`port_activity`

Pack: isc-sans · Connect: https://pipeworx.io/mcp (see Connect below for a single-pack URL)

No MCP client? Call it directly: GET https://gateway.pipeworx.io/v1/tools/port_activity for the schema, then POST the same URL with its arguments for the data.

Get recent attack/probe activity for a TCP/UDP port from SANS ISC — daily counts of report records, distinct target IPs, and distinct source IPs hitting the port. Useful for spotting scanning surges against services like SSH (22), RDP (3389), SMB (445), or Telnet (23). Keyless.

Parameters

Name	Type	Required	Description
`port`	number	yes	A port number, e.g. 22 (SSH), 3389 (RDP), 445 (SMB), 23 (Telnet).

Example call

Arguments

{
  "port": 22
}

curl

curl -X POST https://gateway.pipeworx.io/isc-sans/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"port_activity","arguments":{"port":22}}}'

TypeScript (@pipeworx/sdk)

import { Pipeworx } from '@pipeworx/sdk';
const pipeworx = new Pipeworx();

const result = await pipeworx.call('port_activity', {
  "port": 22
});

More examples

{
  "port": 3389
}

Connect

Add this to your MCP client config — every tool in the catalog, including this one — or use one-click install buttons:

{
  "mcpServers": {
    "pipeworx": {
      "url": "https://pipeworx.io/mcp"
    }
  }
}

Connect to just the isc-sans pack

{
  "mcpServers": {
    "isc-sans": {
      "url": "https://gateway.pipeworx.io/isc-sans/mcp"
    }
  }
}

See Getting Started for client-specific install steps.

port_activity