github.comrepoparalax/SeldomMonster
SeldomMonster is a collection of Model Context Protocol servers built for Gemini CLI (but MCP-generic) that wrap free/community cyber threat intel APIs — GreyNoise, Malpedia, OpenCTI, AlienVault OTX, ransomware.live, IBM X-Force, YaraHub, blockchain transaction lookups, and r/netsec/r/blueteamsec feeds — plus a separate set of macOS tools (Nmap as the only third-party dependency) for discovering and hacking devices on the local network. It's a practical toolkit for wiring an LLM agent directly into IOC enrichment, ransomware tracking, and local network recon/exploitation workflows.
TL;DR MCP servers exposing GreyNoise, OTX, OpenCTI, Malpedia, X-Force, YaraHub and ransomware.live for LLM-driven CTI, plus macOS/Nmap-based local network hacking tools.
Organisations named here
- IBM X-Force
- r/blueteamsec
- r/netsec
- YaraHub
Technologies named here
- blockchain_mcp
- greynoise_mcp
- malpedia_mcp
- opencti_mcp
- otx_simple_mcp
- ransomware-live-mcp
- reddit_netsec_mcp
- xforce_mcp
- yarahub-mcp
- Nmap
- Gemini CLI
- Model Context Protocol
- GreyNoise
- OpenCTI
- macOS
- Malpedia
- OTX
- Ransomware.live
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup