Skip to content
Midkernel logo

Midkernel MCP server

Which MCP servers are Midkernel's own, from the official registry and from asking its own domain, whether they answer, and what they offer. A program checked each of these, nobody copied them from a product page.

read 2026-11-01

← Back to Midkernel

Whose server it is
  • Registry namecom.midkernel/threat-intelverified in the MCP registry

The registry name sits under midkernel.com. The registry only lets a publisher use that namespace after proving control of the domain through DNS or HTTP.

When we asked itchecked 2026-11-01
  • Stateanswerschecked 2026-11-01
  • Tools6
  • Server calls itselfmidkernel-threat-intel
  • Server version0.5.0
  • Protocol version2025-06-18

On 2026-11-01 the server answered initialize and tools/list without a sign-in. First answer in 840 ms.

Should an agent connect itNot proven either way yet
  • Whether its tools do the product's job has not been judged yet.
  • Checked on 1 of the 7 days it takes to judge reliability.

Said by rules from the measurements above. The likely first call is a model's pick from the tool list; read its description before relying on it.

Measured dailydaily checks: 1, the first on 2026-11-01
  • INITE MCP scoreafter a weeka score needs 7 daily checks: 1 so far
  • Answeredmeasuring1 of the 7 daily checks it takes to print a share
  • Median first answer817 ms
  • Space in an agent's context≈ 2,301 tokensthe definitions of all its tools (6), which an agent carries on every turn
  • Tool definitionsA · 97 of 100
  • Typed results0 of 6 toolsdeclared outputSchema: results come typed, read once
  • Parameters without a description: in 1 of 6

Worth a look

None of the five warning signs in these definitions.

A program checks the server once a day: initialize and tools/list, no model. Tokens are the definitions' length at about four characters a token. The grade averages six checks of every tool's name, description, schema and annotations; it says how well the tools are described, not whether they work. The score weighs what was measured and nothing else: answering (25%), doing the product's job (25%), definitions (20%), context (10%), use (10%) and how readily a client connects (10%). A part that was not measured is left out, and a hidden instruction caps the score at 40. The state of vendors' MCP servers: method and numbers →

Tools it offers6 tools · read 2026-11-01
  • ti_daily_report

    Read a bounded daily report of public-source Threat Intel for the previous complete UTC day, selected by source-effective publishedAt, not ingestion time. Free; no user data, repositories, or credits. The day starts at 00:00 UTC inclusive…

  • ti_sources

    List every configured public Threat Intel source ID, name, format, surface and source URL from the pinned collector registry. Free; no user data, repositories, or credits. No arguments. Use the exact ID in ti_latest.source; guessed…

  • ti_classes

    List every supported Threat Intel class ID and the taxonomy version. Free; no user data, repositories, or credits. No arguments. Use the exact ID in ti_latest.class; unknown IDs are rejected. The complete bounded catalog is returned in…

  • ti_latest

    Read new or changed threats from Midkernel's public-source Threat Intel. Free; no repositories, user data, or credits. Pass since as an ISO timestamp (inclusive); until is an exclusive upper bound, defaults to now, and must be at most 60…

  • ti_trends

    Free analytics over Midkernel's own public-source Threat Intel. window.from/to are inclusive UTC source-effective dates, at most 60 days. Compare canonical threat counts with the immediately preceding equal-length window, grouped by…

  • ti_get

    Read one Midkernel Threat Intel record, retained evidence and revisions, plus known-exploited (KEV) evidence joined via CVE. Use a record id from ti_latest, a CVE, or a GHSA id. Free; no user data or credits. KEV absence in the ingested…

How to connect

Add the server to your MCP client config. Claude Desktop, Cursor and most other clients read this shape:

{
  "mcpServers": {
    "threat-intel": {
      "type": "http",
      "url": "https://www.midkernel.com/security/app/mcp/threat-intel"
    }
  }
}

Add it

Claude Code, in a terminal

claude mcp add --transport http midkernel https://www.midkernel.com/security/app/mcp/threat-intel

Add to CursorAdd to VS Code

claude.ai, ChatGPT and other clients: add https://www.midkernel.com/security/app/mcp/threat-intel as a custom connector in the settings.

Each line is something a program found when it went looking: the registry entry, the server's own answer, a spec that parses. A missing line means we did not find it, not that it does not exist.