mcp-registry/io.github.maco144/nullcone · v1.30.0
Also listed as glama/maco144/nullcone-mcp-server
As of 2026-10-18 15:02 UTC, the Maco144 Nullcone MCP server is up with a Glimind reliability score of 76/100 (grade B). Over the last 30 days it answered 99.2% of Glimind's liveness checks. It had 7 outages in 90 days, with a median recovery of 74 minutes.
Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats
Claude Code
claude mcp add --transport http maco144-nullcone-mcp-server https://nullcone.ai/mcp
Claude Desktop · Windsurf · Cline (mcpServers JSON)
{
"mcpServers": {
"maco144-nullcone-mcp-server": {
"type": "http",
"url": "https://nullcone.ai/mcp"
}
}
}
Third-party server, listed as discovered. Review its source before installing.
30 of 30 tool(s) carry no readOnlyHint/destructiveHint annotations.
Annotate read-only tools with {"readOnlyHint": true}. Agents and gateways can then run them without a confirmation prompt, and route around destructive ones. How to fix →
52 parameter(s) across 22 tool(s) have no description.
Add a "description" to each parameter with its format and an example ("ISO 8601 date, e.g. 2026-10-17"). This is the commonest cause of wrong arguments on the first call. How to fix →
4 tool(s) look like they change state (create/send/delete/pay…) but declare no destructiveHint.
Set annotations {"readOnlyHint": false, "destructiveHint": true|false, "idempotentHint": …}. Clients use these to ask the user before a side effect and to auto-approve safe reads. How to fix →
Handshake + tools/list takes ~1,650 ms.
Serve tools/list from memory, keep the process warm, and host close to your users. Every new agent session pays this before its first call.
Paste-ready definitions with the problems above fixed. Changes marked verify need a human look. 22 tool(s) still need parameter descriptions written by someone who knows the API. All of them as JSON: /v1/readiness/mcp-registry%2Fio.github.maco144%2Fnullcone/fixes
{
"name": "check_freshness",
"description": "\n Validate that IOC threat intelligence is fresh enough for the named action.\n\n Call this before any high-risk agent action to ensure the TI snapshot\n is not stale. The check itself completes in <1ms (no network I/O).\n\n Action → staleness tier mapping:\n critical (≤30s): credential_access, keychain_access, execute_shell, sudo\n high (≤120s): load_skill, install_package, network_call, http_request\n medium (≤300s): file_write, file_delete, registry_write, env_write\n",
"inputSchema": {
"type": "object",
"title": "check_freshnessArguments",
"properties": {
"action": {
"type": "string",
"title": "Action",
"default": "load_skill"
},
"block_on_stale": {
"type": "boolean",
"title": "Block On Stale",
"default": false
}
}
},
"annotations": {
"readOnlyHint": true
}
}{
"name": "check_prompt",
"description": "\n Check a prompt or text fragment for known PROMPT IOC patterns.\n\n Uses an in-memory hash set for sub-1ms token-level querying — no\n network calls after the cache is warmed. Slides a window of 3, 5, 8,\n and 10 tokens across the input and checks each window's canonical\n SHA256 against the PROMPT IOC feed.\n\n This is the primary real-time prompt injection detection endpoint.\n Call it on every user-supplied prompt before passing to the LLM.\n\n Args:\n text: The prom",
"inputSchema": {
"type": "object",
"title": "check_promptArguments",
"required": [
"text"
],
"properties": {
"text": {
"type": "string",
"title": "Text"
},
"auto_warm": {
"type": "boolean",
"title": "Auto Warm",
"default": true
}
}
},
"annotations": {
"readOnlyHint": true
}
}{
"name": "check_prompt_batch",
"description": "\n Check multiple prompts for PROMPT IOC patterns in a single call.\n\n More efficient than calling check_prompt() in a loop — tokenization\n overhead is amortized and the cache reference is shared.\n\n Args:\n texts: List of prompt strings to check\n\n Returns:\n One result dict per input text, in the same order.\n ",
"inputSchema": {
"type": "object",
"title": "check_prompt_batchArguments",
"required": [
"texts"
],
"properties": {
"texts": {
"type": "array",
"items": {
"type": "string"
},
"title": "Texts"
}
}
},
"annotations": {
"readOnlyHint": true
}
}Get an email or webhook when this server's readiness drops by 10+ points, tool-poisoning text appears, or a tool breaks:
curl -X POST https://glimind.com/v1/subscriptions -H 'content-type: application/json' -d '{"tools":["mcp-registry/io.github.maco144/nullcone"],"email":"[email protected]"}'Agents: watch_tool({"toolId": "mcp-registry/io.github.maco144/nullcone"}) over MCP.
