@pipeworx/isc-sans
Connect: https://pipeworx.io/mcp — every tool in the catalog, including @pipeworx/isc-sans’s. Install: one-click buttons
Connect to just the @pipeworx/isc-sans pack
https://gateway.pipeworx.io/isc-sans/mcp — only @pipeworx/isc-sans’s own tools, nothing else in the catalog.
No MCP client? Skip the connection: POST https://gateway.pipeworx.io/v1/tools/search_packs {"query":"..."} to find a tool below, GET /v1/tools/<name> for its schema, POST the same URL with arguments for the data — see For AI agents.
Tools: 3
Tools
- ip_reputation — Look up an IPv4 address in the SANS ISC DShield database — its attack-report history, ASN/owner, abuse contact, and risk. A high report_count means the IP is an active attack source (firewall logs sub
- port_activity — Get recent attack/probe activity for a TCP/UDP port from SANS ISC — daily counts of report records, distinct target IPs, and distinct source IPs hitting the port. Useful for spotting scanning surges a
- threat_level — Get the global SANS ISC InfoCon threat level — the internet-wide “weather report” for malicious activity. Returns one of green/yellow/orange/red with a plain-English meaning. An at-a-glance signal o
Tools
ip_reputation— Look up an IPv4 address in the SANS ISC DShield database — its attack-report history, ASN/owner, abuse contact, and risk. A high report_count means the IP is an active attack source (firewall logs subport_activity— Get recent attack/probe activity for a TCP/UDP port from SANS ISC — daily counts of report records, distinct target IPs, and distinct source IPs hitting the port. Useful for spotting scanning surges athreat_level— Get the global SANS ISC InfoCon threat level — the internet-wide weather report for malicious activity. Returns one of green/yellow/orange/red with a plain-English meaning. An at-a-glance signal of wh