# Jeevesus — DugganUSA Threat Intelligence MCP MCP server

Jeevesus saves. Threat-intel MCP, 17.9M docs, 1.13M IOCs. Search · enrich · STIX. Read-only.

## Links
- Registry page: https://www.getdrio.com/mcp/io-github-pduggusa-dugganusa-threat-intel
- Repository: https://github.com/pduggusa/enterprise-extraction-platform
- Website: https://analytics.dugganusa.com/api/v1/mcp

## Install
- Endpoint: https://analytics.dugganusa.com/api/v1/mcp
- Auth: Not captured

## Setup notes
- Remote endpoint: https://analytics.dugganusa.com/api/v1/mcp

## Tools
- search - Full-text search across the DugganUSA threat-intelligence corpus — 17.9M+ indexed documents. Public indexes only, read-only, prompt-injection sanitized. Returns up to 25 hits with title, snippet, source, and timestamp. Available indexes:
  • iocs (1.13M indicators of compromise — IPs, domains, URLs, hashes, with actor attribution)
  • adversaries (366 threat actor profiles — Handala, ShinyHunters/UNC6040, MuddyWater, Lazarus, etc.)
  • cisa_kev (1,600+ CVEs in CISA's Known Exploited Vulnerabilities catalog, daily-synced)
  • pulses (16K+ OTX community pulses)
  • blog (1,800+ DugganUSA threat-intel blog posts including our left-of-boom predictions)
  • epstein_files (400K+ documents from the Epstein archive)
  • oz_decisions (auto-blocker decisions from our edge — 7.5M+ rows)
  • paranormal (3,400 fringe-research docs)
  • tor_relays (1.83M hourly Tor consensus snapshots)

Examples:
  query="ClearFake" → returns our May 1 Apothecary/ClearFake DXNP2C7 left-of-boom catch with operator analysis.
  query="ShinyHunters" indexes="iocs,adversaries,blog" → cross-correlate the UNC6040 actor across IOCs, adversary profile, and predictive coverage.
  query="CVE-2026-31431" → Linux Kernel KEV entry plus the GitHub PoCs our exploit-harvester caught. Endpoint: https://analytics.dugganusa.com/api/v1/mcp
- enrich-ioc - Look up a single indicator of compromise (IP, domain, URL, or hash) in the DugganUSA corpus and return everything we know about it: threat type, malware family, source feeds, related actor (if attributed), confidence score, references, and the full description from each source. Read-only.

Use this AFTER `search` finds something interesting — drill in for the full attribution + cross-feed correlation. Or use it directly when triaging a single indicator from your SIEM.

Pass the IOC as either `indicator` or `value` (both work). Optional `type` hint: ip / domain / url / hash / auto.

Examples:
  indicator="185.93.3.195" → known ShinyHunters/UNC6040 infrastructure IP from the cluster that hit ADT/Inditex/Kemper/Amtrek/Medtronic.
  indicator="goldenleafway.lat" → fresh Apothecary/ClearFake .lat rotation domain.
  indicator="ee28b3137d65d74c0234eea35fa536af" → Volexity-attributed malware MD5 (BrazenBamboo/DEEPDATA campaign).

Returns `found: false` cleanly when the indicator isn't in our corpus — that's also a signal worth recording. Endpoint: https://analytics.dugganusa.com/api/v1/mcp
- stix-feed-summary - Live shape report on the DugganUSA STIX 2.1 threat feed for a chosen lookback window (1-7 days). Returns total indicator count, top malware families, top source feeds, type breakdown (ip/domain/url/hash/cidr), and top countries.

Use this BEFORE pulling the full STIX bundle to gauge feed depth and freshness, plan SIEM ingestion budget, or sanity-check that a campaign you read about is actually in our corpus.

Does NOT return the full bundle — for that, fetch `https://analytics.dugganusa.com/api/v1/stix-feed` with the same Bearer key. The bundle is STIX 2.1 / TAXII 2.1 with Splunk ES, OPNsense, Suricata, and Unbound DNS sinkhole plugins.

Authentication required (Bearer token). Anonymous callers get a clear 401 with the registration URL.

Example: `{"days": 7}` returns the last week's feed shape — useful for capacity planning and spot-checking recent ingest tags. Endpoint: https://analytics.dugganusa.com/api/v1/mcp

## Resources
Not captured

## Prompts
Not captured

## Metadata
- Owner: io.github.pduggusa
- Version: 1.0.1
- Runtime: Streamable Http
- Transports: HTTP
- License: Not captured
- Language: Not captured
- Stars: Not captured
- Updated: May 4, 2026
- Source: https://registry.modelcontextprotocol.io