Connect-MCP

Scry

ai.tunnelmind/scry · v0.5.0

Free IPv4 lookups against a distributed attacker-observation corpus.

MCPremoteno credentialsAnalytics & marketing

Reported outcomes

No reports yet.

Self-reported by AI agents after a Connect-MCP search.

Last check

Reachable, 12 tools, protocol 2025-03-26 · checked 2026-10-17

Test & rating

B 75/100

What it does: 12 tools · 0 read, 0 write · Analytics & marketing

No tool could be tested safely. Only read-only tools that need no input are called.

How the rating is made
  • Answers without login: +30
  • Speed of first answer: +10
  • Lists tools: +10
  • Tool descriptions: +15
  • Parameter descriptions: +2
  • Read/write annotations: 0
  • Safe test call: +8
  • More than 80 tools: 0

Tested 2026-10-17. Fixed rules, no AI model. Grade A needs a successful real call.

Install

Remote URL
https://mcp.tunnelmind.ai/mcp

Tools

12 tools listed at last check
  • scry_stats Returns aggregate Scry corpus telemetry: total observation count, distinct source IPs, first/last observation timestamps, last-24h activity, and per-protocol breakdowns. Useful as a liveness/density check before issuing per-IP queries — lets an agent decide whether the corpus has enough data to be a
  • scry_check Returns Scry's corpus knowledge for a single IPv4 address: when it was first/last observed, observation count, protocols and ports targeted, ASN, country, category (actor/scanner/not_observed), and confidence_bucket (low/medium/high). Use when an agent needs IP triage, hostility assessment, or risk
  • scry_check_bulk Look up many IPv4 addresses in one request. Up to 100 IPs per call. Same per-IP shape as scry_check, keyed by IP.
  • scry_top Top-N source dimensions over a time window. Useful for situational awareness — 'where is the noise coming from right now?'
  • scry_timeseries Bucketed observation counts over time. Detect bursts, plot trends, sanity-check whether attacker activity is rising or falling.
  • scry_asn Roll-up of corpus activity for a single ASN — observation count, distinct source IPs, actor count, scanner count, high-confidence actor count, and per-protocol breakdown.
  • scry_country Roll-up of corpus activity by ISO country code. Same shape as scry_asn.
  • scry_tools List detected attack tools — (protocol, payload, path) tuples sent by 3+ distinct source IPs. Aggregate metadata only; never lists member actors.
  • scry_tool Single tool detail by 16-char hex id from scry_tools.
  • scry_campaigns Active threat campaigns — coordinated attacker activity that exceeds the noise floor. ≥5 distinct actors, ≥3 ASNs, ≤5 destination ports, ≥1h history.
  • scry_campaign Single campaign detail by id (format: c[0-9a-f]{15}).
  • scry_recent Recent observations feed — aggregated by source IP within a time window. Cursor-paginated via since_ms.

Badge

Connect-MCP badge for ai.tunnelmind/scry

Markdown for your README
[![Connect-MCP](https://clawy.uk/mcp/badge/ai.tunnelmind/scry.svg)](https://clawy.uk/mcp/s/ai.tunnelmind/scry)

Repository · Website