Wraps the Scry distributed attacker observation corpus as a single MCP tool. Right now it exposes scry_check, which queries GET /v1/check/{ip} for free IPv4 reputation lookups. Future tools like scry_watch, scry_actor, and scry_campaign are planned but require ATAP attestation and a defender tier subscription. The server runs on Cloudflare Workers at mcp.tunnelmind.ai, implements MCP spec 2025-03-26 over streamable HTTP, and acts as a stateless JSON-RPC 2.0 proxy with no bindings or secrets. Reach for this when you need threat intelligence on an IP address during incident triage or security workflows.
MCP (Model Context Protocol) server for the Scry corpus. Wraps the scry-api public endpoints as agent-callable tools.
Hosted at mcp.tunnelmind.ai. MCP spec version 2025-03-26. Streamable HTTP transport.
| Tool | Wraps | Tier |
|---|---|---|
scry_check | GET /v1/check/{ip} | Free |
Future tools (deferred to defender tier; need ATAP attestation):
scry_watch — subscribe to state changes for an IP/domainscry_actor — full actor profilescry_campaign — campaign detailPOST https://mcp.tunnelmind.ai/mcp
Content-Type: application/json
{"jsonrpc":"2.0","id":1,"method":"initialize"}
Methods:
initialize — handshake, returns { protocolVersion, capabilities, serverInfo }notifications/initialized — client → server notification (returns 204)tools/list — returns { tools: [...] }tools/call — { name, arguments } → { content: [{ type: "text", text }] }ping — returns {}Discovery:
GET https://mcp.tunnelmind.ai/
→ { service, version, protocol, transport, endpoint, tools }
src/
worker.js transport (JSON-RPC 2.0 over POST /mcp)
tools.js tool definitions + handlers
test/
tools.test.js unit tests for tool registry
npm test
npx wrangler deploy
No bindings, no secrets — this Worker is a thin proxy with no state.