threatcrush

com.profullstack/threatcrushVersion 1.0.0

Reputation + security findings (threatcrush.com)

Status

Responds384 msNov 14, 2026, 14:11 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:11 UTC
Latency: 384 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 21:12 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://threatcrush.com/api/mcpResponds384 msNov 14, 2026, 14:11 UTC

No sign-in

Claude Code

claude mcp add --transport http threatcrush https://threatcrush.com/api/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: threatcrush
Remote MCP server URL: https://threatcrush.com/api/mcp

Cursor

{
  "mcpServers": {
    "threatcrush": {
      "url": "https://threatcrush.com/api/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"threatcrush","type":"http","url":"https://threatcrush.com/api/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

20 tools

Tools of threatcrush
	Description		Read-only	Idempotent	Open world
`av_hash_lookup`CrushAV file reputation, no key needed: look up up to 100 SHA-256 file hashes. For each hash something is known about, returns `knownMalicious` (the source listing it as malware), `malwareName`, `trust` (0-100: how sure CIRCL hashlookup is that this is a published, known-good file from NSRL or a major OS/package repo) and a `fileName` it was seen as. Unknown hashes are omitted. Send hashes only, never file contents.	CrushAV file reputation, no key needed: look up up to 100 SHA-256 file hashes. For each hash something is known about, returns `knownMalicious` (the source listing it as malware), `malwareName`, `trust` (0-100: how sure CIRCL hashlookup is that this is a published, known-good file from NSRL or a major OS/package repo) and a `fileName` it was seen as. Unknown hashes are omitted. Send hashes only, never file contents.	Not declared	Yes	Not declared	Yes
`create_invite`Create one invite link (each account has 3, single use, 30 days). When a new account joins on it and confirms its email, both get bonus credits. Session token only.	Create one invite link (each account has 3, single use, 30 days). When a new account joins on it and confirms its email, both get bonus credits. Session token only.	No	No	No	No
`findings_get`One tracked finding with its details (code snippet, remediation, evidence), property and history.	One tracked finding with its details (code snippet, remediation, evidence), property and history.	Not declared	Yes	Not declared	No
`findings_list`Your org's tracked findings from threatcrush scan, pentest and ai-scan (deduped across runs, with a triage status). Default: open + acknowledged. Session token or tc_agent_ key.	Your org's tracked findings from threatcrush scan, pentest and ai-scan (deduped across runs, with a triage status). Default: open + acknowledged. Session token or tc_agent_ key.	Not declared	Yes	Not declared	No
`findings_triage`Set the status and/or note of up to 500 findings: acknowledged, fixed, false_positive, ignored or open. fixed is reopened by a later run that still sees it; false_positive and ignored never are. Needs write.	Set the status and/or note of up to 500 findings: acknowledged, fixed, false_positive, ignored or open. fixed is reopened by a later run that still sees it; false_positive and ignored never are. Needs write.	No	No	Yes	No
`incidents_get`One incident: linked forensic evidence, recent events from the same observed source IP on its server, block history for that IP, saved AI assessment, multi-person assignees, fix and test progress, work history, recorded resolution/operator, findings, timeline, notes and who was paged.	One incident: linked forensic evidence, recent events from the same observed source IP on its server, block history for that IP, saved AI assessment, multi-person assignees, fix and test progress, work history, recorded resolution/operator, findings, timeline, notes and who was paged.	Not declared	Yes	Not declared	No
`incidents_list`Your org's incidents: what `threatcrush investigate --raise`, the daemon (critical detections) and people raised to humans. Filter by host and explicit since timestamp; only teams you can see. Session token or tc_agent_ key.	Your org's incidents: what `threatcrush investigate --raise`, the daemon (critical detections) and people raised to humans. Filter by host and explicit since timestamp; only teams you can see. Session token or tc_agent_ key.	Not declared	Yes	Not declared	No
`incidents_raise`Raise an incident report (report_version 1: title, severity, source, dedupe_key, summary, verdict, findings, timeline, recommendations, optional team_id/server_id). The same dedupe_key while open updates it; a new incident pages the team by SMS and email once. Reports that contain anything shaped like a private key or mnemonic are refused. Needs write.	Raise an incident report (report_version 1: title, severity, source, dedupe_key, summary, verdict, findings, timeline, recommendations, optional team_id/server_id). The same dedupe_key while open updates it; a new incident pages the team by SMS and email once. Reports that contain anything shaped like a private key or mnemonic are refused. Needs write.	No	No	No	Yes
