MCP server

Scry

ai.tunnelmind/scry

Checked 26 Oct 2026, 08:29 UTC · Connected to it and listed its tools

Free IPv4 lookups against a distributed attacker-observation corpus.

Website Source

At a glance

Type

MCP server

Publisher

tunnelmind.ai (verified by the MCP Registry)

Status

Working at last check

Tools

12

Token cost

About 1,444 tokens per request

Sets up in

Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok

Last checked

26 Oct 2026, 08:29 UTC

Connect it to your agent

Add to CursorAdd to VS CodeVS Code Insiders

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http scry https://mcp.tunnelmind.ai/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.scry]
url = "https://mcp.tunnelmind.ai/mcp"

Gemini CLI

{"mcpServers":{"scry":{"httpUrl":"https://mcp.tunnelmind.ai/mcp"}}}

Cursor

{"mcpServers":{"scry":{"url":"https://mcp.tunnelmind.ai/mcp"}}}

VS Code

{"servers":{"scry":{"type":"http","url":"https://mcp.tunnelmind.ai/mcp"}}}

Antigravity

agy mcp add scry https://mcp.tunnelmind.ai/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"scry","server_url":"https://mcp.tunnelmind.ai/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"scry","server_url":"https://mcp.tunnelmind.ai/mcp"}

Tools

• scry_asn ~102 tokens
  Roll-up of corpus activity for a single ASN — observation count, distinct source IPs, actor count, scanner count, high-confidence actor count, and per-protocol breakdown.
• scry_campaign ~69 tokens
  Single campaign detail by id (format: c[0-9a-f]{15}).
• scry_campaigns ~103 tokens
  Active threat campaigns — coordinated attacker activity that exceeds the noise floor. ≥5 distinct actors, ≥3 ASNs, ≤5 destination ports, ≥1h history.
• scry_check ~172 tokens
  Returns Scry's corpus knowledge for a single IPv4 address: when it was first/last observed, observation count, protocols and ports targeted, ASN, country, category (actor/scanner/not_observed), and confidence_bucket (low/medium/high). Use when an agent needs IP triage, hostility assessment, or risk
• scry_check_bulk ~94 tokens
  Look up many IPv4 addresses in one request. Up to 100 IPs per call. Same per-IP shape as scry_check, keyed by IP.
• scry_country ~85 tokens
  Roll-up of corpus activity by ISO country code. Same shape as scry_asn.
• scry_recent ~120 tokens
  Recent observations feed — aggregated by source IP within a time window. Cursor-paginated via since_ms.
• scry_stats ~297 tokens
  Returns aggregate Scry corpus telemetry: total observation count, distinct source IPs, first/last observation timestamps, last-24h activity, and per-protocol breakdowns. Useful as a liveness/density check before issuing per-IP queries — lets an agent decide whether the corpus has enough data to be a
• scry_timeseries ~105 tokens
  Bucketed observation counts over time. Detect bursts, plot trends, sanity-check whether attacker activity is rising or falling.
• scry_tool ~68 tokens
  Single tool detail by 16-char hex id from scry_tools.
• scry_tools ~107 tokens
  List detected attack tools — (protocol, payload, path) tuples sent by 3+ distinct source IPs. Aggregate metadata only; never lists member actors.
• scry_top ~122 tokens
  Top-N source dimensions over a time window. Useful for situational awareness — 'where is the noise coming from right now?'

Browse

• IPv4 tools
• Email marketing

Related MCP servers

• TunnelMind Data API
  Tracker / Sigil / Cross-lens — every TunnelMind Data API operation as one MCP surface.
• IP99 IP risk & geolocation
  Free IP risk and geolocation lookup: proxy, VPN and datacenter detection. No API key.
• Dragons Eye Ransomware Claims
  Ransomware claim lookups, IOC and CVE intel, group intel, bulk checks and watch alerts (x402 USDC).
• ContrastAPI
  55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.
• OrionCMD Checks
  Domain threat checks, a 30-day domain watch, TLS/DNS/email-auth checks and a $2 site audit (x402).
• TweetFeed
  IOCs (URLs, domains, IPs, hashes) shared by the infosec community on X/Twitter. No auth, CC0.
• Dechonet
  30 security tools for AI agents: phishing links, exposure maps, DNS, SSL, PQC, history, pivots.
• AI SENSE Free Public Tools
  66 public tools: semantic search, queues, inboxes, webhooks, approvals, DNS, images, PDF and more.

Badge for your README

[![AptLynx](https://aptlynx.net/badge/ai.tunnelmind/scry.svg)](https://aptlynx.net/servers/ai.tunnelmind/scry)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents