Changelog

The MCP server now implements the two tools ChatGPT requires for custom connectors and Deep research: search and fetch. search accepts an IOC value, a tag, a campaign id or free text and returns citable ids (ioc:, tag:, campaign:) with tweetfeed.live URLs. fetch returns the full document as structuredContent: a 365-day IOC lookup with context, a tag overview, or a campaign header plus rows with CSV/STIX links. Add https://mcp.tweetfeed.live/ in ChatGPT under Settings, Connectors, no authentication required. The 11 typed tools are unchanged and remain the better choice for clients that support them - 13 tools total.

Two new plain-text blocklists: sha256.txt and md5.txt, one lowercase hex hash per line, for EDR/AV bulk import (Microsoft Defender for Endpoint's Indicators CSV import, CrowdStrike IOC management); coverage is smaller than domains/URLs since researchers tweet fewer hashes. A third, nrd-domains.txt, is the subset of domains.txt whose registrable apex had an RDAP creation date 30 days or less before TweetFeed's first report - a high-signal "newly registered and already reported" list, with two caveats: only apexes with a known RDAP creation date are considered (about 6 in 10 reported domains), and a domain can appear one tick after it was first reported. Separately, adguard.txt now ships an AdGuard/uBlock filter-list metadata header (! Title:, ! Homepage:, ! License:, ! Expires:, etc.) instead of the generic # header, making it a valid filter list for AdGuard Home, uBlock Origin and filter-list registries; the body is unchanged. 16 blocklist files total.

Three of the plain-text blocklists now ship a corroborated variant - domains-corroborated.txt, ips-corroborated.txt and urls-corroborated.txt (13 blocklist files total) - the entries also listed by at least one of URLhaus, ThreatFox, MalwareBazaar, USOM or IPsum as of TweetFeed's 6-hourly cross-check; set membership only, not a quality score. A new static file, exclusive.csv, is the opposite view: last-30-days rows not corroborated by those 5 feeds as of the last refresh - what TweetFeed has that the others don't (yet). /v1/ioc gains a matching external_exclusive boolean, and the MCP server's enrich_ioc renders a sentence when it is true.

Each AI-clustered campaign is now downloadable on its own: /v1/campaigns/<id> (JSON: header + complete unsampled IOC membership), /v1/campaigns/<id>.csv (same 6 columns as today.csv) and /v1/campaigns/<id>.stix.json (a self-contained STIX 2.1 bundle - Identity, TLP:CLEAR marking, one Indicator per IOC). The MCP server gets a matching get_campaign_iocs tool. /v1/{today,week,month}, /v1/campaigns, /v1/campaigns/iocs, /v1/trends and /v1/counts now cache for 300 s at the edge (was 60 s).

Added ?defang=1 to the JSON routes (/v1/today, /v1/week, /v1/month, /v1/since/..., /v1/ioc; /v1/year redirects to a raw CSV and is never defanged): IOC values come back as hxxps://evil[.]tld and 1[.]2[.]3[.]4 instead of live values, for pasting into a ticket or chat tool. Off by default - 0, false or no parameter returns the same response as today. Never applied to tweet/user, net.*, ai.summary or the /v1/campaigns routes.

Added IDS/SIEM blocklist exports: zeek-intel.txt for Zeek's Intelligence Framework, and wazuh-domains.txt/wazuh-ips.txt as Wazuh CDB lists. None of the three carries a header comment, so check freshness with /v1/manifest or the response's Last-Modified header instead. Also documented a Palo Alto Networks PAN-OS EDL setup on the existing domains.txt/ips.txt exports.

Added two machine-readable endpoints so a consumer can stop polling blind: /v1/status reports per-artifact freshness plus a per-request stale/fresh verdict (headers X-Feed-Stale/X-Feed-Age-Seconds), computed fresh on every request and never cached; /v1/manifest lists every published file with its byte size, row count and SHA-256, so a client can diff instead of re-downloading. The /feeds/ headline row now shows a live "Updated N min ago" chip reading straight off /v1/status.

The external corroboration sidecar on /search/ lookups now reads abuse.ch's full URLhaus and ThreatFox dumps instead of their "recent" ones, and adds a third source: MalwareBazaar. Hashes benefit the most - URLhaus mostly indexes URLs and ThreatFox rarely carried hashes, so this is the first real corroboration coverage for many of TweetFeed's SHA256/MD5 IOCs. Corroboration stays display-only: it never adds, removes or scores anything in the canonical feed.

Search gets more context on each lookup, plus a new ad-hoc query tool:

• Corroboration signal - IOC lookup records now show whether an indicator came from a single report or multiple accounts, with a tooltip that popularity is not a verdict.
• Also in these tweets - lookup records surface up to 5 other IOCs pulled from the same source tweets (via the new optional related field on /v1/ioc), each with a one-click pivot back into the lookup.
• Feed explorer - a new card on /search/ queries /v1/<window> with type, tag and user filters, a date range, CSV export and shareable deep-links.
• Report a false positive - every lookup record now links straight to the feedback board.
• OpenAPI - the spec now documents /v1/ioc, /v1/trends and the TAXII discovery endpoint.
• Per-type and per-user RSS - subscribe to a single IOC type (/rss/type/) or a single reporter (/rss/user/) without polling the firehose.
• External corroboration - IOC lookups now show when an indicator is also listed in URLhaus or ThreatFox (public abuse.ch feeds), refreshed every 6 hours.
• IP network context - IP lookups now show organisation/ASN and country from ipinfo.io (third-party sidecar, refreshed every 6 hours).

Structural fixes for false positives across every IOC type:

• Quote attribution - IOCs from quoted tweets now point to the original author, not the quoter.
• Hash filter - hex strings inside URL paths or subdomains (cloud bucket IDs, webinar IDs, phishing-kit session IDs) no longer leak as MD5/SHA256.
• Research-host whitelist - links to sample-sharing services no longer emit as URL or domain IOCs.
• CDN IPs - Anycast edges filtered; the domain is the actionable IOC, not the CDN frontend.

~10K historical false-positive rows cleaned.

Three new bulk data formats for SIEM, Threat Intelligence platforms and automation:

• STIX 2.1 bundles (today/week/month) at /stix/manifest.json - spec-compliant, TLP:CLEAR, deterministic UUIDs.
• Diff endpoint at /v1/since/<ISO8601> - incremental sync, returns only IOCs added after a given timestamp.
• Per-tag RSS at /rss/tag/<slug>.xml - subscribe to a single threat type without polling the firehose.

Full docs on the Feeds, API and Agents pages. The MCP server-card also lists the new endpoints under dataEndpoints.

After a few months paused, TweetFeed is back again.

TweetFeed stopped due to technical issues retrieving info from Twitter/X.

TweetFeed alive again.

Improved frontend, made it better for mobile devices (bootstrap ftw).

Created OpenCTI connector. [Tweet]

Thanks to @aaarghhh for building it.

Improved frontend, made it better for mobile devices (bootstrap ftw).

Added new tags and removed old ones with fewer hits.

Thanks to Matt Anderson for the suggestion.

Added #Spring4Shell. [Tweet]

Created the Dashboard section.

Added #log4j and #Log4Shell. [Tweet]

First commit.

Thanks to Germán Fernández and Will for the initial feedback about the project.