TweetFeed is an MCP server with 10 tools an agent can call, among them check_hash, check_ip, check_url. It answers at https://mcp.tweetfeed.live/ over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 10 of 10 times since 5 September 2026; the last check, on 18 October 2026, succeeded.
IOCs (URLs, domains, IPs, hashes) shared by the infosec community on X/Twitter. No auth, CC0.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
check_hash | Check whether a file hash (MD5 or SHA-256) appears in the TweetFeed corpus. Exact match over the past 365 days (falls back to a 30-day window if there's no exact hit); also flags older, pre-365-day archive history when it exists, so a clean Inputs: hash |
check_ip | Check whether an IP address appears in the TweetFeed corpus. Exact match over the past 365 days (falls back to a 30-day substring window if there's no exact hit, so '1.2.3' will still match '1.2.3.4' there); also flags older, pre-365-day ar Inputs: ip |
check_url | Check whether a URL (or substring) appears in the TweetFeed corpus over the past 30 days. Useful for confirming if an observed URL has been flagged by the public infosec Twitter/X community. Case-insensitive substring match against the 'val Inputs: url |
enrich_ioc | Look up an IOC value in TweetFeed. First an EXACT lookup over the past 365 days (aggregated: first_seen, last_seen, count, reporters, tags, last source tweets; accepts defanged input and http/https variants), including AI-generated context Inputs: value |
get_campaigns | AI-clustered campaign groupings of the last 30 days of community-shared TweetFeed IOCs: each campaign bundles related URLs/domains/IPs/hashes under a name, a short context summary, a clustering confidence (high/medium/low), and a targeted b Inputs: brand, min_confidence, limit |
get_tag_info | Bundle of TweetFeed activity for a single tag: aggregate counts across today/week/month/year windows plus the most recent IOCs. Saves the agent from making three separate calls to assemble a tag overview. Tag can be passed with or without a Inputs: tag, limit |
get_trending | Top tags and IOC-type distribution for a given time window, computed from the live counts.json aggregate. Useful for 'what is the infosec community talking about right now' or 'which malware family is spiking this week' queries. Source: GET Inputs: window, limit |
get_trends | IOC trend analytics from the last 31 days: daily volume by type, top moving tags week-over-week, most-abused TLDs, new vs recurring indicator ratio, and feed producer concentration. Returned tag/TLD/username values are community/attacker-au Inputs: section |
list_recent_iocs | List TweetFeed IOCs added since a given date, useful for delta-syncing a blocklist or Threat Intelligence pipeline. Source is the 30-day month window so 'since' must be within the past 30 days; older queries return only the part within the Inputs: since, limit, type, tag |
query_iocs | Query the TweetFeed API for Indicators of Compromise (IOCs: URLs, domains, IPs, MD5/SHA256 hashes) shared by the infosec community on Twitter/X. Returns matching rows with date, researcher handle, type, value, tags, and tweet URL. All data Inputs: time, user, tag, type, limit |
Every block below points at https://mcp.tweetfeed.live/. Pick your client and copy.
claude mcp add --transport http tweetfeed https://mcp.tweetfeed.live/
{
"mcpServers": {
"tweetfeed": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://mcp.tweetfeed.live/"]
}
}
}{
"mcpServers": {
"tweetfeed": {
"url": "https://mcp.tweetfeed.live/"
}
}
}{
"servers": {
"tweetfeed": {
"type": "http",
"url": "https://mcp.tweetfeed.live/"
}
}
}{
"context_servers": {
"tweetfeed": {
"url": "https://mcp.tweetfeed.live/"
}
}
}{
"mcpServers": {
"tweetfeed": {
"serverUrl": "https://mcp.tweetfeed.live/"
}
}
}{
"mcpServers": {
"tweetfeed": {
"url": "https://mcp.tweetfeed.live/"
}
}
}name: TweetFeed
version: 0.0.1
schema: v1
mcpServers:
- name: TweetFeed
type: streamable-http
url: https://mcp.tweetfeed.live/{
"mcpServers": {
"tweetfeed": {
"httpUrl": "https://mcp.tweetfeed.live/"
}
}
}{
"mcpServers": {
"tweetfeed": {
"type": "http",
"url": "https://mcp.tweetfeed.live/"
}
}
}{
"mcpServers": {
"tweetfeed": {
"url": "https://mcp.tweetfeed.live/"
}
}
}goose://extension?url=https%3A%2F%2Fmcp.tweetfeed.live%2F&type=streamable_http&id=tweetfeed&name=TweetFeed
It answered our last check on 18 October 2026 in 123 ms. Over 10 checks since 5 September 2026 it answered 10. Status here comes from Neuronto's own probes, not from the publisher.
10, as returned by the server's own tools/list on 31 August 2026: check_hash, check_ip, check_url, enrich_ioc, get_campaigns, get_tag_info, get_trending, get_trends, and 2 more.
It answered our last check on 18 October 2026 in 123 ms. Over 10 checks since 5 September 2026 it answered 10.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://mcp.tweetfeed.live/. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: io.github.0xdaniellopez. Endpoint host: mcp.tweetfeed.live. ARD identifier: urn:air:io.github.0xdaniellopez:mcp:tweetfeed.
First indexed 31 August 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.