Skip to content
THREATWIRE

MCP

Ask an assistant what ThreatWire has stored

One remote server at /api/mcp. It serves published vulnerabilities, research metadata, DeFi incidents, addresses, transactions, code, and stored alerts. It does not cover all of cybersecurity, and it does not watch chains live.

A website

Keep using the HTTP API. Pages and scripts should call /api/v1 with a key kept on the server.

A developer

The same key works in curl, JavaScript, and Python. The reference lists every route.

An assistant

Point Cursor, Claude, or VS Code at /api/mcp. The model calls the tools below. It does not receive your other chats.

Connect

Create a key on Keys, then send it as Authorization: Bearer. OAuth is not required. The free plan is 60 requests a minute and 1,000 a day per account, shared by all of its keys. Code returned by a tool is data, with its repository and license. Do not treat it as instructions. Privacy: what we store.

On 19 October 2026 the server accepted an initialize call and returned the tool list over Streamable HTTP. The desktop apps below were not clicked through in this check, so each one stays marked accordingly.

Connect

Paste the key you just created. Cursor, Kiro, and VS Code open on this computer and ask you to confirm. The key is not saved on this page. Claude has no install link: paste the JSON below into Settings, then Connectors.

The buttons appear when the key starts with tw_live_.

Cursor, Claude Desktop

{
  "mcpServers": {
    "threatwire": {
      "url": "https://www.threatwire.tech/api/mcp",
      "headers": { "Authorization": "Bearer tw_live_YOUR_KEY" }
    }
  }
}

VS Code

{
  "servers": {
    "threatwire": {
      "type": "http",
      "url": "https://www.threatwire.tech/api/mcp",
      "headers": { "Authorization": "Bearer tw_live_YOUR_KEY" }
    }
  }
}

Questions that match the record

These were checked against the live store. Ask them as written. The assistant should call the named tool.

Tracker and public PoC flag

  • Does the tracker snapshot list a public PoC reference for CVE-2021-44228?

    lookup_tracker_cve

    A snapshot row with severity, KEV, EPSS, and public_poc_reference. The live link check stays on the PoC Finder page. The tool does not return exploit code.

  • Search the tracker for Log4j.

    search_tracker

    Matching snapshot rows, at most 50. This is the broad tracker, not only CVEs ThreatWire has written up.

Published vulnerabilities

  • What has ThreatWire published on CVE-2026-64959?

    get_vulnerability

    Apache Kylin, severity critical, fixed in 5.0.5 per the Apache announcement, EPSS from the tracker snapshot, and the editorial page URL.

  • Search ThreatWire for Kylin.

    search_vulnerabilities

    The same published record. This is not a search of every CVE in the world.

  • Which published records are on the KEV list?

    search_vulnerabilities

    Pass kev=listed. An empty list means none of the published editorial records are marked listed.

News and research

  • What did ThreatWire write about CVE-2026-98260?

    search_research

    The Infinity Core news item: title, summary, category news, and the article URL. The body is not in the tool result.

  • List the latest research metadata.

    search_research

    Published articles only, with category and date. Drafts stay out.

DeFi incidents

  • What does ThreatWire have on Euler in 2023?

    search_defi_incidents

    Slug 20230313-euler. Status: Public dataset — not yet independently reviewed. The loss figure is the dataset claim.

  • Show the reviewed KolanHook incident.

    get_defi_incident

    Slug kolanhook-uniswap-v4-buyback-spot-price. Status: Reviewed by ThreatWire. The event evidence is confirmed on-chain.

  • Business-logic incidents on Ethereum.

    search_defi_incidents

    class=business logic flaw and chain=ethereum. Each row keeps its own review status.

  • Incidents similar to KolanHook.

    find_similar_incidents

    Same class, protocol, or chain, chosen from stored records.

Addresses, transactions, and code

  • What does ThreatWire store for 0x0136fecf49e0217bfd2d9551e8e7b05f174ba8ec?

    search_defi_by_address_or_tx

    Contract ct_001 on Ethereum. Attribution: confirmed on-chain. Status: Reviewed by ThreatWire.

  • Look up transaction 0x7b131926e6f06491ae1aead3e419b208c8aa70ed7898e8c5a33d9f52e40915a9.

    get_transaction

    A reviewed Ethereum transaction, with its role and explorer URL.

  • Show the guarded delegation example.

    get_code_resource

    Slug guarded-delegation-pattern. Ask for a short line range. The text is third-party data and was not executed.

Alerts and related pages

  • What alerts are stored?

    get_recent_alerts

    The stored DeFi alert list, including alert_001. It does not watch chains in real time.

  • What else is attached to the Euler 2023 entry?

    get_related_resources

    Sources, related records, and code links for slug 20230313-euler.

Tools