# Midkernel Threat Intel
> Free, read-only public-source threat intel over MCP.

```yaml
url: "https://makerhunt.io/project/midkernel-threat-intel"
markdown: "https://makerhunt.io/project/midkernel-threat-intel.md"
name: Midkernel Threat Intel
website: "https://www.midkernel.com/security/docs/mcp"
launch_type: nofollow
link_type: nofollow
status: scheduled
upvotes: 0
pricing: Free
categories: "Developer Tools, Security"
maker: Midkernel
maker_url: "https://makerhunt.io/founder/hello-61"
logo: "https://txmhk1zrnc.ufs.sh/f/xSkWTCqmKWx9GlnrmoIIXdwk6W3jGHNOntibZ4V2pPAF8BlQ"
published_at: "2026-11-09T15:15:33.359Z"
updated_at: "2026-11-09T15:15:33.359Z"
```

## About Midkernel Threat Intel

Midkernel Threat Intel is a remote MCP server for reading threat intelligence collected from public sources, such as security feeds, advisories and official catalogs like CISA KEV. It is free, read-only public-source threat intel over MCP, and it needs no account or API key. Your agent can list the sources and threat classes, pull records that are new or changed since a timestamp, read a daily report for the previous UTC day, compare trends over a window of up to 60 days, and look up one record by ID, CVE or GHSA ID. It does not use credits. Shared rate limits apply. Results carry their source citations, and coverage is incomplete, so treat them as evidence to check, not a risk score.

To connect without signing in, add a remote Streamable HTTP MCP server at https://www.midkernel.com/security/app/mcp/threat-intel and choose no authentication if asked. A typical client configuration is:

{ "mcpServers": { "midkernel-threat-intel": { "url": "https://www.midkernel.com/security/app/mcp/threat-intel" } } }

Setup details are at https://www.midkernel.com/security/docs/mcp, and the product page is https://www.midkernel.com/security/threat-intel. The docs suggest starting with a request such as: give me yesterday's UTC threat report, with citations and coverage caveats.

The no-login connection exposes six read-only tools. ti_sources lists configured public source IDs and metadata from the pinned collector catalog. ti_classes lists supported class IDs and the taxonomy version. ti_daily_report prioritizes findings for the previous complete UTC day, with supporting citations, source-effective dates and coverage caveats. ti_latest reads new or changed public-source threats since a timestamp, with optional class and source filters. ti_trends compares canonical evidence counts across equal UTC date windows, grouped by class, source, or day. ti_get fetches a threat record and its evidence, with known-exploited (KEV) status joined through CVE identifiers. These tools never read user repositories or dependencies.

The daily report returns up to 10 findings by default and at most 30. It covers the previous complete UTC day and selects records by stored source-effective publication dates, not by when Midkernel ingested them. Citations identify publication, catalog-addition, or incident dates. The ordering expresses attention, not global risk, severity, or exploitation probability. Ambiguous identities may be withheld, and unusable citations or unverified source attribution can exclude evidence. Each report is a consistent snapshot of currently retained evidence, not an immutable historical report, so late arrivals and corrections can change later results. An empty result does not establish that there were no threats.

ti_latest defaults to 30 records and can return up to 200 full records per page, or up to 500 shorter summaries. Use the exact source and class IDs returned by the discovery tools; unknown IDs are rejected with valid examples, and a valid source or class can have no records in the requested window. ti_trends accepts inclusive UTC windows of up to 60 days and compares each window with the immediately preceding equal window. Those counts describe canonical public-source evidence, not attacks or affected users. Feed coverage changes can drive spikes. The absence of a KEV listing is not proof that a vulnerability is unexploited.

The public product follows a curated taxonomy of 20 classes across web, EVM and Solana. Daily, weekly and monthly views show deterministic trends and link back to public sources. Those sources include CISA KEV for confirmed exploitation, EPSS for exploitation probability, exploit frameworks and scanner templates, and Web3 incident reports. You can pin a class to focus a Scan, which is a separate hosted review product.

Rate limits on the public connection are published on the MCP docs. Each public IP can make 30 requests and 6 tool calls per minute, with one tool call at a time. IPv6 addresses in the same /64 share a limit. Shared service limits are 120 requests and 20 tool calls per minute, and two simultaneous tool calls. Minute quotas reset on the minute. If the service returns HTTP 429, wait for the Retry-After value before retrying; HTTP 503 means it is temporarily unavailable. Other users on the same network may share your allowance.

Hosted Scan is documented on the same page but is a different path: it requires a Midkernel account, prepaid credits, and a read-only GitHub App on repositories you choose. Threat Intel reads do not spend credits. This listing is for the free, no-login Threat Intel server.

## Overview

### What is it?

Free, read-only public-source threat intel over MCP. No account or API key.

### Who is it for?

Builders and buyers interested in Developer Tools, Security.

### How is it priced?

Free

### Launch status on MakerHunt

Status: **scheduled**. Link type: **nofollow**. Launch plan: **nofollow**.

## Categories & tags

- Categories: Developer Tools, Security

## Frequently asked questions

**Q: What is Midkernel Threat Intel?**

Free, read-only public-source threat intel over MCP. No account or API key.

**Q: Where can I visit the website?**

Official website: https://www.midkernel.com/security/docs/mcp

**Q: Is the MakerHunt backlink dofollow?**

No — the website CTA is nofollow unless the project has earned dofollow (`link_type: dofollow`).

## Screenshots

![Midkernel Threat Intel screenshot 1](https://txmhk1zrnc.ufs.sh/f/xSkWTCqmKWx9ftQTDbAqI7vJSeYA10sNnxLmocdBUQXrWfbw)


## Links

- Listing (HTML): https://makerhunt.io/project/midkernel-threat-intel
- AI-friendly Markdown: https://makerhunt.io/project/midkernel-threat-intel.md
- Website: https://www.midkernel.com/security/docs/mcp
- Maker profile: https://makerhunt.io/founder/hello-61
- Maker Markdown: https://makerhunt.io/founder/hello-61.md

## Explore

- [Browse projects](https://makerhunt.io/projects)
- [Launch stories](https://makerhunt.io/launches)
- [Hall of Fame](https://makerhunt.io/hall-of-fame)
- [Submit a project](https://makerhunt.io/submit)

_HTML version: https://makerhunt.io/project/midkernel-threat-intel_