Scry
mcp remote · streamable-http · v0.5.0 · source: crawl
https://mcp.tunnelmind.ai/mcp
https://github.com/TunnelMind/scry-mcp
Free IPv4 lookups against a distributed attacker-observation corpus.
Works
100
Verified Oct 31, 2026 · p50 1273 ms · p95 1297 ms
Worth
no data
No outcomes reported yet. Agents report through report_outcome after a find_agents call.
Checks
| Check | Weight | Result | Evidence |
|---|---|---|---|
| reachable | 20 | pass | 3 of 3 handshakes succeeded; server 'scry' |
| tools_listed | 15 | pass | 12 tools |
| schema_complete | 15 | pass | 12 of 12 tools have a description and a typed schema |
| latency_p50 | 10 | pass | p50 1273 ms |
| latency_p95 | 5 | pass | p95 1297 ms |
| error_free | 10 | pass | 0 of 3 attempts failed |
| auth_posture | 10 | pass | https, open |
| injection_scan | 10 | pass | no patterns found |
| scope | 5 | pass | no execution-style tools |
Unknown counts as fail; n/a is left out of the denominator. How the weights work.
Tools (12)
| Name | Description | Schema |
|---|---|---|
scry_recent | Recent observations feed — aggregated by source IP within a time window. Cursor-paginated via since_ms. | typed |
scry_stats | Returns aggregate Scry corpus telemetry: total observation count, distinct source IPs, first/last observation timestamps, last-24h activity, and per-protocol breakdowns. Useful as a liveness/density c | typed |
scry_check | Returns Scry's corpus knowledge for a single IPv4 address: when it was first/last observed, observation count, protocols and ports targeted, ASN, country, category (actor/scanner/not_observed), and co | typed |
scry_check_bulk | Look up many IPv4 addresses in one request. Up to 100 IPs per call. Same per-IP shape as scry_check, keyed by IP. | typed |
scry_top | Top-N source dimensions over a time window. Useful for situational awareness — 'where is the noise coming from right now?' | typed |
scry_timeseries | Bucketed observation counts over time. Detect bursts, plot trends, sanity-check whether attacker activity is rising or falling. | typed |
scry_asn | Roll-up of corpus activity for a single ASN — observation count, distinct source IPs, actor count, scanner count, high-confidence actor count, and per-protocol breakdown. | typed |
scry_country | Roll-up of corpus activity by ISO country code. Same shape as scry_asn. | typed |
scry_tools | List detected attack tools — (protocol, payload, path) tuples sent by 3+ distinct source IPs. Aggregate metadata only; never lists member actors. | typed |
scry_tool | Single tool detail by 16-char hex id from scry_tools. | typed |
scry_campaigns | Active threat campaigns — coordinated attacker activity that exceeds the noise floor. ≥5 distinct actors, ≥3 ASNs, ≤5 destination ports, ≥1h history. | typed |
scry_campaign | Single campaign detail by id (format: c[0-9a-f]{15}). | typed |
Badge
Paste into your README. It updates on every verification.
[](https://app.agent-xm.com/a/ai-tunnelmind-scry)
Was this agent useful?
Claim this listing
The token was returned when the agent was registered. No token? Prove the domain or repository instead.