ReadBeforeRunAgentic Security Field Guide

Catalog / Plugin

Threat Intel Toolkit

Draft · awaiting review

Claude Code plugin with a subagent and two skills that triage IOCs and CVEs against free threat-intel feeds, without API keys.

For Threat intel enrichment, Vulnerability prioritizationWorks with Claude CodeMaintained kevinmhorvath, last push 2026-08-18

PluginA plugin bundles skills, commands, hooks or MCP servers for one AI client. by kevinmhorvath · read from the code at 8b5acb2 on 2026-10-21The date we last read the tool’s files. The code after “at” names the exact version (the git commit) we read; a newer version may differ. · Not run yet.Whether we have run the tool in our lab. “Did more than it said” means the run used rights its description does not name; “did no more than it said” means it stayed within them.

Code showsWhat a reading of the code found the tool can do, at the checked version, in the words of the rights table in the record. It is a ceiling, not what the tool did. A right marked unknown has no evidence either way, and that never counts as harmless.

What the code shows, worst first. No run advice yet: the one word needs a read under the full rule.

  1. Files. The cache directory lies in the user's home, outside the working directory, and --report writes into any --out path.

    ti.py L51

  2. Execution. The subagent may use Bash without restriction, while the bundled scripts start no processes.

    threat-intel-analyst.md L12

  3. Secrets. Unknown: the code reads no key or token, but the search patterns for secrets match one line in skills/threat-intel-lookup/SKILL.md, so a zero cannot be written. That never counts as zero.

Before first useSettings for your AI client that limit the tool to the rights its task needs; derived from the code unless marked tested. derived from the code, not tested

  1. Claude Code: permissions.allow: [Read, Grep, Bash(python3 skills/*)]; keep other Bash calls and Write on ask, and pass --out with a case folder.

What we checked, and what we foundDisagree?

Plugin · code showsreach ≥2 · open
212?10FilesNetworkExecutionSecretsPersistenceApproval

What the code can reach, 0 to 3 per right; a dashed point means no evidence, never zero. The three readings

Is it for you?

Made for
  • Answer whether any reputable free feed flags an indicator, and how strongly, as a defensive triage aid.
  • Rate how ready-made the public exploit material for a CVE is, so defenders and pentesters can prioritize.
  • Build or refresh a local blocklist from free, key-free open-source feeds.
Use it when
  • Enrich a batch of IOCs pasted from a SIEM alert, firewall log, phishing email or incident timeline Threat intel enrichment
  • Rate exploit maturity and in-the-wild status of CVEs during vulnerability triage, patch prioritization or pentest scoping Vulnerability prioritization
  • Check a URL from a suspicious email, where a hit on the phishing-domain feed carries the most weight Email and phishing analysis
  • Write a Markdown and CSV report of indicator verdicts for a ticket, IR timeline or client folder Alert triage
Not for
  • Meant for defensive prioritization; the author states it never contacts, scans or attacks an indicator.
  • Does not write new exploit code, weaponize a PoC or give exploitation steps; it locates and rates already-public material.
  • File hashes are out of scope, because the free hash feeds the author considered require an API key.
You need
  • Needs Python 3.8 or later; the scripts use the standard library and need no pip installs
  • Installs as a plugin from the repository's own single-plugin marketplace (.claude-plugin/marketplace.json and .claude-plugin/plugin.json)
  • ti.py needs network access to each feed URL to build its cache; each download uses urllib with a 90-second timeout

+2 more

Details

Install

linked, not distributed: the Field Guide does not bundle agents or MCP servers

Upstream

/plugin marketplace add kevinmhorvath/threat-intel-toolkit /plugin install threat-intel-toolkit@threat-intel-marketplace
Quoted from README.md#L84-85 at the pinned commit; a quotation, not a command to copy.

Run it with least privilege

claude code
permissions.allow: [Read, Grep, Bash(python3 skills/*)]; keep other Bash calls and Write on ask, and pass --out with a case folder
note
derived from the code, not tested in the lab

derived, not tested: proposed from the code analysis

End of the card. Below: what we checked, and what we found.MarkdownJSON

The record · every value with its evidence

What we checked, and what we found.

Profile read at commit 8b5acb2 on 2026-10-25: 59 facts, each with its quoted line confirmed by script; not installed, not run in the lab.Each fact was read from the tool's files at the checked version and links to the line it comes from. Where nothing was found, the page says so instead of assuming “none”.

Selected by criteria v0.1, approved by Ilja Schlak: awaiting approval. Each section opens with the answer; the file and line of every fact follow it.

What it can change the capability groups as upstream groups them, worst first

Changes, runs commands, according to the capabilities read.

