`port_activity`

Pack: isc-sans · Endpoint: https://gateway.pipeworx.io/isc-sans/mcp

Get recent attack/probe activity for a TCP/UDP port from SANS ISC — daily counts of report records, distinct target IPs, and distinct source IPs hitting the port. Useful for spotting scanning surges against services like SSH (22), RDP (3389), SMB (445), or Telnet (23). Keyless.

Parameters

Name	Type	Required	Description
`port`	number	yes	A port number, e.g. 22 (SSH), 3389 (RDP), 445 (SMB), 23 (Telnet).

Example call

Arguments

{
  "port": 22
}

curl

curl -X POST https://gateway.pipeworx.io/isc-sans/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"port_activity","arguments":{"port":22}}}'

TypeScript (@pipeworx/sdk)

import { Pipeworx } from '@pipeworx/sdk';
const pipeworx = new Pipeworx();

const result = await pipeworx.call('port_activity', {
  "port": 22
});

More examples

{
  "port": 3389
}

Connect

Add this to your MCP client config, or use one-click install buttons:

{
  "mcpServers": {
    "isc-sans": {
      "url": "https://gateway.pipeworx.io/isc-sans/mcp"
    }
  }
}

See Getting Started for client-specific install steps.

port_activity