Scry
by tunnelmind.ai · remote · no sign-in to list tools · v0.5.0 · published by ai.tunnelmind
Free IPv4 lookups against a distributed attacker-observation corpus.
Changes · 9
12 tools: 9 change things and 3 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things9Claude Code: ask: see these tools
- Only reads3Claude Code: allow: see these tools
No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http scry https://mcp.tunnelmind.ai/mcpTools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
12 tools
Changes things 9Claude Code: ask
scry_asnRoll-up of corpus activity for a single ASN — observation count, distinct source IPs, actor count, scanner count, high-confidence actor count, and per-protocol breakdown.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Roll-up of corpus activity for a single ASN — observation count, distinct source IPs, actor count, scanner count, high-confidence actor count, and per-protocol breakdown.
scry_campaignSingle campaign detail by id (format: c[0-9a-f]{15}).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Single campaign detail by id (format: c[0-9a-f]{15}).
scry_campaignsActive threat campaigns — coordinated attacker activity that exceeds the noise floor.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Active threat campaigns — coordinated attacker activity that exceeds the noise floor. ≥5 distinct actors, ≥3 ASNs, ≤5 destination ports, ≥1h history.
scry_check_bulkLook up many IPv4 addresses in one request.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Look up many IPv4 addresses in one request. Up to 100 IPs per call. Same per-IP shape as scry_check, keyed by IP.
scry_countryRoll-up of corpus activity by ISO country code.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Roll-up of corpus activity by ISO country code. Same shape as scry_asn.
scry_recentRecent observations feed — aggregated by source IP within a time window.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Recent observations feed — aggregated by source IP within a time window. Cursor-paginated via since_ms.
scry_timeseriesBucketed observation counts over time.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Bucketed observation counts over time. Detect bursts, plot trends, sanity-check whether attacker activity is rising or falling.
scry_toolSingle tool detail by 16-char hex id from scry_tools.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Single tool detail by 16-char hex id from scry_tools.
scry_topTop-N source dimensions over a time window.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Top-N source dimensions over a time window. Useful for situational awareness — 'where is the noise coming from right now?'
Only reads 3Claude Code: allow
scry_checkReturns Scry's corpus knowledge for a single IPv4 address: when it was first/last observed, observation count, protocols and ports targeted, ASN, country, category (actor/scanner/n…No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it Returns Scry's corpus knowledge for a single IPv4 address: when it was first/last observed, observation count, protocols and ports targeted, ASN, country, category (actor/scanner/not_observed), and confidence_bucket (low/medium/high). Use when an agent needs IP triage, hostility assessment, or risk signaling. Do NOT use for raw payloads (never exposed) or IPv6 (corpus is v4-only at v0.1).
scry_statsReturns aggregate Scry corpus telemetry: total observation count, distinct source IPs, first/last observation timestamps, last-24h activity, and per-protocol breakdowns.No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it Returns aggregate Scry corpus telemetry: total observation count, distinct source IPs, first/last observation timestamps, last-24h activity, and per-protocol breakdowns. Useful as a liveness/density check before issuing per-IP queries — lets an agent decide whether the corpus has enough data to be authoritative. Use this tool when: - An agent is planning a multi-step investigation and wants to know if Scry has corpus density worth querying. - You want a 'corpus health' signal in a dashboard or report. Do NOT use this tool when: - You want details about a specific IP — use `scry_check`. - You want sensor fleet size or node identities — never exposed at any tier. Inputs: none. Returns: total_observations, distinct_source_ips, first_seen_ms, last_seen_ms, observations_last_24h, distinct_source_ips_last_24h, by_protocol, as_of_ms. Cost: free, anonymous, rate-limited. Latency: <100ms typical.
scry_toolsList detected attack tools — (protocol, payload, path) tuples sent by 3+ distinct source IPs.No findings
Why it is in this group
- The description's first verb is "list": a word for reading.
Description, as the server wrote it List detected attack tools — (protocol, payload, path) tuples sent by 3+ distinct source IPs. Aggregate metadata only; never lists member actors.
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 0.5.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http scry https://mcp.tunnelmind.ai/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__scry__scry_stats",
"mcp__scry__scry_check",
"mcp__scry__scry_tools"
],
"ask": [
"mcp__scry__scry_check_bulk",
"mcp__scry__scry_top",
"mcp__scry__scry_timeseries",
"mcp__scry__scry_asn",
"mcp__scry__scry_country",
"mcp__scry__scry_tool",
"mcp__scry__scry_campaigns",
"mcp__scry__scry_campaign",
"mcp__scry__scry_recent"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as scry. Review it before you use it.