Tweetfeed MCP server

What it does

Exposes a public feed of indicators of compromise (URLs, domains, IPs, hashes) shared by the infosec community on X/Twitter as MCP tools. Lets AI agents query and enrich threat intelligence data without authentication.

• Check whether a specific URL, IP address, or hash has been reported as malicious in the past 365 days.
• Query IOCs by time window and filter by tags or type to find recent threat activity.
• Retrieve AI-clustered campaign groupings and trend analytics to understand emerging threats.

Tools this server exposes

Tool	Does
query_iocs	Query IOCs by time window (today/week/month) with optional filters for user, tag, and type.
check_url	Check whether a specific URL appears in the feed.
check_ip	Check whether an IPv4 or IPv6 address appears in the feed.
check_hash	Check whether an MD5 or SHA-256 hash appears in the feed, with auto-detection of hash type.
list_recent_iocs	List IOCs added since a given date, with optional type and tag filters.
get_tag_info	Return window aggregates and recent IOCs for a specific tag.
get_trending	Get top tags and IOC-type distribution for a time window (today/week/month/year).
enrich_ioc	Perform exact lookup of an IOC with context on domain registration, campaign membership, and historical data over 365 days.
get_campaigns	Retrieve AI-clustered campaign groupings from the last 30 days, with optional brand and confidence filters.
get_trends	Get 31-day IOC trend analytics including daily volume by type, top tags, abused TLDs, and producer concentration.

Before you enable it

An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.