subscribe_threats

io.github.maco144/nullcone · Verify this server

Open a named, stateful subscription to live threat push delivery. Returns a subscription_id. Pass it to drain_subscription() to collect the IOCs that have arrived since your last drain — zero polling, each caller gets their own isolated stream. Multiple subscribers receive independent copies of every matching IOC. Subscriptions expire after 1 hour of inactivity (no drain calls). Composition filters let you narrow the stream: - ioc_types: only deliver these IOC types (empty = all) - families: only deliver IOCs from these malware families (empty = all) - tags: only deliver IOCs with at least one of these tags (empty = all) Requires the MCP server to be running in SSE mode (MCP_TRANSPORT=sse) with a live SpacetimeDB push subscription active. Args: min_severity: Minimum severity to deliver (0-10). Default 5 (medium+). ioc_types: List of IOC types to include. E.g. ["skill","prompt","ip"]. Valid: hash_md5, hash_sha1, hash_sha256, ip, ip_port, domain, url, yara, email, mutex, filepath, asn, ja3, imphash, cve, prompt, skill. Empty = all types. families: List of malware family names to include. Empty = all. tags: List of tags — IOC must match at least one. Empty = all. Returns: subscription_id: Opaque ID — pass to drain_subscription() / unsubscribe() push_active: Whether the background push subscription is running filters: Echo of the composition filters applied