TweetFeed for AI Agents

Connect Claude Desktop, ChatGPT, Cursor, Zed or any MCP client to the IOC feed (free, no auth)

Agents

MCP, Agent Skills and API discovery (free, no auth)

MCP tools

mcp.tweetfeed.live

Agent Skills

RFC v0.2.0

Bulk formats

STIX, TAXII, RSS, diff

15 min

Refresh

CC0, no API key

Fastest path: paste this line to your agent and it configures itself.

MCP server

mcp.tweetfeed.live

Claude Desktop, Cursor, Zed
JSON-RPC 2.0 over HTTP

Agent Skills

/.well-known/agent-skills/

RFC v0.2.0 manifest
Tool-agnostic markdown

REST API

api.tweetfeed.live

Any HTTP client, n8n, Make, Zapier
Same data, JSON output

All three are free, no authentication, no rate limit for normal use. Same IOC data underneath.

Connect

Three ways in, one data set underneath. Pick the one your client already speaks.

MCP server

Remote Model Context Protocol server at https://mcp.tweetfeed.live/ over HTTP JSON-RPC 2.0 (protocolVersion 2025-11-25). Works with Claude Desktop, Claude Code, ChatGPT, Cursor, Zed and any SDK-based MCP client.

Config for Claude Desktop, Cursor, Zed

{
  "mcpServers": {
    "tweetfeed": {
      "url": "https://mcp.tweetfeed.live/"
    }
  }
}

ChatGPT (connectors and deep research)

In ChatGPT, go to Settings, Connectors, Create (or add a custom connector from Deep research) and paste https://mcp.tweetfeed.live/, no authentication needed. The server exposes the search and fetch tools ChatGPT requires, alongside the typed tools below, and every result carries a tweetfeed.live URL so answers cite the feed.

Or add from the Claude Code CLI

claude mcp add --transport http tweetfeed https://mcp.tweetfeed.live/

Available tools

Tool	Purpose
`query_iocs`	Query the IOC feed by time window (`today`, `week`, `month`) with optional filters: `user` (Twitter handle), `tag` (malware family or category), `type` (`url` / `domain` / `ip` / `sha256` / `md5`). Returns matching rows with date, researcher, type, value, tags and tweet URL.
`check_url`	Check whether a URL or substring appears in the past 30 days of TweetFeed (case-insensitive substring match against `type=url` IOCs).
`check_ip`	Check whether an IPv4 or IPv6 address appears in TweetFeed. Exact match over the past 365 days plus the pre-365-day archive, falling back to a 30-day substring match against `type=ip` IOCs if there's no exact hit.
`check_hash`	Check whether a file hash appears in TweetFeed. Exact match over the past 365 days plus the pre-365-day archive, falling back to a 30-day window if there's no exact hit. Type auto-detected from length (32 hex = MD5, 64 hex = SHA-256), hex required.
`list_recent_iocs`	Delta-sync helper: returns IOCs added since a given `YYYY-MM-DD` date, sorted newest first. Optional `type` and `tag` filters. Source window is the past 30 days.
`get_tag_info`	Bundle for a single tag: aggregate counts across `today` / `week` / `month` / `year` from `counts.json` plus the most recent IOCs. Saves the agent from three separate calls to assemble a tag overview.
`get_trending`	Top tags + IOC-type distribution for a given window (`today` / `week` / `month` / `year`), read from `counts.json`. Useful for "what is the community talking about right now" queries.
`enrich_ioc`	Auto-detects IOC type (URL / domain / IP / MD5 / SHA-256) from the value. Exact match over the past 365 days plus the pre-365-day archive first, falling back to a 30-day substring scan if there's no exact hit. Saves the agent from picking the right `check_*` tool when the type is uncertain.
`get_campaigns`	List AI-clustered threat campaign groupings of the last 30 days of community IOCs. Optional `brand` (substring match on targeted brand), `min_confidence` (`low` / `medium` / `high`), `limit` (1-50, default 20). Returns trimmed campaigns with up to 5 sample IOCs each.
`get_campaign_iocs`	Full IOC membership of one AI-clustered campaign: header (name, context, ATT&CK `ttps`, targeted sector/country, `ioc_count`) plus its rows (date, type, value, researcher handle, tags, source tweet URL). Required `campaign_id` (from `get_campaigns`), optional `type` filter and `limit` (1-500, default 100). Same data as `/v1/campaigns/<id>` (`.csv` / `.stix.json` variants also exist).
`get_trends`	Community IOC trend analytics: 31-day daily volume by type, top moving tags week-over-week, most-abused TLDs, and the new-vs-recurring novelty ratio.
`search`	ChatGPT connector interface. One `query` string: an IOC value, a tag, a campaign id or free text matched against campaign names. Returns document ids (`ioc:`, `tag:`, `campaign:`) with a tweetfeed.live URL each, as `structuredContent`. When your client supports the typed tools above, use those instead.
`fetch`	ChatGPT connector interface. Full document for one id from `search`: the 365-day IOC lookup with context, a tag overview with recent IOCs, or a campaign header with its IOC rows and CSV/STIX links. Returns `{id, title, text, url, metadata}`.

Try it from the command line

curl -sX POST https://mcp.tweetfeed.live/ \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}'

Source: github.com/0xDanielLopez/tweetfeed-mcp · Server card: /.well-known/mcp/server-card.json

Agent Skills

For agents that consume Agent Skills Discovery (RFC v0.2.0) instructions instead of MCP tools. Each skill is a markdown file describing how to call the feed.

Skill	Purpose
`tweetfeed-iocs`	Query the IOC feed with route pattern, filter taxonomy, common queries and gotchas. Drop-in for any Claude Code / Copilot-compatible harness.
`tweetfeed-ioc-lookup`	Exact-match lookup for one specific IOC over the full 365-day window plus the pre-365-day archive: first/last seen, reporters, optional AI context.
`tweetfeed-blocklists`	Ready-made plain-text blocklists (domains, hosts, AdGuard, IPs, RPZ, dnsmasq, URLs) for direct import into firewalls and DNS resolvers.
`tweetfeed-trends`	Community IOC trend analytics: daily volume, top-moving tags, abused TLDs, novelty ratio.
`tweetfeed-campaigns`	AI-clustered campaign groupings of the last 30 days, grouped by shared infrastructure or tag.

Discovery index: /.well-known/agent-skills/index.json (includes sha256 content digest for integrity).

REST API

No MCP or skills harness? Call the public REST API directly: no key, no auth, CORS-enabled, JSON responses.

GET https://api.tweetfeed.live/v1/{time}/{filter1}/{filter2}

The API page is the reference: every parameter, the 10,000-row result cap and its truncation headers, conditional requests, and the campaigns, counts, trends and IOC-lookup endpoints.

Bulk data and discovery

For platforms that ingest files on a schedule instead of calling a tool per question.

Bulk data formats

Static bundles for SIEM/Threat Intelligence platforms and incremental sync. All regenerated every 15 minutes from the same pipeline that feeds the API and MCP server.

Endpoint	Purpose
`/stix/manifest.json`	STIX 2.1 indicator bundles for the today/week/month windows. Details on Feeds.
`/taxii2/`	TAXII 2.1 server over the same STIX data, for OpenCTI, ThreatQ and other TIPs. Details on the API page.
`/v1/since/<ISO8601>`	IOCs added after a timestamp, for incremental sync. Details on the API page.
`/rss/tag/<slug>.xml`	One RSS feed per active tag, to follow a single threat type. Details on Feeds.

Discovery endpoints

Crawlers and agents can discover every integration from a single HEAD https://tweetfeed.live/: the Link header carries rel="api-catalog", rel="agent-skills", rel="mcp-server", rel="service-doc" and rel="service-desc" (RFC 8288).

Path	Format	Spec
/.well-known/api-catalog	`application/linkset+json`	RFC 9727
/.well-known/agent-skills/index.json	`application/json`	Agent Skills Discovery RFC v0.2.0
/.well-known/mcp/server-card.json	`application/json`	MCP SEP-1649 draft
robots.txt · `Content-Signal`	`text/plain`	contentsignals.org

License

IOC data (feed rows, API responses, MCP tool outputs) is freely available; see the Terms of Service for license. No attribution required, no warranty. Source code for the MCP server: tweetfeed-mcp (MIT).

Frequently asked questions

Do I need an API key or an account?

No. The MCP server, the Agent Skills and the REST API are all open: no key, no sign-up, and no rate limit for normal use. The IOC data is CC0.

MCP server, Agent Skills or REST API - which one?

If your client speaks Model Context Protocol (Claude Desktop, Claude Code, ChatGPT, Cursor, Zed), use the MCP server: the agent gets 13 tools and chooses between them itself. If it consumes Agent Skills instructions instead, point it at the skills manifest. If it is a script, or an n8n, Make or Zapier workflow, call the REST API. All three read the same rows.

Which clients work with the MCP server?

Any client that speaks JSON-RPC 2.0 over HTTP at protocolVersion 2025-11-25. It is tested with Claude Desktop, Claude Code, Cursor and Zed, and implements the ChatGPT connector interface (search / fetch). Nothing gets installed: the server is remote, so a URL in the client config is all it takes.

How fresh is the data an agent sees?

The pipeline rebuilds every 15 minutes, and the MCP server, the REST API and the bulk files all read that same output. An agent asking twice in the same quarter of an hour gets the same answer.

Can I redistribute what the agent pulls?

The IOC data is free to reuse; the Terms of Service carries the license. No attribution required, no warranty. The MCP server source is MIT.