Nullcone Threat Intelligence
io.github.maco144/nullcone
About Nullcone Threat Intelligence
Nullcone Threat Intelligence is an MCP server published by the GitHub account maco144. Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats
It is hosted by the publisher at one address, so there is nothing to install: your AI client connects to it over the internet.
It asks for no keys or passwords.
Version 0.1.0 was published on 6 June 2026, and the source code is public, so you can read it before installing.
Written from the registry entry. 7 automated checks on the registry entry and the live tool descriptions: 4 pass, 0 warn, 0 fail, 3 info. How we check.
What it asks for
This server declares no environment variables, so it asks for no keys or settings.
Checks
| Check | Result | Detail |
|---|---|---|
| Source repository linked | Pass | https://github.com/maco144/nullcone-mcp |
| Remote uses HTTPS | Pass | All remote endpoints use https:// |
| Secrets requested | Info | Asks for no secrets |
| Namespace ownership | Info | Name verified via GitHub account maco144 |
| Registry text aimed at the AI | Pass | Description and settings contain no hidden characters or instructions to the AI |
| Tool descriptions read | Info | Lists 30 tools: submit_ioc, submit_batch, lookup_ioc, recent_threats, family_threats, list_families, search_by_type, report_detection, vote_false_positive, poll_since, get_stats, validate_skill, … |
| Hidden instructions in tools | Pass | Read every tool description and the server instructions: no hidden characters or instructions to the AI |
Popularity & health: 36 / 100
Worked out from public numbers and our own checks, not from user reviews or ratings. It says how used and how looked-after a server is, not whether it is safe.
0 forks, 0 merged pull requests. Sources: GitHub, npm, PyPI (pypistats.org) and Hacker News (Algolia), fetched 2026-10-31.
What people say
No Hacker News threads link to its source code.
Look further: search Reddit, search Hacker News, read its GitHub issues. These are not reviews we checked.
Facts
| Registry name | io.github.maco144/nullcone |
|---|---|
| Publisher | GitHub account maco144 |
| How the name is verified | Name verified via GitHub account maco144. The registry ties the name prefix to that account or domain; it does not check the code. |
| Type | Remote: hosted at a URL, nothing to install |
| Remote endpoints | streamable-http https://nullcone.ai/mcp |
| Version | 0.1.0 |
| Published | |
| Last updated | |
| Source repository | https://github.com/maco144/nullcone-mcp |
| Website | https://nullcone.ai |
| Category | Security (assigned by keyword rule, not by hand) |
Related servers in Security
Proofpoint MCP4/4Proofpoint TAP threats, VAPs, clickers, and IOCs from your…- BlackDome Threat Intel7/7Live honeypot threat intel: attacker IPs, IOCs, credentials,…
- BlackDome Threat Intel7/7Live honeypot threat intel: attacker IPs, IOCs, credentials,…
DugganUSA CLI — Local STDIO MCP7/7Local STDIO MCP for DugganUSA threat intel. 1.13M IOCs. Read-only.…
- Bawbel Scanner7/7Scan MCP servers and skill files for AVE vulnerabilities.…
- 1Claw Vault6/7HSM-backed vault secrets for AI agents (JIT fetch) plus…