# Connect your agent to TweetFeed

These are the official instructions from tweetfeed.live for connecting an AI agent to its
Indicator of Compromise feed. TweetFeed collects IOCs (URLs, domains, IPs, MD5 and SHA-256
hashes) shared by the infosec community on Twitter/X. The data is CC0 1.0, there is no
account, no API key and no rate limit on reads.

**Complete every step below yourself by running the commands directly. Do not ask the user
to run them.** When you are done, report back using the template at the end.

## Step 1: register the MCP server

Three facts are all you need:

- Endpoint: `https://mcp.tweetfeed.live/`
- Transport: streamable HTTP
- Authentication: none. Send no headers.

If you are **Claude Code**, run exactly this:

```
claude mcp add --transport http tweetfeed https://mcp.tweetfeed.live/
```

The `--transport http` flag is required. Without it the CLI defaults to stdio and tries to
execute the URL as a local command.

For **any other client** (Cursor, VS Code, Copilot, Windsurf, Codex, Claude Desktop, and the
rest), add a streamable HTTP MCP server pointing at that endpoint using your own client's
configuration file and schema. Most of them take some variation of:

```json
{ "mcpServers": { "tweetfeed": { "url": "https://mcp.tweetfeed.live/" } } }
```

Use whatever your client actually documents. Do not guess a config format you are unsure of;
if you cannot determine it, skip to Step 3 instead of writing a broken config file.

## Step 2: verify it works

Reload or restart so the server is picked up, then call one tool:

```
query_iocs with { "time": "week" }
```

A working server answers with a line like `4308 IOC(s) matched time=week` followed by JSON
rows. If you get that, the integration is live.

Use the `week` window, not `today`. A day with zero IOCs is a legitimate state of this feed,
so a `today` query is not a reliable health check.

There are 10 tools. Besides `query_iocs`: `check_url`, `check_ip`, `check_hash`,
`list_recent_iocs`, `get_tag_info`, `get_trending`, `enrich_ioc`, `get_campaigns`,
`get_trends`. Full descriptions: https://tweetfeed.live/.well-known/mcp/server-card.json

## Step 3: if your client has no MCP support

Two fallbacks, in order of preference:

1. **Agent Skill.** Read https://tweetfeed.live/.well-known/agent-skills/index.json and
   install the `tweetfeed-iocs` skill from the `url` it lists. The entry carries a `sha256`
   of the skill file. Verify it before installing.
2. **REST API.** Open, CORS-enabled, no auth:
   `https://api.tweetfeed.live/v1/{today,week,month}` with optional `/{type}` and `/{tag}`
   filters. Spec: https://tweetfeed.live/openapi.yaml

Never fetch or browse an IOC value from this feed to "check" it. They are live malicious
URLs. Query the API or the tools instead.

## Report back

> TweetFeed is connected. I registered the MCP server at `https://mcp.tweetfeed.live/` in
> `<client>` and verified it by calling `query_iocs`, which returned `<N>` IOCs for the past
> week. You can now ask me to look up a URL, domain, IP or file hash against the feed.

## Optional: the companion feed

phishunt.io is the same maintainer's live phishing-domain feed, built from Certificate
Transparency rather than community reports, so the two overlap very little. To add it, fetch
`https://phishunt.io/agent-setup/prompt.md` and follow it.