Scry
Free IPv4 lookups against a distributed attacker-observation corpus.
| Endpoint | https://mcp.tunnelmind.ai/mcp (streamable-http) |
|---|---|
| Registry version | 0.5.0 |
| Now | 12 tools · grade C (72) · pin ts_5182af8e77b53fdeeb0817ab557c32cf · protocol 2025-03-26 |
| First / last listed | 2026-10-26 05:30 UTC / 2026-10-26 05:30 UTC |
| Grade over time | 2026-10-26: C (72), 12 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: scry_stats scry_check scry_check_bulk scry_top scry_timeseries scry_asn scry_country scry_tools scry_tool scry_campaigns scry_campaign scry_recent
scry_stats | Returns aggregate Scry corpus telemetry: total observation count, distinct
source IPs, first/last observation timestamps, last-24h activity, and
per-protocol breakdowns. Useful as a liveness/density check before issuing
per-IP queries — lets an agent decide whether the corpus has enough data
to be authoritative.
Use this tool when:
- An agent is planning a multi-step investigation and wants to kn params: none |
scry_check | Returns Scry's corpus knowledge for a single IPv4 address: when it was first/last
observed, observation count, protocols and ports targeted, ASN, country, category
(actor/scanner/not_observed), and confidence_bucket (low/medium/high).
Use when an agent needs IP triage, hostility assessment, or risk signaling.
Do NOT use for raw payloads (never exposed) or IPv6 (corpus is v4-only at v0.1). params: ip* |
scry_check_bulk | Look up many IPv4 addresses in one request. Up to 100 IPs per call. Same per-IP shape as scry_check, keyed by IP. params: ips* |
scry_top | Top-N source dimensions over a time window. Useful for situational awareness — 'where is the noise coming from right now?' params: dimension, since_ms, limit, include_noise |
scry_timeseries | Bucketed observation counts over time. Detect bursts, plot trends, sanity-check whether attacker activity is rising or falling. params: bucket, since_ms, until_ms |
scry_asn | Roll-up of corpus activity for a single ASN — observation count, distinct source IPs, actor count, scanner count, high-confidence actor count, and per-protocol breakdown. params: asn*, since_ms |
scry_country | Roll-up of corpus activity by ISO country code. Same shape as scry_asn. params: country*, since_ms |
scry_tools | List detected attack tools — (protocol, payload, path) tuples sent by 3+ distinct source IPs. Aggregate metadata only; never lists member actors. params: protocol, since_ms, limit |
scry_tool | Single tool detail by 16-char hex id from scry_tools. params: id* |
scry_campaigns | Active threat campaigns — coordinated attacker activity that exceeds the noise floor. ≥5 distinct actors, ≥3 ASNs, ≤5 destination ports, ≥1h history. params: include_inactive, limit |
scry_campaign | Single campaign detail by id (format: c[0-9a-f]{15}). params: id* |
scry_recent | Recent observations feed — aggregated by source IP within a time window. Cursor-paginated via since_ms. params: since_ms, limit, protocol, country, include_noise |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.