submit_ioc ~317 tokenssubscribe_threats ~267 tokensfingerprint_tool_metadata ~245 tokensreport_detection ~237 tokensvalidate_skill ~235 tokensStatic checks of the advertised tools/list (schema, descriptions, annotations, tool-poisoning patterns, names, size) plus observed protocol, uptime, latency and contract changes. Read-only: no tool is ever called. Weights: schema 15, docs 20, safety 15, efficiency 15, compatibility 15, protocol 5, reliability 10, stability 5. Token counts are estimates (~3.6 characters per token).
Operator? Fix these, then re-check live. Embed the readiness badge:
[](https://glimind.com/server/mcp-registry%2Fio.github.maco144%2Fnullcone?ref=badge)
<a href="https://glimind.com/server/mcp-registry%2Fio.github.maco144%2Fnullcone?ref=badge"><img src="https://glimind.com/v1/readiness/badge/mcp-registry%2Fio.github.maco144%2Fnullcone.svg" alt="MCP agent-readiness"></a>
.. image:: https://glimind.com/v1/readiness/badge/mcp-registry%2Fio.github.maco144%2Fnullcone.svg :target: https://glimind.com/server/mcp-registry%2Fio.github.maco144%2Fnullcone?ref=badge :alt: MCP agent-readiness
Glimind records every version of this server's tool definitions in a signed, append-only transparency log. Current manifest sha256:4358a220fe352199…, first seen 2026-10-17, included at leaf 61 of 22,407. Version history · verify what your client received.
Compare: most reliable security servers · most reliable data servers
Glimind tells agents whether a server is up right now and how to call it, then fails over to a live alternative when it isn't.
Claude Code
claude mcp add --transport http glimind https://glimind.com/mcp
Claude Desktop · Windsurf · Cline (mcpServers JSON)
{
"mcpServers": {
"glimind": {
"type": "http",
"url": "https://glimind.com/mcp"
}
}
}
As of 2026-10-18 15:02 UTC, the Maco144 Nullcone MCP server is up with a Glimind reliability score of 76/100 (grade B). Over the last 30 days it answered 99.2% of Glimind's liveness checks. It had 7 outages in 90 days, with a median recovery of 74 minutes.
Maco144 Nullcone MCP server advertises 30 tools, including check_freshness, check_prompt, check_prompt_batch, drain_subscription, family_threats.
Point your MCP client at this streamable-http endpoint: https://nullcone.ai/mcp
Glimind scanned all 30 tool definitions for tool-poisoning patterns — hidden or invisible characters, instructions that override the model, concealment from the user, requests to read credential or MCP config files, conversation exfiltration and cross-tool shadowing — and found none. This checks what the server tells the model, not what its code does; review the source before granting access to sensitive data.
Status page: 90-day uptime, every outage and how long it lasted.
Claim this listing to get the Verified operator marker, a remediation checklist and owner analytics, or embed the live badge from any of the tool pages above. Maintainers: alerts, deploy attestation and monthly reports.
Status is an automated estimate from Glimind's liveness checks (handshake and tool listing only; no tool is ever called) and may lag or differ from your network. Glimind is not affiliated with this server or its operator. Operator? Request a correction or opt out at https://glimind.com/opt-out.