TweetFeed for AI Agents

Connect Claude Desktop, Cursor, Zed or any MCP client to the IOC feed (free, no auth)


Agents

MCP, Agent Skills and API discovery (free, no auth)

10
MCP tools
mcp.tweetfeed.live
5
Agent Skills
RFC v0.2.0
4
Bulk formats
STIX, TAXII, RSS, diff
15 min
Refresh
CC0, no API key

Fastest path: paste this line to your agent and it configures itself.

MCP server

mcp.tweetfeed.live
  • Claude Desktop, Cursor, Zed
  • JSON-RPC 2.0 over HTTP

Agent Skills

/.well-known/agent-skills/
  • RFC v0.2.0 manifest
  • Tool-agnostic markdown

REST API

api.tweetfeed.live
  • Any HTTP client, n8n, Make, Zapier
  • Same data, JSON output

All three are free, no authentication, no rate limit for normal use. Same IOC data underneath.

Connect

Three ways in, one data set underneath. Pick the one your client already speaks.

MCP server

Remote Model Context Protocol server at https://mcp.tweetfeed.live/ over HTTP JSON-RPC 2.0 (protocolVersion 2025-11-25). Works with Claude Desktop, Claude Code, Cursor, Zed and any SDK-based MCP client.

Config for Claude Desktop, Cursor, Zed 
{
  "mcpServers": {
    "tweetfeed": {
      "url": "https://mcp.tweetfeed.live/"
    }
  }
}
Or add from the Claude Code CLI 
claude mcp add --transport http tweetfeed https://mcp.tweetfeed.live/
Available tools
Tool Purpose
query_iocs Query the IOC feed by time window (today, week, month) with optional filters: user (Twitter handle), tag (malware family or category), type (url / domain / ip / sha256 / md5). Returns matching rows with date, researcher, type, value, tags and tweet URL.
check_url Check whether a URL or substring appears in the past 30 days of TweetFeed (case-insensitive substring match against type=url IOCs).
check_ip Check whether an IPv4 or IPv6 address appears in TweetFeed. Exact match over the past 365 days, falling back to a 30-day substring match against type=ip IOCs if there's no exact hit.
check_hash Check whether a file hash appears in TweetFeed. Exact match over the past 365 days, falling back to a 30-day window if there's no exact hit. Type auto-detected from length (32 hex = MD5, 64 hex = SHA-256), hex required.
list_recent_iocs Delta-sync helper: returns IOCs added since a given YYYY-MM-DD date, sorted newest first. Optional type and tag filters. Source window is the past 30 days.
get_tag_info Bundle for a single tag: aggregate counts across today / week / month / year from counts.json plus the most recent IOCs. Saves the agent from three separate calls to assemble a tag overview.
get_trending Top tags + IOC-type distribution for a given window (today / week / month / year), read from counts.json. Useful for "what is the community talking about right now" queries.
enrich_ioc Auto-detects IOC type (URL / domain / IP / MD5 / SHA-256) from the value. Exact match over the past 365 days first, falling back to a 30-day substring scan if there's no exact hit. Saves the agent from picking the right check_* tool when the type is uncertain.
get_campaigns List AI-clustered threat campaign groupings of the last 30 days of community IOCs. Optional brand (substring match on targeted brand), min_confidence (low / medium / high), limit (1-50, default 20). Returns trimmed campaigns with up to 5 sample IOCs each.
get_trends Community IOC trend analytics: 31-day daily volume by type, top moving tags week-over-week, most-abused TLDs, and the new-vs-recurring novelty ratio.
Try it from the command line 
curl -sX POST https://mcp.tweetfeed.live/ \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}'

Source: github.com/0xDanielLopez/tweetfeed-mcp  ·  Server card: /.well-known/mcp/server-card.json

Agent Skills

For agents that consume Agent Skills Discovery (RFC v0.2.0) instructions instead of MCP tools. Each skill is a markdown file describing how to call the feed.

Skill Purpose
tweetfeed-iocs Query the IOC feed with route pattern, filter taxonomy, common queries and gotchas. Drop-in for any Claude Code / Copilot-compatible harness.
tweetfeed-ioc-lookup Exact-match lookup for one specific IOC over the full 365-day window: first/last seen, reporters, optional AI context.
tweetfeed-blocklists Ready-made plain-text blocklists (domains, hosts, AdGuard, IPs, RPZ, dnsmasq, URLs) for direct import into firewalls and DNS resolvers.
tweetfeed-trends Community IOC trend analytics: daily volume, top-moving tags, abused TLDs, novelty ratio.
tweetfeed-campaigns AI-clustered campaign groupings of the last 30 days, grouped by shared infrastructure or tag.

Discovery index: /.well-known/agent-skills/index.json  (includes sha256 content digest for integrity).

REST API

No MCP or skills harness? Call the public REST API directly: no key, no auth, CORS-enabled, JSON responses. 

GET https://api.tweetfeed.live/v1/{time}/{filter1}/{filter2}

The API page is the reference: every parameter, the 10,000-row result cap and its truncation headers, conditional requests, and the campaigns, counts, trends and IOC-lookup endpoints.

Bulk data and discovery

For platforms that ingest files on a schedule instead of calling a tool per question.

Bulk data formats

Static bundles for SIEM/Threat Intelligence platforms and incremental sync. All regenerated every 15 minutes from the same pipeline that feeds the API and MCP server.

Endpoint Purpose
/stix/manifest.json STIX 2.1 indicator bundles for the today/week/month windows. Details on Feeds.
/taxii2/ TAXII 2.1 server over the same STIX data, for OpenCTI, ThreatQ and other TIPs. Details on the API page.
/v1/since/<ISO8601> IOCs added after a timestamp, for incremental sync. Details on the API page.
/rss/tag/<slug>.xml One RSS feed per active tag, to follow a single threat type. Details on Feeds.

Discovery endpoints

Crawlers and agents can discover every integration from a single HEAD https://tweetfeed.live/: the Link header carries rel="api-catalog", rel="agent-skills", rel="mcp-server", rel="service-doc" and rel="service-desc" (RFC 8288).

Path Format Spec
/.well-known/api-catalog application/linkset+json RFC 9727
/.well-known/agent-skills/index.json application/json Agent Skills Discovery RFC v0.2.0
/.well-known/mcp/server-card.json application/json MCP SEP-1649 draft
robots.txt · Content-Signal text/plain contentsignals.org

License

IOC data (feed rows, API responses, MCP tool outputs) is freely available; see the Terms of Service for license. No attribution required, no warranty.  Source code for the MCP server: tweetfeed-mcp (MIT).

Frequently asked questions

Do I need an API key or an account?

No. The MCP server, the Agent Skills and the REST API are all open: no key, no sign-up, and no rate limit for normal use. The IOC data is CC0.

MCP server, Agent Skills or REST API - which one?

If your client speaks Model Context Protocol (Claude Desktop, Claude Code, Cursor, Zed), use the MCP server: the agent gets 10 typed tools and chooses between them itself. If it consumes Agent Skills instructions instead, point it at the skills manifest. If it is a script, or an n8n, Make or Zapier workflow, call the REST API. All three read the same rows.

Which clients work with the MCP server?

Any client that speaks JSON-RPC 2.0 over HTTP at protocolVersion 2025-11-25. It is tested with Claude Desktop, Claude Code, Cursor and Zed. Nothing gets installed: the server is remote, so a URL in the client config is all it takes.

How fresh is the data an agent sees?

The pipeline rebuilds every 15 minutes, and the MCP server, the REST API and the bulk files all read that same output. An agent asking twice in the same quarter of an hour gets the same answer.

Can I redistribute what the agent pulls?

The IOC data is free to reuse; the Terms of Service carries the license. No attribution required, no warranty. The MCP server source is MIT.