Servers Playground How we check Add a server Log in

Scry

Working · 383 ms

ai.tunnelmind/scryv0.5.0 Domain verified

Free IPv4 lookups against a distributed attacker-observation corpus.

Security

Source Website Registry entry

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://mcp.tunnelmind.ai/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

scry_asn

Roll-up of corpus activity for a single ASN — observation count, distinct source IPs, actor count, scanner count, high-confidence actor count, and per-protocol breakdown.

asnstring, required

since_msinteger

This tool isn't marked read-only, so it may change something on the server or in an account you connected.

I understand, run it anyway

Scry MCP server | mcptry

Tools (12)

scry_asn

Roll-up of corpus activity for a single ASN — observation count, distinct source IPs, actor count, scanner count, high-confidence actor count, and per-protocol breakdown.

Argument	Type	Description
asn*	string
since_ms	integer

Input schema (JSON)

{
  "type": "object",
  "required": [
    "asn"
  ],
  "properties": {
    "asn": {
      "type": "string"
    },
    "since_ms": {
      "type": "integer"
    }
  },
  "additionalProperties": false
}

scry_campaign

Single campaign detail by id (format: c[0-9a-f]{15}).

Argument	Type	Description
id*	string

Input schema (JSON)

{
  "type": "object",
  "required": [
    "id"
  ],
  "properties": {
    "id": {
      "type": "string",
      "pattern": "^c[0-9a-f]{15}$"
    }
  },
  "additionalProperties": false
}

scry_campaigns

Active threat campaigns — coordinated attacker activity that exceeds the noise floor. ≥5 distinct actors, ≥3 ASNs, ≤5 destination ports, ≥1h history.

Argument	Type	Description
limit	integer
include_inactive	boolean

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "maximum": 200,
      "minimum": 1
    },
    "include_inactive": {
      "type": "boolean"
    }
  },
  "additionalProperties": false
}

scry_check

Returns Scry's corpus knowledge for a single IPv4 address: when it was first/last observed, observation count, protocols and ports targeted, ASN, country, category (actor/scanner/not_observed), and confidence_bucket (low/medium/high). Use when an agent needs IP triage, hostility assessment, or risk signaling. Do NOT use for raw payloads (never exposed) or IPv6 (corpus is v4-only at v0.1).

Argument	Type	Description
ip*	string	IPv4 address (e.g. '8.8.8.8')

Input schema (JSON)

{
  "type": "object",
  "required": [
    "ip"
  ],
  "properties": {
    "ip": {
      "type": "string",
      "description": "IPv4 address (e.g. '8.8.8.8')"
    }
  },
  "additionalProperties": false
}

scry_check_bulk

Look up many IPv4 addresses in one request. Up to 100 IPs per call. Same per-IP shape as scry_check, keyed by IP.

Argument	Type	Description
ips*	array

Input schema (JSON)

{
  "type": "object",
  "required": [
    "ips"
  ],
  "properties": {
    "ips": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "maxItems": 100,
      "minItems": 1
    }
  },
  "additionalProperties": false
}

scry_country

Roll-up of corpus activity by ISO country code. Same shape as scry_asn.

Argument	Type	Description
country*	string
since_ms	integer

Input schema (JSON)

{
  "type": "object",
  "required": [
    "country"
  ],
  "properties": {
    "country": {
      "type": "string",
      "pattern": "^[A-Za-z]{2}$"
    },
    "since_ms": {
      "type": "integer"
    }
  },
  "additionalProperties": false
}

scry_recent

Recent observations feed — aggregated by source IP within a time window. Cursor-paginated via since_ms.

Argument	Type	Description
limit	integer
country	string
protocol	string
since_ms	integer
include_noise	boolean

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "maximum": 500,
      "minimum": 1
    },
    "country": {
      "type": "string",
      "pattern": "^[A-Za-z]{2}$"
    },
    "protocol": {
      "type": "string"
    },
    "since_ms": {
      "type": "integer"
    },
    "include_noise": {
      "type": "boolean"
    }
  },
  "additionalProperties": false
}

scry_stats

Returns aggregate Scry corpus telemetry: total observation count, distinct source IPs, first/last observation timestamps, last-24h activity, and per-protocol breakdowns. Useful as a liveness/density check before issuing per-IP queries — lets an agent decide whether the corpus has enough data to be authoritative. Use this tool when: - An agent is planning a multi-step investigation and wants to know if Scry has corpus density worth querying. - You want a 'corpus health' signal in a dashboard or report. Do NOT use this tool when: - You want details about a specific IP — use `scry_check`. - You want sensor fleet size or node identities — never exposed at any tier. Inputs: none. Returns: total_observations, distinct_source_ips, first_seen_ms, last_seen_ms, observations_last_24h, distinct_source_ips_last_24h, by_protocol, as_of_ms. Cost: free, anonymous, rate-limited. Latency: <100ms typical.

No arguments.

Input schema (JSON)

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

scry_timeseries

Bucketed observation counts over time. Detect bursts, plot trends, sanity-check whether attacker activity is rising or falling.

Argument	Type	Description
bucket	string
since_ms	integer
until_ms	integer

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "bucket": {
      "enum": [
        "minute",
        "hour",
        "day"
      ],
      "type": "string"
    },
    "since_ms": {
      "type": "integer"
    },
    "until_ms": {
      "type": "integer"
    }
  },
  "additionalProperties": false
}

scry_tool

Single tool detail by 16-char hex id from scry_tools.

Argument	Type	Description
id*	string

Input schema (JSON)

{
  "type": "object",
  "required": [
    "id"
  ],
  "properties": {
    "id": {
      "type": "string",
      "pattern": "^[0-9a-f]{16}$"
    }
  },
  "additionalProperties": false
}

scry_tools

List detected attack tools — (protocol, payload, path) tuples sent by 3+ distinct source IPs. Aggregate metadata only; never lists member actors.

Argument	Type	Description
limit	integer
protocol	string
since_ms	integer

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "maximum": 200,
      "minimum": 1
    },
    "protocol": {
      "type": "string"
    },
    "since_ms": {
      "type": "integer"
    }
  },
  "additionalProperties": false
}

scry_top

Top-N source dimensions over a time window. Useful for situational awareness — 'where is the noise coming from right now?'

Argument	Type	Description
limit	integer
since_ms	integer
dimension	string
include_noise	boolean

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "maximum": 100,
      "minimum": 1
    },
    "since_ms": {
      "type": "integer"
    },
    "dimension": {
      "enum": [
        "asn",
        "country",
        "protocol",
        "port"
      ],
      "type": "string"
    },
    "include_noise": {
      "type": "boolean"
    }
  },
  "additionalProperties": false
}