DugganUSA Threat Intelligence Is Now in the Claude Connectors Directory. Here Is What It Gives Claude, and What It Will Never Do.
You can now add DugganUSA threat intelligence to Claude from the Claude connectors directory: DugganUSA Threat Intelligence. Anthropic's review approved it as a community connector. It takes one click, it needs no account, and it cannot change anything on your side.
What Claude can do with it
Seven read-only tools, the same ones our Jeevesus MCP server serves to Cursor, VS Code and Microsoft Foundry:
Search the corpus of indicators, CISA KEV entries, threat-actor profiles and our research, in plain language.
Enrich an indicator. Paste an IP, domain, URL or hash from a log and Claude gets everything we hold on it, with every source named.
Check a package before it is installed. Name an npm or PyPI package and version, and Claude gets a block, review or allow verdict from our malicious-package list, registry reputation and known vulnerabilities. This is the check we built for coding agents: ask before npm install, not after.
Patch-priority answers. Where confirmed exploitation concentrates for a vendor or product, and how long exploitation of a KEV entry tends to keep going.
Feed summary and model prices. What is in the feed right now, and the current published price per million tokens for an AI model, with its source.
Try:
"Is 185.39.19.176 known? What do you hold on it?"
"Before I install @x402/fetch 2.22.0, check it."
"Which Citrix bugs are actually being exploited, and which should I patch first?"
What it will never do
Every tool is marked read-only, and Claude's tool annotations say so. Nothing it calls writes, deletes, posts or runs anything. Results are data, not instructions: a result that contains text aimed at Claude is still just text. No key is needed. A free key raises the limits, and it is sent as a header, never in a URL.
Why this matters to us
Our wedge is the people building AI agents. An agent that can install packages, connect to MCP servers and read the web needs a check between what it is about to do and what it does. We call that the membrane, and the cheapest way to put it in front of someone is to be where they already work. Today that includes Claude.
Community approval means Anthropic's review checked the listing, not that Anthropic vouches for the data. Judge the data the way we ask you to judge everything we publish: every answer names its sources, confidence is capped at 95, and our corrections are public at analytics.dugganusa.com/updates.
Developer docs for every integration, including the same server outside Claude: docs.dugganusa.com.
If this was useful, or if it wasn't, the rating widget below takes ten seconds and is the only way we know.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=dugganusa-threat-intelligence-is-now-in-the-claude-connectors-directory-here-is-what-it-gives-claud
Comments