Changelog

The MCP server now exposes the feed as resources (resources/list, resources/templates/list, resources/read): tweetfeed://status, tweetfeed://counts, tweetfeed://trends, tweetfeed://campaigns, tweetfeed://iocs/{today|week|month}, plus the templates tweetfeed://iocs/{time}/{type} and tweetfeed://campaigns/{id}. Each read returns raw JSON, the same documents the REST API serves. The 14 tools stay the filtered, size-bounded path; resources are for clients that want a whole document (a status panel, a whole-window blocklist sync). The server also ships three prompts (triage_ioc, daily_brief, campaign_summary), user-invoked recipes (slash commands in Claude Desktop and Claude Code) that chain the tools for an IOC triage, a threat brief and a campaign hand-off.

A new contributors.json artifact is written every 15-minute tick: today/week/month/year rankings of reporting X/Twitter handles by IOCs, each entry with its top 3 IOC types and top 3 tags. /v1/contributors passes it through, and /researchers/ now renders all four windows from that one fetch instead of ranking CSVs in the browser - the long-dormant Year tab is back too. Side effect: the Week and Month tabs load again (their lazy init relied on an IntersectionObserver that never fired inside a hidden tab pane, so they had been rendering empty).

/v1/status now reports a sources block: per-X-source coverage (hashtag and account feeds), how many rows each attributed in the last 24h, and a dead-account verdict (no new post in 72h) with the offending handles listed. /v1/manifest gets a matching sources summary (total/hashtag/account counts). The MCP server adds a 14th tool, get_feed_status, so an agent can check pipeline health and source coverage in one call before trusting a feed pull.

The MCP server now implements the two tools ChatGPT requires for custom connectors and Deep research: search and fetch. search accepts an IOC value, a tag, a campaign id or free text and returns citable ids (ioc:, tag:, campaign:) with tweetfeed.live URLs. fetch returns the full document as structuredContent: a 365-day IOC lookup with context, a tag overview, or a campaign header plus rows with CSV/STIX links. Add https://mcp.tweetfeed.live/ in ChatGPT under Settings, Connectors, no authentication required. The 11 typed tools are unchanged and remain the better choice for clients that support them - 13 tools total.

Two new plain-text blocklists: sha256.txt and md5.txt, one lowercase hex hash per line, for EDR/AV bulk import (Microsoft Defender for Endpoint's Indicators CSV import, CrowdStrike IOC management); coverage is smaller than domains/URLs since researchers tweet fewer hashes. A third, nrd-domains.txt, is the subset of domains.txt whose registrable apex had an RDAP creation date 30 days or less before TweetFeed's first report - a high-signal "newly registered and already reported" list, with two caveats: only apexes with a known RDAP creation date are considered (about 6 in 10 reported domains), and a domain can appear one tick after it was first reported. Separately, adguard.txt now ships an AdGuard/uBlock filter-list metadata header (! Title:, ! Homepage:, ! License:, ! Expires:, etc.) instead of the generic # header, making it a valid filter list for AdGuard Home, uBlock Origin and filter-list registries; the body is unchanged. 16 blocklist files total.

Three of the plain-text blocklists now ship a corroborated variant - domains-corroborated.txt, ips-corroborated.txt and urls-corroborated.txt (13 blocklist files total) - the entries also listed by at least one of URLhaus, ThreatFox, MalwareBazaar, USOM or IPsum as of TweetFeed's 6-hourly cross-check; set membership only, not a quality score. A new static file, exclusive.csv, is the opposite view: last-30-days rows not corroborated by those 5 feeds as of the last refresh - what TweetFeed has that the others don't (yet). /v1/ioc gains a matching external_exclusive boolean, and the MCP server's enrich_ioc renders a sentence when it is true.

Each AI-clustered campaign is now downloadable on its own: /v1/campaigns/<id> (JSON: header + complete unsampled IOC membership), /v1/campaigns/<id>.csv (same 6 columns as today.csv) and /v1/campaigns/<id>.stix.json (a self-contained STIX 2.1 bundle - Identity, TLP:CLEAR marking, one Indicator per IOC). The MCP server gets a matching get_campaign_iocs tool. /v1/{today,week,month}, /v1/campaigns, /v1/campaigns/iocs, /v1/trends and /v1/counts now cache for 300 s at the edge (was 60 s).

Added ?defang=1 to the JSON routes (/v1/today, /v1/week, /v1/month, /v1/since/..., /v1/ioc; /v1/year redirects to a raw CSV and is never defanged): IOC values come back as hxxps://evil[.]tld and 1[.]2[.]3[.]4 instead of live values, for pasting into a ticket or chat tool. Off by default - 0, false or no parameter returns the same response as today. Never applied to tweet/user, net.*, ai.summary or the /v1/campaigns routes.

Added IDS/SIEM blocklist exports: zeek-intel.txt for Zeek's Intelligence Framework, and wazuh-domains.txt/wazuh-ips.txt as Wazuh CDB lists. None of the three carries a header comment, so check freshness with /v1/manifest or the response's Last-Modified header instead. Also documented a Palo Alto Networks PAN-OS EDL setup on the existing domains.txt/ips.txt exports.

Added two machine-readable endpoints so a consumer can stop polling blind: /v1/status reports per-artifact freshness plus a per-request stale/fresh verdict (headers X-Feed-Stale/X-Feed-Age-Seconds), computed fresh on every request and never cached; /v1/manifest lists every published file with its byte size, row count and SHA-256, so a client can diff instead of re-downloading. The /feeds/ headline row now shows a live "Updated N min ago" chip reading straight off /v1/status.

The external corroboration sidecar on /search/ lookups now reads abuse.ch's full URLhaus and ThreatFox dumps instead of their "recent" ones, and adds a third source: MalwareBazaar. Hashes benefit the most - URLhaus mostly indexes URLs and ThreatFox rarely carried hashes, so this is the first real corroboration coverage for many of TweetFeed's SHA256/MD5 IOCs. Corroboration stays display-only: it never adds, removes or scores anything in the canonical feed.

Search gets more context on each lookup, plus a new ad-hoc query tool:

• Corroboration signal - IOC lookup records now show whether an indicator came from a single report or multiple accounts, with a tooltip that popularity is not a verdict.
• Also in these tweets - lookup records surface up to 5 other IOCs pulled from the same source tweets (via the new optional related field on /v1/ioc), each with a one-click pivot back into the lookup.
• Feed explorer - a new card on /search/ queries /v1/<window> with type, tag and user filters, a date range, CSV export and shareable deep-links.
• Report a false positive - every lookup record now links straight to the feedback board.
• OpenAPI - the spec now documents /v1/ioc, /v1/trends and the TAXII discovery endpoint.
• Per-type and per-user RSS - subscribe to a single IOC type (/rss/type/) or a single reporter (/rss/user/) without polling the firehose.
• External corroboration - IOC lookups now show when an indicator is also listed in URLhaus or ThreatFox (public abuse.ch feeds), refreshed every 6 hours.
• IP network context - IP lookups now show organisation/ASN and country from ipinfo.io (third-party sidecar, refreshed every 6 hours).

Structural fixes for false positives across every IOC type:

• Quote attribution - IOCs from quoted tweets now point to the original author, not the quoter.
• Hash filter - hex strings inside URL paths or subdomains (cloud bucket IDs, webinar IDs, phishing-kit session IDs) no longer leak as MD5/SHA256.
• Research-host whitelist - links to sample-sharing services no longer emit as URL or domain IOCs.
• CDN IPs - Anycast edges filtered; the domain is the actionable IOC, not the CDN frontend.

~10K historical false-positive rows cleaned.

Three new bulk data formats for SIEM, Threat Intelligence platforms and automation:

• STIX 2.1 bundles (today/week/month) at /stix/manifest.json - spec-compliant, TLP:CLEAR, deterministic UUIDs.
• Diff endpoint at /v1/since/<ISO8601> - incremental sync, returns only IOCs added after a given timestamp.
• Per-tag RSS at /rss/tag/<slug>.xml - subscribe to a single threat type without polling the firehose.

Full docs on the Feeds, API and Agents pages. The MCP server-card also lists the new endpoints under dataEndpoints.

After a few months paused, TweetFeed is back again.

TweetFeed stopped due to technical issues retrieving info from Twitter/X.

TweetFeed alive again.

Improved frontend, made it better for mobile devices (bootstrap ftw).

Created OpenCTI connector. [Tweet]

Thanks to @aaarghhh for building it.

Improved frontend, made it better for mobile devices (bootstrap ftw).

Added new tags and removed old ones with fewer hits.

Thanks to Matt Anderson for the suggestion.

Added #Spring4Shell. [Tweet]

Created the Dashboard section.

Added #log4j and #Log4Shell. [Tweet]

First commit.

Thanks to Germán Fernández and Will for the initial feedback about the project.