Scan and Threat Intel over MCP_

Add a remote Streamable HTTP server in your MCP client and paste this URL. Choose no authentication if asked. No account, API key, or credits are needed.

https://www.midkernel.com/security/app/mcp/threat-intel

The connection exposes ti_sources, ti_classes, ti_daily_report, ti_latest, ti_trends, and ti_get. Try asking: “Give me yesterday's UTC threat report, with citations and coverage caveats.”

Each public IP can make 30 requests and 6 tool calls per minute, with one tool call at a time. IPv6 addresses in the same /64 share a limit. Shared service limits are 120 requests, 20 tool calls per minute, and two simultaneous tool calls. Minute quotas reset on the minute. On HTTP 429, wait for Retry-After before retrying; HTTP 503 means temporarily unavailable. Other users on the same network may share your allowance.

The hosted MCP for Scan is the same product as /security/scan, not a third product. Connect a GitHub repository you authorize, start a hosted review, poll the run, and fetch the report and findings. Same tools as the Cursor plugin. Credits meter runs. No Stripe.

Register a service_auth agent with an email hint, then open the returned verification URL for the account holder and show the code separately. Google sign-in proves the email; the human reviews the current workspace and explicitly approves access. Registration creates no account, workspace, credits, or scans.

The pending request lasts ten minutes. The default threat-intel:read scope spends no Scan credits. Request scan only with explicit approval for paid Scan access. After approval, the claim grant issues a revocable one-hour access token without a refresh token or identity assertion.

Choose one exact resource per grant. Agent registration defaults to https://www.midkernel.com for protected REST and MCP access. Existing OAuth clients default to https://www.midkernel.com/security/app/mcp. The resource stays bound through exchange and refresh; the issuer remains https://www.midkernel.com/security/app.

Follow the canonical authentication instructions for request formats, polling, and claim renewal, or read the root auth.md summary. Account holders can manage and revoke agent access.

Use the public URL above, or request threat-intel:read on the account-based connection, to read Midkernel's own public-source threat evidence. These tools do not access your repositories, dependencies, or other user data, and do not use credits.

Discover filters with ti_sources and ti_classes. Each returns its complete supported catalog in one response. Use the exact IDs in ti_latest.source and ti_latest.class; unknown IDs return invalid_query with valid examples and the discovery tool to call. The source catalog includes its pinned revision. A valid source or class can have no records in the requested window.

For a prioritized daily report, call ti_daily_report with no arguments. It selects findings from the previous complete UTC day using stored source-effective dates. Each citation identifies its date basis: publication, catalog addition, or incident. The complete eligible day is considered before the top findings are selected.

Priority reasons point to included source citations. The ordering expresses attention priority, not a severity or exploitation-probability score. Read the coverage and omission counts: ambiguous identities, unusable citations, and unverified source attribution can exclude evidence. Late arrivals and corrections can change a later report; an empty result does not establish that there were no threats.

For daily alerts, call ti_latest with an ISO timestamp in since. The default is 30 records in format=full, with up to 200 records per page. Use format=summary for up to 500 records per page: identities, timestamps, classes, sources, title, public URL, and evidence count, without prose or provenance. Call ti_get for a selected record's retained detail.

Follow every nextCursor with the same timestamps, filters, timeField, and format; the cursor freezes the first page's until. Changing a bound value returns invalid_query, so start without a cursor to change it. Save the final page's checkpoint.since for the next poll. The checkpoint overlaps recent ingestion; deduplicate repeated (id, matchedAt) pairs.

For a weekly digest, call ti_trends with window.from and window.to as inclusive UTC source-effective dates and groupBy as class, source, or day. Each window is limited to 60 days and is compared with the immediately preceding equal window. Tool descriptions give the complete input and pagination contract.

Evidence that cannot be resolved from a multi-identifier bundle remains listable with identityStatus: ambiguous_bundle. These groups are excluded from unique, class, and daily threat counts. Trends report summary.ambiguousGroups and summary.previousAmbiguousGroups with a notice explaining the exclusion. These are group counts, not additional CVE counts; the remaining totals are not complete CVE coverage.

Counts describe canonical public-source evidence, not attacks or affected users. Feed coverage changes can drive spikes. Withheld counts are null, not zero. KEV absence is not proof that a vulnerability is unexploited.