DugganUSA CLI — Local STDIO MCP server

dugganusa-cli

1.5M+ IOCs. ~38M+ documents. Two binaries. One install. The MCP we'd audit.

What's New (v1.5.1)

• Supply-chain scanning leveled up. The corpus now ingests OSV malicious-package feeds for both npm and PyPI — named-malicious packages, zero-heuristic, daily — alongside daily GitHub Hunt detections of malware-staging repos and install-time execution signatures. Pipe a lockfile or --file package.json and known-bad packages surface next to network IOCs. This is the CI angle: catch a poisoned dependency before it ships.
• Four live, no-auth, deploy-durable validation endpoints now prove feed quality:
• Novelty — feed-uniqueness: ~75%+ of what we publish ThreatFox doesn't have (measured live).
• Timeliness — kev-lead: a live ledger of how far ahead of CISA KEV we flagged each exploited CVE — positive leads, same-day, and no-receipt all shown honestly, with receipts.
• Accuracy — spamhaus-validation: Spamhaus independently corroborates our first-hand contributions.
• Liveness — feed-efficacy: opt-in consumer reports of when our indicators actually fire on real traffic — proof the feed is operationally live, not just large.

# Scanner — block bad IOCs in your stack
npx dugganusa-cli 185.39.19.176

# MCP server — wire DugganUSA into Claude Desktop / Cursor / Claude Code
npx -y -p dugganusa-cli dugganusa-mcp

A two-person Minnesota LLC. A Bloom filter for novelty checks. Meilisearch cross-index correlation. A github-hunt cron that runs at 08:15 UTC every day.

That's the stack that named TeamPCP 45 days before CISA added LiteLLM CVE-2026-42208 to KEV. That named Handala 28 days before they exfiltrated 6 petabytes from Dubai. That named NGINX-UI as actively exploited 20 days before the same agency caught up.

This is the CLI that puts the same corpus in your terminal.

Bin rename (since v1.3.0): the scanner bin was dugganusa-lookup in v1.2.0. It is now dugganusa-cli. The old dugganusa-lookup package is dead — use dugganusa-cli. The MCP bin (dugganusa-mcp) is unchanged. Update any pinned scripts.

Install

# Run without installing
npx dugganusa-cli 185.39.19.176
npx -y -p dugganusa-cli dugganusa-mcp --help

# Or install globally — both bins on PATH
npm install -g dugganusa-cli

Scanner usage

# Single lookup
dugganusa-cli 185.39.19.176
dugganusa-cli welcome.supp0v3.com
dugganusa-cli CVE-2026-21643

# Multiple indicators
dugganusa-cli 185.39.19.176 welcome.supp0v3.com CVE-2026-21643

# Scan a file for IOCs
dugganusa-cli --file config.js
dugganusa-cli --file terraform/main.tf

# Pipe stdin (works with any tool)
cat firewall.log | dugganusa-cli --stdin
grep -r "http" src/ | dugganusa-cli --stdin

# Batch lookup (one IOC per line)
dugganusa-cli --batch iocs.txt

# AIPM audit (AI presence + brand exposure)
dugganusa-cli --aipm crowdstrike.com

# Output formats
dugganusa-cli --format json 185.39.19.176
dugganusa-cli --format markdown --file report.md
dugganusa-cli --format table 185.39.19.176  # default

# Only show matches (suppress clean results)
dugganusa-cli --file app.js --quiet

# With API key (higher rate limits)
dugganusa-cli --key dugusa_YOUR_KEY 185.39.19.176
# Or set env var
export DUGGANUSA_API_KEY=dugusa_YOUR_KEY

Output

!!    12  185.39.19.176                                 IOC: Cobalt Strike C2 (via SSLBL) | Blocked 47x | 3 OTX pulse(s)
  OK     0  8.8.8.8                                       clean

  1 threat indicator(s) found in 2 checked.
  Full enrichment: https://analytics.dugganusa.com/api/v1/search/correlate?q=<indicator>
  Free API key: https://analytics.dugganusa.com/stix/register

Exit codes

Shortened. The full README is on GitHub.