io.github.0xDanielLopez/tweetfeed — Model Context Protocol (MCP) Server

This MCP server provides access to IOCs (URLs, domains, IPs, hashes) shared by the infosec community on X/Twitter. It is described as having no authentication. The content is noted as CC0.

🛠️ Key Features

Shares IOCs: URLs, domains, IPs, hashes
Sources data from X/Twitter posts
No authentication (as stated)
CC0 licensing (as stated)

🚀 Use Cases

Threat intelligence enrichment using community-shared IOCs
IOC collection for security workflows where X/Twitter is a source

⚡ Developer Benefits

MCP integration aligned with topics: mcp and mcp-server
Fits server environments associated with cloudflare-workers
IOC-oriented usage via ioc topic categorization

⚠️ Limitations

No authentication is explicitly stated, which may be a constraint for protected or access-controlled use cases

tweetfeed-mcp

Model Context Protocol (MCP) server for tweetfeed.live.

Exposes the public IOC feed (URLs, domains, IPs, SHA256/MD5 hashes shared by the infosec community on Twitter/X) as MCP tools so AI agents can query threat intel programmatically.

Endpoint: https://mcp.tweetfeed.live/ (HTTP JSON-RPC 2.0, POST)
Protocol version: 2025-11-25 (negotiated; older clients fall back automatically)
Auth: none (all IOC data is CC0)
License (data): CC0-1.0 · License (code): MIT

Tools

Name	Purpose
`query_iocs`	Query IOCs by time window (today/week/month) with optional user, tag, and type filters.
`check_url`	Check whether a specific URL appears in the feed.
`check_ip`	Check whether an IPv4/IPv6 address appears in the feed.
`check_hash`	Check whether an MD5 or SHA-256 hash appears in the feed (type auto-detected).
`list_recent_iocs`	List IOCs added since a given date, with optional type/tag filters.
`get_tag_info`	Window aggregates plus recent IOCs for a tag (leading `#` optional).
`get_trending`	Top tags and IOC-type distribution for a window (today/week/month/year).
`enrich_ioc`	Auto-detect an IOC's type (url/domain/ip/md5/sha256) and look it up over the past 30 days.
`get_campaigns`	AI-clustered campaign groupings from the last 7 days, with optional brand and min-confidence filters.

Use with Claude Desktop / Claude.ai / other MCP clients

json

{
  "mcpServers": {
    "tweetfeed": {
      "url": "https://mcp.tweetfeed.live/"
    }
  }
}

Or from the Claude Code CLI:

bash

claude mcp add tweetfeed https://mcp.tweetfeed.live/

Quick test

bash

curl -sX POST https://mcp.tweetfeed.live/ \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}' | jq .

# Example tool call:
curl -sX POST https://mcp.tweetfeed.live/ \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/call","id":2,
       "params":{"name":"query_iocs",
                 "arguments":{"time":"today","tag":"phishing","type":"url","limit":5}}}' | jq .

Develop

bash

npm install
npm run dev          # wrangler dev on http://localhost:8787
MCP_URL=http://localhost:8787 npm test

Deploy

bash

npm run deploy       # wrangler deploy (routes mcp.tweetfeed.live/*)
MCP_URL=https://mcp.tweetfeed.live npm test

time	string	required	Time window. 'today' = since UTC midnight, 'week' = last 7 days, 'month' = last 30 days.
user	string	optional	Optional: filter by Twitter/X handle WITHOUT the @ prefix (e.g. 'malwrhunterteam', 'JCyberSec_').
tag	string	optional	Optional: filter by tag, case-insensitive substring match. Examples: 'phishing', 'cobaltstrike', 'ransomware', 'APT', 'Lockbit'. ~122 tags exist - see https://tweetfeed.live/ for the live taxonomy.
type	string	optional	Optional: filter by IOC type.
limit	number	optional	Optional: max rows to return (1-1000). Default 100.

since	string	required	ISO date (YYYY-MM-DD) for the lower bound. Example: '2026-04-15'.
limit	number	optional	Max results (1-1000). Default 100.
type	string	optional	Optional: filter by IOC type.
tag	string	optional	Optional: filter by tag (case-insensitive substring match on the tag list).

tag	string	required	Tag to look up (e.g. 'phishing', 'CobaltStrike', 'lockbit'). Case-insensitive. The leading '#' is optional. ~122 tags exist - see https://tweetfeed.live/tags/ for the full list.
limit	number	optional	Max recent IOCs to include (1-100). Default 10.

window	string	required	Time window. 'today' = since UTC midnight, 'week' = last 7 days, 'month' = last 30 days, 'year' = last 365 days.
limit	number	optional	How many top tags to return (1-100). Default 20.

brand	string	optional	Optional: filter by targeted brand, case-insensitive substring match against targeted_brand (e.g. 'paypal', 'microsoft'). Campaigns with no identified brand are excluded when this is set.
min_confidence	string	optional	Optional: minimum clustering confidence to include (low < medium < high). Only campaigns at or above this confidence are returned.
limit	number	optional	Optional: max campaigns to return (1-50). Default 20.

TweetFeed

io.github.0xDanielLopez/tweetfeed — Model Context Protocol (MCP) Server

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

query_iocs

check_url

check_ip

check_hash

list_recent_iocs

get_tag_info

get_trending

enrich_ioc

get_campaigns

tweetfeed-mcp

Tools

Use with Claude Desktop / Claude.ai / other MCP clients

Quick test

Develop

Deploy

Install

Remote endpoint