging for an IP or domain.check_ransomwareProvides ransomware group lookup and victim tracking.Configuration
claude_desktop_config.json
{"mcpServers": {"keyboardcrumbs": {"command": "uvx", "args": ["--from", "git+https://github.com/keyboardcrumbs/mcp", "keyboardcrumbs-mcp"]}}}Try it
→Is 45.141.26.73 malicious?
→Should I patch CVE-2024-3400 immediately?
→What CVEs are about to be added to CISA KEV?
→Is this domain staging for an attack?
→What's the current threat landscape?