The author states the plugin ships a subagent and two skills. README.md L5

GroupWhat it coversEffectOn by default
threat-intel-analystThe threat-intel-analyst subagent is granted the Bash, Read, Write, Glob and Grep tools. threat-intel-analyst.md L12reads, changes, runs commandsyes
ti.py aggregateti.py aggregate downloads and normalizes the registry feeds into the local cache; --refresh forces re-download, --only and --exclude select feeds by key. ti.py L582-587reads, changesyes
ti.py lookupti.py lookup checks IPs, domains, URLs and CVEs (defanged accepted) against the cache; --json prints machine-readable output and --report writes Markdown and CSV files to --out. ti.py L589-594reads, changesyes
exploit-availability-checkexploit_check.py reports in-the-wild status and a public exploit maturity tier per CVE from CISA KEV, FIRST EPSS, Metasploit, Nuclei, Exploit-DB, nomi-sec and trickest. exploit_check.py L5-13reads, changesyes
ti.py feedsti.py feeds lists the curated feed registry. ti.py L579readsyes
healthcheck.pyOne healthcheck.py per skill: the lookup one fetches and parses all 10 feeds; the exploit one checks that every source returns a known canary CVE (Log4Shell). README.md L100-106readsno, optional
Fallback (no shell)Without a shell, the exploit skill tells the model to fetch EPSS, nomi-sec, trickest and Nuclei per CVE with its fetch tool and to WebSearch KEV, Metasploit and Exploit-DB. SKILL.md L52readsno, optional

Where it sends data and who can connect to it

9 outside connections found in the files read: CISA KEV and abuse.ch Feodo Tracker, blocklist.de and stamparm/ipsum, Emerging Threats and GreenSnow, Tor Project and SANS DShield, Spamhaus and Phishing.Database, FIRST EPSS (api.first.org), cisa.gov, GitHub and GitLab, nomi-sec and trickest PoC indexes, Client web search.

Listens for no connections in the files read.

Other connections not ruled out: read in the documentation and the cited code, not searched in full.

How it runs generated from the files read, never drawn by hand

A subagent routes indicators to two skills: threat-intel-lookup, whose stdlib-only script ti.py aggregates 10 free feeds into a local SQLite cache and looks indicators up in it, and exploit-availability-check, which rates a CVE via KEV, EPSS, Metasploit, Nuclei, Exploit-DB and PoC aggregators. README.md L7-15

Your AI client

Parts that live inside the AI client: skill instructions, client configuration.

Your machine

Programs and files on the machine where you run the tool.

Outside your machine

Remote services: vendor APIs, model providers, targets, telemetry endpoints. Data sent here leaves your machine.

The six rights, read three waysThe six rights a tool can take (files, network, execution, secrets, persistence, approval), each read three ways and rated 0 to 3. 0 never means safe; “?” means no evidence. what the author says, what the code shows, what one lab run showed

Level 2 (open), one right unknown, read from the code. Not run in our lab yet.

RightAuthor sayswhat the author saysCode showswhat static analysis findsRun showedwhat one lab run showed
Fileswhere does it read and write?
Networkwhom does it talk to?
Executionwhat does it run?
Secretswhich credentials does it touch?
Persistencewhat survives the run?
Approvaldoes it ask before acting?

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe · zero means: none declared (Declared), none found (Code), none observed (Lab)

Author says: the evidence

  • Files · 2SKILL.md L47 the author puts the indicator cache under ~/.cache, outside the working directory
  • Network · 1README.md L116-117 the author states the toolkit only reports what public feeds say and never contacts an indicator
  • Execution · 2threat-intel-analyst.md L12 the shipped subagent lists the Bash tool without restriction
  • Secrets · 0plugin.json L4 the author states that no API keys are required
  • Persistence · 1SKILL.md L36 the author declares a 24-hour feed cache under ~/.cache

Code shows: the evidence

  • Files · 2ti.py L51 the cache directory lies in the user's home, outside the working directory, and --report writes into any --out path
  • Network · 1ti.py L182-183 requests go only to the fixed feed registry, and indicators supplied by the user are never fetched
  • Execution · 2threat-intel-analyst.md L12 the subagent may use Bash without restriction, while the bundled scripts start no processes
  • Secrets · ?no evidence: the code reads no key or token, but the search patterns for secrets match one line in skills/threat-intel-lookup/SKILL.md, so a zero cannot be written
  • Persistence · 1exploit_check.py L29 downloaded feeds stay in a cache under ~/.cache after the run
  • Approval · 0none found: patterns hitl-v0.1 in 8 files at 8b5acb2

Valid for commit 8b5acb2 · checked 2026-10-21 · method reach-v0.1The published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.

