MCP server

Isc Sans

io.github.pipeworx-io/isc-sans

Checked 26 Oct 2026, 08:29 UTC · Connected to it and listed its tools

SANS Internet Storm Center (ISC) MCP.

Website Source

At a glance

Type

MCP server

Publisher

pipeworx.io (verified by the MCP Registry)

Status

Working at last check

Tools

45

Token cost

About 26,751 tokens per request

Sets up in

Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok

Last checked

26 Oct 2026, 08:29 UTC

Connect it to your agent

Add to CursorAdd to VS CodeVS Code Insiders

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http isc-sans https://gateway.pipeworx.io/isc-sans/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.isc-sans]
url = "https://gateway.pipeworx.io/isc-sans/mcp"

Gemini CLI

{"mcpServers":{"isc-sans":{"httpUrl":"https://gateway.pipeworx.io/isc-sans/mcp"}}}

Cursor

{"mcpServers":{"isc-sans":{"url":"https://gateway.pipeworx.io/isc-sans/mcp"}}}

VS Code

{"servers":{"isc-sans":{"type":"http","url":"https://gateway.pipeworx.io/isc-sans/mcp"}}}

Antigravity

agy mcp add isc-sans https://gateway.pipeworx.io/isc-sans/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"isc-sans","server_url":"https://gateway.pipeworx.io/isc-sans/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"isc-sans","server_url":"https://gateway.pipeworx.io/isc-sans/mcp"}

Tools

• ip_reputation ~186 tokens
  Look up an IPv4 address in the SANS ISC DShield database — its attack-report history, ASN/owner, abuse contact, and risk. A high report_count means the IP is an active attack source (firewall logs submitted by sensors worldwide). report_count null/0 = no malicious activity reported. The comment fiel
• port_activity ~153 tokens
  Get recent attack/probe activity for a TCP/UDP port from SANS ISC — daily counts of report records, distinct target IPs, and distinct source IPs hitting the port. Useful for spotting scanning surges against services like SSH (22), RDP (3389), SMB (445), or Telnet (23). Keyless.
• threat_level ~109 tokens
  Get the global SANS ISC InfoCon threat level — the internet-wide "weather report" for malicious activity. Returns one of green/yellow/orange/red with a plain-English meaning. An at-a-glance signal of whether a major internet-scale event is underway. Keyless, no arguments.

Browse

• GitHub tools
• IPv4 tools
• GitHub and code hosting
• Databases
• Weather

Related MCP servers

• Cognita
  Passive OSINT and security recon: DNS, TLS, email posture, IP reputation, CVE/KEV, CT logs.
• Headed In: Florida trips, water and weather
  Live Florida trip info: boat ramps, NOAA forecasts, red tide, beach flags, bridges, launches, picks.
• Hurricanes
  Hurricanes / tropical cyclones MCP.
• 787daily
  Puerto Rico news summaries and live island conditions from 787daily, read-only over MCP.
• SiteCheck Jobs & Property
  114 pay-per-call agent tools: job market and real estate data tools. x402
• Citiview Agent Market
  186 pay-per-call tools: search, LLMs, UK KYB, FRED, Census, maps, crypto. x402 USDC.
• Ocean Schedules
  Compare ocean carrier schedules, transit times and reliability: 60+ carriers, 72,000+ sailings.
• TrueFixR Storm Data API
  Storm history by address since 2003, recent storm leads, model-based weather and storm forecasts.

Badge for your README

[![AptLynx](https://aptlynx.net/badge/io.github.pipeworx-io/isc-sans.svg)](https://aptlynx.net/servers/io.github.pipeworx-io/isc-sans)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents