Tonight I read a post describing something interesting: someone uses CrowdStrike Falcon via MCP to query their threat intelligence database in natural language — APT12, Calypso, Pegasus, DarkHotel — and get categorized C2 IOC lists by actor.

Falcon costs a fortune. But the concept is simple. And I already had the infrastructure to do the same thing.

This post covers how I built the equivalent in a few hours, using free sources, and what I found.

What Is MCP?

MCP (Model Context Protocol) is a standard developed by Anthropic that allows an LLM to connect to external tools in real time. When I talk to Claude Code, it can call tools — launch an nmap scan, query my Metasploit database, search for CVEs — because my infrastructure exposes those capabilities through an MCP server.

That’s exactly what CrowdStrike did: they plugged their Falcon platform into this protocol. The operator asks “show me active APT12 C2s from this week” and the LLM queries Falcon automatically.

The difference from a regular chatbot: the data is fresh and contextualized to your own infrastructure.

My Starting Infrastructure

I have a Docker Swarm homelab with:

  • A custom MCP server (mcp-server) exposing around thirty tools
  • A Metasploit PostgreSQL database with 6.15 million scanned hosts and their services
  • An automated scanning pipeline (masscan → classification → exploit → nuclei)

The MCP server already had lookup_ip for querying OTX on a single IP. What was missing: the feed dimension — querying threat feeds to find known actors, known C2s, and most importantly cross-referencing that against my own database.

Free Sources

Two abuse.ch sources, free and well-maintained:

ThreatFox — C2 IOC database with confidence scores, malware families, and campaign tags. Requires a free account for the API. Thousands of recent IOCs: Cobalt Strike, Sliver, Metasploit stagers, botnets.

Feodo Tracker — botnet C2 list (Emotet, QakBot, IcedID). Completely public, no authentication. Fewer entries but zero friction.

What We Built

Three functions in a new bojemoi/cti.py module:

threatfox_recent(days=7, ioc_type=None, malware=None)
# → Recent IOCs, filterable by type and malware family

threatfox_search(ioc)
# → Is this IP/domain/hash a known C2?

ioc_crossref(days=7, malware=None, min_confidence=50)
# → THE KILLER FEATURE

The killer feature is ioc_crossref. The logic:

  1. Fetch recent ip:port IOCs from ThreatFox
  2. Extract unique IPs
  3. A single SQL query against the 6.15M hosts:
SELECT host(address::inet), os_name, scan_status, last_scanned
FROM hosts
WHERE host(address::inet) = ANY($1)
  1. Return matches with context from both sides (what ThreatFox knows + what my scanner saw)

If a host I’ve already scanned matches a known C2 — I know immediately.

These three functions are also exposed as MCP tools, so Claude can call them directly in conversation:

ittohhcrr_eecaarttoffsoosxxr__ersfeecaerncth→→→crblorosooswk-sreuepfreearceesnnpcteecCiT2fhirIceOaCItsPF/obdxyomIfaOaiCmnsi/lhvyas/sthMySpFeDB

The Result

First run with ioc_crossref(days=2):

SUMonSuiF4rq5cuH.eeI8T.IS1O5C9s.20:::5t21h6r7eaCtofboaxltStrikescan_status:None

One hit. 45.8.159.205, Cobalt Strike C2, port 8596, reported the day before with 75% confidence and tag drb-ra.

The IP had been in my database since May 2026 — my masscan sweep had touched it — but with no in-depth scan (status null).

Manual Confirmation

Nmap scan:

2825/9t6c/ptcpooppeennsusnhknownOpenSSH7.6p1Ubuntu4ubuntu0.7

HTTP probe on port 8596:

GOEPTTI/ONS→/CC[HoonTnno→TttPeeS/nneHCA1ttrTol.--vTnl1TLePtoyer/ew4pn1n:0egh.t4:te1-OhaTPNt:d2yToee0pItx0r0eOt]:NFOSpKt,uleGnaxEditTn/,hHtEmAlD,POST

This is the classic signature of a Cobalt Strike Malleable C2 HTTP profile:

  • Silent 404 on GET (non-beacon requests silently rejected)
  • 200 on OPTIONS (beacon heartbeat)
  • No Server header (obfuscation)
  • Port 50050 closed (teamserver UI not exposed — careful operator)

Ubuntu 18.04 EOL. ASN AS49392 LLC Baxet, Moscow. Tag drb-ra is a campaign marker identified in the CTI community.

Finding documented in DefectDojo.

What This Changes

The cross-reference is the part that interests me most. I’m not trying to check whether an IP exists in ThreatFox — I can do that with lookup_ip. I want to know if among the millions of hosts I’ve already scanned, some of them are known C2 infrastructure.

That’s a different question, and the answer changes what you do next. A host already in your database with known services is immediately explorable — you already know its open ports, OS, and context.

The natural next step: automate this daily and alert via Telegram when a new match appears. That’s now running as a daily cron on the lab:

0 7 * * * docker exec <mcp-server> python cti_daily.py

The script calls ioc_crossref(days=1), and sends a Telegram message — either “0 hits, all clear” or a detailed alert with IP, malware family, and confidence score.

Reproduce This

Everything you need:

  • A Python MCP server (code is on my Gitea)
  • A free ThreatFox key (register at threatfox.abuse.ch)
  • A database of scanned hosts (or Shodan/Censys if you don’t have your own scanner)

The cross-reference logic works with any SQL database. If you have a list of IPs you know about, you can cross-reference it against ThreatFox in a few lines.

Infrastructure: Docker Swarm, Python, PostgreSQL, ThreatFox API, abuse.ch Feodo Tracker