Jeevesus — DugganUSA threat-intel MCP

Install

Works with Claude Code, VS Code, Cursor, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install connector/pduggusa-dugganusa-threat-intel

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

7 read · 0 write · 0 deleteRead-only

Secrets

None asked for

Install scripts

Nothing to install (hosted)

Runs as

Hosted (remote endpoint)

Tools (7)

As the server listed them on Oct 25, 2026. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• ai-model-priceLook up AI model pricesread-only

  Looks up what an AI model or an agent session costs at list price. Prices are dated and copied from each provider's own pricing page. Returns the per-1M-token USD rates for a model (input, output, and for Anthropic models the 5-minute and 1-hour cache write, cache read and fast-mode rates), the date the provider page was checked, and the page it came from. Pass token counts to get an exact list-price cost for a call or a whole session. With no args: lists every priced model and each provider's checked date. With {"model":"claude-opus-5-5","input_tokens":2,"cache_read_tokens":300000,"output_t…

• check-packageCheck a package before installread-only

  Checks whether a dependency (npm, PyPI or RubyGems, or a GitHub Action used in a workflow) is on the DugganUSA malicious-package deny-list or has published advisories. Suited to a pre-install step in an agent or a CI pipeline, against slopsquatting and hijacked-package attacks. Returns a crisp, machine-actionable verdict: {ecosystem, package, version, malicious, verdict:"block"|"allow"|"review", reason, advice, source}. `malicious:true` = the exact package is on our OSV-curated deny-list (230k+ named-not-heuristic entries across npm + PyPI + RubyGems; RubyGems coverage is thin, so lean on the…

• enrich-iocEnrich an indicatorread-only

  Looks up an IP address, domain, URL or file hash, such as one from a message, log line, SIEM alert or code under review. Look up a single indicator of compromise (IP, domain, URL, or hash) in the DugganUSA corpus. Returns the threat type, malware family, confidence and references of the record with the strongest attribution (first-party, then curated, then third-party; not necessarily the highest confidence), the attributed actor if any record names one, and a `sources` list with each record's source, actor, confidence, first-seen date (when it entered our corpus, not when it was first observ…

• kev-exploitation-stickinessKEV exploitation stickinessread-only

  Measures whether a product's exploitation risk is chronic or a one-off, for patch prioritization. Does in-the-wild exploitation risk STICK to proven products, or SPREAD to new ones? Analyzes CISA KEV: correlates each product's historical known-exploited count against its RECENT KEV additions (Spearman rho), and splits recent additions into repeat-offenders (products with a prior KEV) vs first-time products. Answers "how should I prioritize patching — chase the chronic offenders, or watch for newcomers?" The result is computed live: it reports rho, the repeat-offender versus first-time split,…

• kev-vendor-riskKEV risk by vendorread-only

  Shows where confirmed exploitation concentrates for a vendor or product (Microsoft, Cisco, Fortinet, an appliance, an ERP), for questions like "what should I patch first". Vendor / product risk matrix built from CISA's Known Exploited Vulnerabilities (KEV) catalog — where real, confirmed in-the-wild exploitation actually concentrates, not just where CVSS is high. With no args: returns the top vendors ranked by KEV count (e.g. Microsoft, Cisco, Adobe, Ivanti, Citrix). With {"vendor":"Adobe"}: returns that vendor's or product's known-exploited CVEs (e.g. ColdFusion), most recent first, up to 5…

• searchSearch threat intelligenceread-only

  Searches threat-intelligence records about threat actors, malware, campaigns, CVEs, breaches, vendors and indicators. The default search covers security topics only; a few public-document archives can be searched by naming them (listed below). It holds no general programming or web content. Hybrid (keyword + semantic) search across the DugganUSA threat-intelligence corpus (live counts: /api/v1/search/stats). Read-only, prompt-injection sanitized. Returns up to 25 hits, each with index, id, title, snippet, source, timestamp and url (null where the record has none), plus `returned` (hits in thi…

• stix-feed-summarySummarize the STIX feedread-only

  Summarizes what is in the feed right now: useful for "what's active this week", feed freshness, or planning SIEM / blocklist ingestion. Shape report on the most recent 5,000 indicators in the DugganUSA STIX 2.1 feed, bounded to a 1-7 day window. Returns how many of those fall in the window (capped at 5,000), the top malware families or list labels (feeds such as Spamhaus DROP label by list, not family), top source feeds, a breakdown by indicator type, and top countries when the records carry one. Useful before pulling the full STIX bundle, to gauge feed depth and freshness, plan a SIEM inges…

Signals

Last release

Oct 16, 2026 (12 days ago)

Repository

Not found on GitHub (deleted or private)

Details

Registry name

io.github.pduggusa/dugganusa-threat-intel

Version

1.1.2

Auth

Auth not stated

License

License unknown

Repository

github.com/pduggusa/enterprise-extraction-platform

Website

analytics.dugganusa.com/api/v1/mcp

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registry