mcpbeat

Scry MCP Server

ai.tunnelmind/scry
answering

Scry is answering right now. Last checked 3 min ago. It exposes 12 tools. Last commit 25 May 2026.

Free IPv4 lookups against a distributed attacker-observation corpus.

The author archived this repository on GitHub, meaning it is no longer maintained.

Uptime history 41 hours of history
41 hours agonow
100.0%
Uptime 24h
91 of 91 checks
12
Tools
read from the server
188 ms
Response time
average over 24h
0
Stars
last commit 25 May 2026

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 3 min ago.

run in your terminal
claude mcp add scry --transport http https://mcp.tunnelmind.ai/mcp
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "scry": {
      "url": "https://mcp.tunnelmind.ai/mcp"
    }
  }
}
~/.codex/config.toml
[mcp_servers.scry]
url = "https://mcp.tunnelmind.ai/mcp"
.cursor/mcp.json
{
  "mcpServers": {
    "scry": {
      "url": "https://mcp.tunnelmind.ai/mcp"
    }
  }
}
.vscode/mcp.json
{
  "mcpServers": {
    "scry": {
      "url": "https://mcp.tunnelmind.ai/mcp"
    }
  }
}

Available tools 12

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

scry
scry_asn
Roll-up of corpus activity for a single ASN — observation count, distinct source IPs, actor count, scanner count, high-confidence actor count, and per-protocol breakdown.
scry_campaign
Single campaign detail by id (format: c[0-9a-f]{15}).
scry_campaigns
Active threat campaigns — coordinated attacker activity that exceeds the noise floor. ≥5 distinct actors, ≥3 ASNs, ≤5 destination ports, ≥1h history.
scry_check
Returns Scry's corpus knowledge for a single IPv4 address: when it was first/last observed, observation count, protocols and ports targeted, ASN, country, category (actor/scanner/not_observed), and confidence_bucket (low/medium/high). Use when an agent needs IP triage, hostility assessment, or risk signaling. Do NOT use for raw payloads (never exposed) or IPv6 (corpus is v4-only at v0.1).
scry_check_bulk
Look up many IPv4 addresses in one request. Up to 100 IPs per call. Same per-IP shape as scry_check, keyed by IP.
scry_country
Roll-up of corpus activity by ISO country code. Same shape as scry_asn.
scry_recent
Recent observations feed — aggregated by source IP within a time window. Cursor-paginated via since_ms.
scry_stats
Returns aggregate Scry corpus telemetry: total observation count, distinct source IPs, first/last observation timestamps, last-24h activity, and per-protocol breakdowns. Useful as a liveness/density check before issuing per-IP queries — lets an agent decide whether the corpus has enough data to be authoritative. Use this tool when: - An agent is planning a multi-step investigation and wants to know if Scry has corpus density worth querying. - You want a 'corpus health' signal in a dashboard or report. Do NOT use this tool when: - You want details about a specific IP — use `scry_check`. - You want sensor fleet size or node identities — never exposed at any tier. Inputs: none. Returns: total_observations, distinct_source_ips, first_seen_ms, last_seen_ms, observations_last_24h, distinct_source_ips_last_24h, by_protocol, as_of_ms. Cost: free, anonymous, rate-limited. Latency: <100ms typical.
scry_timeseries
Bucketed observation counts over time. Detect bursts, plot trends, sanity-check whether attacker activity is rising or falling.
scry_tool
Single tool detail by 16-char hex id from scry_tools.
scry_tools
List detected attack tools — (protocol, payload, path) tuples sent by 3+ distinct source IPs. Aggregate metadata only; never lists member actors.
scry_top
Top-N source dimensions over a time window. Useful for situational awareness — 'where is the noise coming from right now?'

Endpoints

URLTransportStateLatencyChecked
https://mcp.tunnelmind.ai/mcp streamable-http answering 176 ms 3 min ago

Scry — questions

Answers built from our own checks of this server.

What can Scry do?
It exposes 12 tools, read directly from the server on our last check. Among them: scry_asn, scry_campaign, scry_campaigns, scry_check, scry_check_bulk, scry_country and 6 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →
Is Scry working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 188 ms. The bar chart above shows every period we have measured.
Is Scry still maintained?
The author archived this repository on GitHub, meaning it is no longer maintained. We show this because it changes what you can expect: an unmaintained server may keep answering for months and then stop without warning.
How do I connect Scry?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does Scry need an API key?
No. Scry completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 12 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is Scry?
It answers our handshake in 188 ms on average, which is faster than 65% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.
Is Scry open source?
Yes — written in JavaScript and 0 stars on GitHub. The source link is on this page, so you can read exactly what it does with your data before you connect it.