Nullcone Threat Intelligence

Real-time threat intelligence for AI agents — 900K+ IOCs including prompt-injection payloads and malicious AI-skill (MCP tool) indicators. Free, no API key. Check IPs, domains, URLs, hashes, CVEs, **prompt-injection payloads**, and **malicious AI-skill / MCP-tool definitions** against the live Nullcone network. Hosted over streamablecHTTP — nothing to install. ## Connect claude mcp add --transport http nullcone https://nullcone.ai/mcp Or point any MCP client at `https://nullcone.ai/mcp`. ## What you get - `lookup_ioc` — check any indicator against the feed - `recent_threats` — current threat picture - `submit_ioc` / `submit_batch` — contribute indicators - `check_prompt` — sub-millisecond prompt-injection lookup - `validate_skill` / `scan_skill_content` — vet MCP tools and AI skills before loading - `poll_since` — incremental sync, no persistent connection - 30+ tools total, plus resources (`threat://recent`, `threat://stats`) and analysis prompts No signup required. Reads and submissions are open; destructive tools are disabled on the public endpoint.

First seen 2 Oct 2026. Evidence as of 5 Oct 2026.