TweetFeed MCP Server

IOCs (URLs, domains, IPs, hashes) shared by the infosec community on X/Twitter. No auth, CC0.

Remote serverstreamable-http

What is the TweetFeed MCP Server?

IOCs (URLs, domains, IPs, hashes) shared by the infosec community on X/Twitter. No auth, CC0.

What it actually does

Exposes the public IOC feed (URLs, domains, IPs, SHA256/MD5 hashes shared by the infosec community on Twitter/X) as MCP tools so AI agents can query threat intel programmatically.

Recorded tools

  • query_iocs — Query IOCs by time window (today/week/month) with optional user, tag, and type filters.
  • check_url — Check whether a specific URL appears in the feed.
  • check_ip — Check whether an IPv4/IPv6 address appears in the feed.
  • check_hash — Check whether an MD5 or SHA-256 hash appears in the feed (type auto-detected).
  • list_recent_iocs — List IOCs added since a given date, with optional type/tag filters.
  • get_tag_info — Window aggregates plus recent IOCs for a tag (leading # optional).
  • get_trending — Top tags and IOC-type distribution for a window (today/week/month/year).
  • enrich_ioc — Exact lookup of an IOC (auto-detected type: url/domain/ip/md5/sha256) over the past 365 days, with AI/external-corroboration/net context when available; falls back to a 30-day substring scan on a miss.
  • get_campaigns — AI-clustered campaign groupings from the last 7 days, with optional brand and min-confidence filters.
  • get_trends — 31-day IOC trend analytics: daily volume by type, top moving tags week-over-week, most-abused TLDs, new vs recurring ratio, producer concentration.

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

ToolWhat it does
query_iocsQuery IOCs by time window (today/week/month) with optional user, tag, and type filters.
check_urlCheck whether a specific URL appears in the feed.
check_ipCheck whether an IPv4/IPv6 address appears in the feed.
check_hashCheck whether an MD5 or SHA-256 hash appears in the feed (type auto-detected).
list_recent_iocsList IOCs added since a given date, with optional type/tag filters.
get_tag_infoWindow aggregates plus recent IOCs for a tag (leading # optional).
get_trendingTop tags and IOC-type distribution for a window (today/week/month/year).
enrich_iocExact lookup of an IOC (auto-detected type: url/domain/ip/md5/sha256) over the past 365 days, with AI/external-corroboration/net context when available; falls back to a 30-day substring scan on a miss.
get_campaignsAI-clustered campaign groupings from the last 7 days, with optional brand and min-confidence filters.
get_trends31-day IOC trend analytics: daily volume by type, top moving tags week-over-week, most-abused TLDs, new vs recurring ratio, producer concentration.

How to install the TweetFeed MCP Server

{
  "mcpServers": {
    "tweetfeed": {
      "url": "https://mcp.tweetfeed.live/"
    }
  }
}

Configuration as documented by the project. Restart the client after saving.

Example prompts to try

  • “Use TweetFeed to query iocs.”
  • “Use TweetFeed to check url.”
  • “Use TweetFeed to check ip.”

Frequently asked questions

IOCs (URLs, domains, IPs, hashes) shared by the infosec community on X/Twitter. No auth, CC0. Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.