Scry is an MCP server with 12 tools an agent can call, among them scry_asn, scry_campaign, scry_campaigns. It answers at https://mcp.tunnelmind.ai/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 10 of 10 times since 4 September 2026; the last check, on 17 October 2026, succeeded.
Free IPv4 lookups against a distributed attacker-observation corpus.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
scry_asn | Roll-up of corpus activity for a single ASN — observation count, distinct source IPs, actor count, scanner count, high-confidence actor count, and per-protocol breakdown. Inputs: asn, since_ms |
scry_campaign | Single campaign detail by id (format: c[0-9a-f]{15}). Inputs: id |
scry_campaigns | Active threat campaigns — coordinated attacker activity that exceeds the noise floor. ≥5 distinct actors, ≥3 ASNs, ≤5 destination ports, ≥1h history. Inputs: include_inactive, limit |
scry_check | Returns Scry's corpus knowledge for a single IPv4 address: when it was first/last observed, observation count, protocols and ports targeted, ASN, country, category (actor/scanner/not_observed), and confidence_bucket (low/medium/high). Use w Inputs: ip |
scry_check_bulk | Look up many IPv4 addresses in one request. Up to 100 IPs per call. Same per-IP shape as scry_check, keyed by IP. Inputs: ips |
scry_country | Roll-up of corpus activity by ISO country code. Same shape as scry_asn. Inputs: country, since_ms |
scry_recent | Recent observations feed — aggregated by source IP within a time window. Cursor-paginated via since_ms. Inputs: since_ms, limit, protocol, country, include_noise |
scry_stats | Returns aggregate Scry corpus telemetry: total observation count, distinct source IPs, first/last observation timestamps, last-24h activity, and per-protocol breakdowns. Useful as a liveness/density check before issuing per-IP queries — let |
scry_timeseries | Bucketed observation counts over time. Detect bursts, plot trends, sanity-check whether attacker activity is rising or falling. Inputs: bucket, since_ms, until_ms |
scry_tool | Single tool detail by 16-char hex id from scry_tools. Inputs: id |
scry_tools | List detected attack tools — (protocol, payload, path) tuples sent by 3+ distinct source IPs. Aggregate metadata only; never lists member actors. Inputs: protocol, since_ms, limit |
scry_top | Top-N source dimensions over a time window. Useful for situational awareness — 'where is the noise coming from right now?' Inputs: dimension, since_ms, limit, include_noise |
Every block below points at https://mcp.tunnelmind.ai/mcp. Pick your client and copy.
claude mcp add --transport http scry https://mcp.tunnelmind.ai/mcp
{
"mcpServers": {
"scry": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://mcp.tunnelmind.ai/mcp"]
}
}
}{
"mcpServers": {
"scry": {
"url": "https://mcp.tunnelmind.ai/mcp"
}
}
}{
"servers": {
"scry": {
"type": "http",
"url": "https://mcp.tunnelmind.ai/mcp"
}
}
}{
"context_servers": {
"scry": {
"url": "https://mcp.tunnelmind.ai/mcp"
}
}
}{
"mcpServers": {
"scry": {
"serverUrl": "https://mcp.tunnelmind.ai/mcp"
}
}
}{
"mcpServers": {
"scry": {
"url": "https://mcp.tunnelmind.ai/mcp"
}
}
}name: Scry
version: 0.0.1
schema: v1
mcpServers:
- name: Scry
type: streamable-http
url: https://mcp.tunnelmind.ai/mcp{
"mcpServers": {
"scry": {
"httpUrl": "https://mcp.tunnelmind.ai/mcp"
}
}
}{
"mcpServers": {
"scry": {
"type": "http",
"url": "https://mcp.tunnelmind.ai/mcp"
}
}
}{
"mcpServers": {
"scry": {
"url": "https://mcp.tunnelmind.ai/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fmcp.tunnelmind.ai%2Fmcp&type=streamable_http&id=scry&name=Scry
It answered our last check on 17 October 2026 in 143 ms. Over 10 checks since 4 September 2026 it answered 10. Status here comes from Neuronto's own probes, not from the publisher.
Yes. It is published by tunnelmind.ai and served from mcp.tunnelmind.ai, the vendor's own domain: https://mcp.tunnelmind.ai/mcp.
12, as returned by the server's own tools/list on 8 September 2026: scry_asn, scry_campaign, scry_campaigns, scry_check, scry_check_bulk, scry_country, scry_recent, scry_stats, and 4 more.
It answered our last check on 17 October 2026 in 143 ms. Over 10 checks since 4 September 2026 it answered 10.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://mcp.tunnelmind.ai/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: ai.tunnelmind. Endpoint host: mcp.tunnelmind.ai. ARD identifier: urn:air:ai.tunnelmind:mcp:scry.
First indexed 31 August 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.