skills: {'id': 'scry_stats', 'name': 'scry_stats', 'description': "Returns aggregate Scry corpus telemetry: total observation count, distinct\nsource IPs, first/last observation timestamps, last-24h activity, and\nper-protocol breakdowns. Useful as a liveness/density check before issuing\nper-IP queries — lets an agent decide whether the corpus has enough data\nto be authoritative.\n\nUse this tool when:\n- An agent is planning a multi-step investigation and wants to know if Scry\n has corpus density worth querying.\n- You want a 'corpus health' signal in a dashboard or report.\n\nDo NOT use this tool when:\n- You want details about a specific IP — use `scry_check`.\n- You want sensor fleet size or node identities — never exposed at any tier.\n\nInputs: none.\nReturns: total_observations, distinct_source_ips, first_seen_ms, last_seen_ms, observations_last_24h, distinct_source_ips_last_24h, by_protocol, as_of_ms.\nCost: free, anonymous, rate-limited.\nLatency: <100ms typical.", 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'scry_check', 'name': 'scry_check', 'description': "Returns Scry's corpus knowledge for a single IPv4 address: when it was first/last\nobserved, observation count, protocols and ports targeted, ASN, country, category\n(actor/scanner/not_observed), and confidence_bucket (low/medium/high).\n\nUse when an agent needs IP triage, hostility assessment, or risk signaling.\nDo NOT use for raw payloads (never exposed) or IPv6 (corpus is v4-only at v0.1).", 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'scry_check_bulk', 'name': 'scry_check_bulk', 'description': 'Look up many IPv4 addresses in one request. Up to 100 IPs per call. Same per-IP shape as scry_check, keyed by IP.', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'scry_top', 'name': 'scry_top', 'description': "Top-N source dimensions over a time window. Useful for situational awareness — 'where is the noise coming from right now?'", 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'scry_timeseries', 'name': 'scry_timeseries', 'description': 'Bucketed observation counts over time. Detect bursts, plot trends, sanity-check whether attacker activity is rising or falling.', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'scry_asn', 'name': 'scry_asn', 'description': 'Roll-up of corpus activity for a single ASN — observation count, distinct source IPs, actor count, scanner count, high-confidence actor count, and per-protocol breakdown.', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'scry_country', 'name': 'scry_country', 'description': 'Roll-up of corpus activity by ISO country code. Same shape as scry_asn.', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}, {'id': 'scry_tools', 'name': 'scry_tools', 'description': 'List detected attack tools — (protocol, payload, path) tuples sent by 3+ distinct source IPs. Aggregate metadata only; never lists member actors.', 'tags': [], 'examples': None, 'input_modes': None, 'output_modes': None}; uptime_30d 1.0%; p95 395.5ms; conformance: pass
How to connect
https://mcp.tunnelmind.ai/mcpcurl -X POST https://mcp.tunnelmind.ai/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}'