Limits and risks what the files say that fits nowhere else, and what this reading does not cover

What you need and what the documented installer does

KindWhat
AI clientClaude Code
RuntimeNeeds Python 3.8 or later; the scripts use the standard library and need no pip installs. README.md L70
RuntimeInstalls as a plugin from the repository's own single-plugin marketplace (.claude-plugin/marketplace.json and .claude-plugin/plugin.json). README.md L80-81
Otherti.py needs network access to each feed URL to build its cache; each download uses urllib with a 90-second timeout. ti.py L181-184
OtherThe first exploit check downloads about 35 MB of feeds into ~/.cache/exploit-availability-check, kept for 24 hours. SKILL.md L36
OtherIndicator lookups need a cache built first with ti.py aggregate, about 13 seconds for about 435k indicators. threat-intel-analyst.md L45-48

What the documented installer does

Lab runs one run is an observation, not a benchmark

No lab run yet. Once we run it, this section shows what it did and whether it did more than it said.

About this entry

Type
Plugin · Defensive · works with Claude Code
Source
github.com/kevinmhorvath/threat-intel-toolkit · MIT · manifest plugin.json
Version readThe install command installs exactly the version we checked (the pinned git commit), so what you get is what the card describes.
8b5acb2 · last upstream push 2026-08-18 · no release since the pinned commit
In the catalog
listed · added 2026-10-21 · last checked 2026-10-21 · next check 2027-01-19 · fresh
ScannersA scan of the tool's files with a scanner for malicious patterns. “Pending” means it has not run yet.
cisco-skill-scanner: not run, pending
Changes
none since the entry was added on 2026-10-21
MethodThe published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.
v0.1 · reach-v0.1 · badge · the rules

Disagree?

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

This entry as Markdownas JSON

How this entry was checked, and how to cite it

Selected by the published criteria (method v0.1). What the author says comes only from author statements; what the code shows comes from the code and manifests at commit 8b5acb2, each with one evidence line. A “?” means no evidence, never zero; zero never means safe.

The descriptive profile (what it does, can do, how it runs, what it needs) was read through the same isolated pipeline at commit 8b5acb2 on 2026-10-25: one reader proposed every fact with a quoted line, a script confirmed each quoted line (59 of 59), and a second reader checked each sentence against its lines. Where nothing was found, the page says so instead of assuming “none”.

Known issues and limits: remote server-side behaviour stays “?”; the lab is not your production; static analysis can miss runtime behaviour.

Placement, badges or fast tracks are not for sale. The author is employed by an IT consultancy; the company has no influence on selection, execution or result.

Cite this:

Ilja Schlak. "Threat Intel Toolkit". Agentic Security Field Guide, checked 2026-10-21, method reach-v0.1. https://readbeforerun.ai/catalog/kevinmhorvath-threat-intel-toolkit/

The method · the rules

For maintainers

Badge for your README (reach ≥2 · not run yet):

[![reach ≥2 · not run yet](https://readbeforerun.ai/badge/kevinmhorvath-threat-intel-toolkit.svg)](https://readbeforerun.ai/catalog/kevinmhorvath-threat-intel-toolkit/)

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

Claim the entry with a fieldguide.yaml in your repository: planned.

Other tools for the same task

Tasks: Threat intel enrichment, Vulnerability prioritization. The task pages compare every tool side by side.
  1. 23112?
    CrowdStrike Falcon MCP ServerMCP server · by CrowdStrike · reach 3, privilegedDraft · awaiting review

    MCP server that connects agents to the CrowdStrike Falcon platform: detections, threat intel, host management and response.

    Can tunnel or exfiltrate · write outside the project · change config or install globally · Approval: no evidence · ran once, 2026-11-07: did more than it said · checked 2026-11-07

    Code shows
  2. 111230
    Tenable MSSP Portal MCP ServerMCP server · by andrewspearson · reach 3, privilegedDraft · awaiting review

    MCP server that runs Tenable queries and hosted Hexa AI MCP tools across the child containers of a Tenable MSSP Portal.

    Can add autostart, users or keys · read broad tokens or the environment · not run yet · checked 2026-10-21

    Code shows
  3. 13023?
    Purple AI MCP ServerMCP server · by Sentinel-One · reach 3, privilegedDraft · awaiting review

    Read-only MCP server for the SentinelOne Singularity platform: Purple AI, data-lake PowerQuery, alerts, vulnerabilities, misconfigurations and inventory.

    Can tunnel or exfiltrate · add autostart, users or keys · read broad tokens or the environment · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows