TweetFeed MCP Server

IOCs (URLs, domains, IPs, hashes) shared by the infosec community on X/Twitter. No auth, CC0. The tweetfeed mcp server wraps that behind the Model Context Protocol, so an assistant can use it through 10 defined tools rather than through you.

What it actually does

Exposes the public IOC feed (URLs, domains, IPs, SHA256/MD5 hashes shared by the infosec community on Twitter/X) as MCP tools so AI agents can query threat intel programmatically.

Its toolset

Everything the assistant can do here goes through one of these:

• query_iocs — Query IOCs by time window (today/week/month) with optional user, tag, and type filters
• check_url — Check whether a specific URL appears in the feed
• check_ip — Check whether an IPv4/IPv6 address appears in the feed
• check_hash — Check whether an MD5 or SHA-256 hash appears in the feed (type auto-detected)
• list_recent_iocs — List IOCs added since a given date, with optional type/tag filters
• get_tag_info — Window aggregates plus recent IOCs for a tag (leading # optional)
• get_trending — Top tags and IOC-type distribution for a window (today/week/month/year)
• enrich_ioc — Exact lookup of an IOC (auto-detected type: url/domain/ip/md5/sha256) over the past 365 days, with AI/external-corroboration/net context when
• get_campaigns — AI-clustered campaign groupings from the last 7 days, with optional brand and min-confidence filters
• get_trends — 31-day IOC trend analytics: daily volume by type, top moving tags week-over-week, most-abused TLDs, new vs recurring ratio, producer concentration

Adding it to your client

Being a remote server, there is no local install. You register the endpoint with your client, authorise it once, and the tools appear.

When to reach for it

Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. TweetFeed's toolset — query_iocs, check_url, check_ip and 7 more — is a fair guide to whether it matches your workflow. It is maintained by 0xDanielLopez; worth a glance at recent repository activity before you build anything load-bearing on it.

SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.

Caveats

• Your data travels to the provider's service, so the usual questions apply about what you send and what they retain.
• With 10 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch TweetFeed.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the tweetfeed mcp server does with a few real requests.