`incidents_update`Update fix work performed by your assigned agent or human: set multiple assignees, fix status, PR URL, test status and evidence, verification or blocker, and/or add a note. ThreatCrush catalogs the incident and does not execute remediation. Closing requires status fixed with passing tests and verification, or false_positive with a reason and verification, plus resolution.reason/action/verification. Needs write.	Update fix work performed by your assigned agent or human: set multiple assignees, fix status, PR URL, test status and evidence, verification or blocker, and/or add a note. ThreatCrush catalogs the incident and does not execute remediation. Closing requires status fixed with passing tests and verification, or false_positive with a reason and verification, plus resolution.reason/action/verification. Needs write.	No	No	Yes	No
`list_invites`The signed-in account's invites: how many are left of 3, who joined, and whether the bonus credits were paid. Session token only.	The signed-in account's invites: how many are left of 3, who joined, and whether the bonus credits were paid. Session token only.	Not declared	Yes	Not declared	No
`redeem_credit_code`Redeem a ThreatCrush credit code (CR-XXXX-XXXX-XXXX-XXXX) into the signed-in account's credit balance (1 credit = $1.00). Needs the account's session token (`threatcrush login`), not a tc_agent_ key: agent keys belong to a team, not a person.	Redeem a ThreatCrush credit code (CR-XXXX-XXXX-XXXX-XXXX) into the signed-in account's credit balance (1 credit = $1.00). Needs the account's session token (`threatcrush login`), not a tc_agent_ key: agent keys belong to a team, not a person.	No	No	No	No
`reputation_bulk`Look up many IPs or domains at once (up to 100 with a free key, 1,000 with Reputation Pro). Results come back in request order; each counts against the daily allowance.	Look up many IPs or domains at once (up to 100 with a free key, 1,000 with Reputation Pro). Results come back in request order; each counts against the daily allowance.	Not declared	Yes	Not declared	Yes
`reputation_lookup`Look up an IP address or a domain against the ThreatCrush community threat database (what every linked ThreatCrush daemon blocked). Returns `listed` (the corroboration bar: independent reporters agree), a 0-100 `score`, severity, reports, reporters, rules and country; a domain is answered from its A/AAAA addresses plus nichedb.dev's public answer (abuse.ch, SURBL). With Reputation Pro: 90 days of history, the /24 neighbourhood, the network owner (ASN) and how much of it is listed, city and the reasons behind the score. Registered servers, allowlisted addresses and anyone who logged in are never reported.	Look up an IP address or a domain against the ThreatCrush community threat database (what every linked ThreatCrush daemon blocked). Returns `listed` (the corroboration bar: independent reporters agree), a 0-100 `score`, severity, reports, reporters, rules and country; a domain is answered from its A/AAAA addresses plus nichedb.dev's public answer (abuse.ch, SURBL). With Reputation Pro: 90 days of history, the /24 neighbourhood, the network owner (ASN) and how much of it is listed, city and the reasons behind the score. Registered servers, allowlisted addresses and anyone who logged in are never reported.	Not declared	Yes	Not declared	Yes
`webhooks_create`Add a webhook endpoint (public https URL). Returns the endpoint and its signing secret (whsec_…), shown once.	Add a webhook endpoint (public https URL). Returns the endpoint and its signing secret (whsec_…), shown once.	No	No	No	Yes
`webhooks_delete`Remove a webhook endpoint and its delivery log.	Remove a webhook endpoint and its delivery log.	Yes	No	Yes	No
`webhooks_deliveries`Recent webhook deliveries (status, attempts, last HTTP status/error, payload), for one endpoint or all.	Recent webhook deliveries (status, attempts, last HTTP status/error, payload), for one endpoint or all.	Not declared	Yes	Not declared	No
`webhooks_list`Your org's webhook endpoints (signed Standard Webhooks deliveries, retried for about three days) and the events ThreatCrush emits: detection.created, findings.raised, reputation.changed. Endpoints behind a Webhook alert destination follow your alert rules; the others get every event they subscribe to. Org owner/admin session token or an admin tc_agent_ key.	Your org's webhook endpoints (signed Standard Webhooks deliveries, retried for about three days) and the events ThreatCrush emits: detection.created, findings.raised, reputation.changed. Endpoints behind a Webhook alert destination follow your alert rules; the others get every event they subscribe to. Org owner/admin session token or an admin tc_agent_ key.	Not declared	Yes	Not declared	No
`webhooks_rotate_secret`Replace an endpoint's signing secret; the old one stops working at once. Returns the new secret.	Replace an endpoint's signing secret; the old one stops working at once. Returns the new secret.	Yes	No	No	No
`webhooks_test`Send a signed webhook.test event to one endpoint now and say how it went.	Send a signed webhook.test event to one endpoint now and say how it went.	No	No	No	Yes
`webhooks_update`Change a webhook endpoint's url, events, description, or switch it on/off (on again clears its failure count).	Change a webhook endpoint's url, events, description, or switch it on/off (on again clears its failure count).	No	No	Yes	Yes

Details

Registry status: Active
Published: Nov 11, 2026
Updated: Nov 11, 2026
Website: https://threatcrush.com/⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): Developer tools SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing