TweetFeed for AI Agents

Connect Claude Desktop, Cursor, Zed or any MCP client to the IOC feed (free, no auth)

Agents

MCP, Agent Skills and API discovery (free, no auth)

MCP server

mcp.tweetfeed.live

Claude Desktop, Cursor, Zed
JSON-RPC 2.0 over HTTP

Agent Skills

/.well-known/agent-skills/

RFC v0.2.0 manifest
Tool-agnostic markdown

REST API

api.tweetfeed.live

Any HTTP client, n8n, Make, Zapier
Same data, JSON output

All three are free, no authentication, no rate limit for normal use. Same IOC data underneath.

MCP server

Remote Model Context Protocol server at https://mcp.tweetfeed.live/ over HTTP JSON-RPC 2.0 (protocolVersion 2025-03-26). Works with Claude Desktop, Claude Code, Cursor, Zed and any SDK-based MCP client.

Config for Claude Desktop, Cursor, Zed

{
  "mcpServers": {
    "tweetfeed": {
      "url": "https://mcp.tweetfeed.live/"
    }
  }
}

Or add from the Claude Code CLI

claude mcp add tweetfeed https://mcp.tweetfeed.live/

Available tools

Tool	Purpose
`query_iocs`	Query the IOC feed by time window (`today`, `week`, `month`) with optional filters: `user` (Twitter handle), `tag` (malware family or category), `type` (`url` / `domain` / `ip` / `sha256` / `md5`). Returns matching rows with date, researcher, type, value, tags and tweet URL.
`check_url`	Check whether a URL or substring appears in the past 30 days of TweetFeed (case-insensitive substring match against `type=url` IOCs).
`check_ip`	Check whether an IPv4 or IPv6 address appears in the past 30 days (substring match against `type=ip` IOCs).
`check_hash`	Check whether a file hash appears in the past 30 days. Type auto-detected from length (32 hex = MD5, 64 hex = SHA-256). Exact match, hex required.
`list_recent_iocs`	Delta-sync helper: returns IOCs added since a given `YYYY-MM-DD` date, sorted newest first. Optional `type` and `tag` filters. Source window is the past 30 days.
`get_tag_info`	Bundle for a single tag: aggregate counts across `today` / `week` / `month` / `year` from `counts.json` plus the most recent IOCs. Saves the agent from three separate calls to assemble a tag overview.
`get_trending`	Top tags + IOC-type distribution for a given window (`today` / `week` / `month` / `year`), read from `counts.json`. Useful for "what is the community talking about right now" queries.
`enrich_ioc`	Auto-detects IOC type (URL / domain / IP / MD5 / SHA-256) from the value and looks it up across the past 30 days. Saves the agent from picking the right `check_*` tool when the type is uncertain.

Try it from the command line

curl -sX POST https://mcp.tweetfeed.live/ \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}'

Source: github.com/0xDanielLopez/tweetfeed-mcp · Server card: /.well-known/mcp/server-card.json

Agent Skills

For agents that consume Agent Skills Discovery (RFC v0.2.0) instructions instead of MCP tools. Each skill is a markdown file describing how to call the feed.

Skill	Purpose
`tweetfeed-iocs`	Query the IOC feed with route pattern, filter taxonomy, common queries and gotchas. Drop-in for any Claude Code / Copilot-compatible harness.

Discovery index: /.well-known/agent-skills/index.json (includes sha256 content digest for integrity).

REST API

No MCP or skills harness? Call the public REST API directly: no key, no auth, CORS-enabled, JSON responses. Full docs on the API page.

GET https://api.tweetfeed.live/v1/{time}/{filter1}/{filter2}

Bulk data formats

Static bundles for SIEM/Threat Intelligence platforms and incremental sync. All regenerated every 15 minutes from the same pipeline that feeds the API and MCP server.

Endpoint	Purpose
`/stix/manifest.json`	STIX 2.1 indicator bundles (today/week/month windows). Spec-compliant Bundle objects with TLP:CLEAR marking, per-IOC pattern types, deterministic UUIDs for cross-pull dedupe.
`/v1/since/<ISO8601>`	Diff endpoint: returns IOCs added after the given timestamp. Supports the same `/<filter1>/<filter2>` syntax as `/v1/<time>`. 410 if `since` is >365d ago.
`/rss/tag/<slug>.xml`	One RSS feed per active tag (a tag is "active" with >=1 hit in the last 7 days). Subscribe to a single threat type without polling the firehose.

Discovery endpoints

Crawlers and agents can discover every integration from a single HEAD https://tweetfeed.live/: the Link header carries rel="api-catalog", rel="agent-skills", rel="mcp-server" and rel="service-doc" (RFC 8288).

Path	Format	Spec
/.well-known/api-catalog	`application/linkset+json`	RFC 9727
/.well-known/agent-skills/index.json	`application/json`	Agent Skills Discovery RFC v0.2.0
/.well-known/mcp/server-card.json	`application/json`	MCP SEP-1649 draft
robots.txt · `Content-Signal`	`text/plain`	contentsignals.org

License

IOC data (feed rows, API responses, MCP tool outputs) is freely available; see the Terms of Service for license. No attribution required, no warranty. Source code for the MCP server: tweetfeed-mcp (MIT).