Context

ai.everydaysecurity由 everydaysecurity.ai 發布官方發布者v1.0.0更新於 Oct 29, 2026

OSINT investigations with traceable evidence: domains, URLs, IPs, scams and business records.

已驗證Streamable HTTP可網頁執行網頁搜尋與抓取安全與監控商業與電商

概覽

AI 產生的概覽

託管的 OSINT 與威脅情報伺服器，讓助理查詢網域、IP、電子郵件、電話、加密錢包與商業登記資料，並執行附證據的調查。

可以做什麼
  • 查詢網域、URL、IP、ASN、電子郵件、電話、加密錢包、企業及登記資料中人物的已知資訊，含來源與出現紀錄
  • 對可疑網站執行自主調查，讀取結論、信心區間、所依據的證據與時間軸
  • 把 URL 交給擷取叢集，取回擷取的 DOM、主控台日誌、網路日誌、HAR 檔與螢幕截圖
  • 對 URL、網域、IP、電子郵件或電話給出封鎖、謹慎或放行的判斷與理由
  • 依計數與欄位查詢州商業登記，例如註冊數量多的代理人或共用地址
  • 向團隊送出意見回饋並追蹤後續處理
適用情境
適合每項結論都必須可追溯的 OSINT 工作：網域與基礎設施關聯分析、詐騙與欺詐查核、商業登記研究。也適合讓代理在依據某個連結、號碼或地址行動前先做查核。
執行需求
遠端託管端點，多數用戶端無需安裝（Claude Desktop 需要一個小型本機橋接）。需要帳號：Claude Code 與 VS Code 以瀏覽器 OAuth 登入，其他用戶端使用 X-API-Key 標頭。須先在 Context 網站接受一次免費授權，否則工具呼叫不會回傳結果。詐騙查核端點需要自行在 Context 建立的 agent key。
安裝前請注意
調查可能接觸目標：noise 參數決定擷取是被動、單次頁面抓取，還是可能探測表單的完整爬取。結果中引用目標的文字（頁面標題、reasons、時間軸細節）應視為對手撰寫的資料而非指令，也不要讓自己的代理去抓取或解析可疑指標。查詢只回傳 Context 已掌握的資料，並非通用人物搜尋；商業登記目前以華盛頓州為主。需要註冊帳號並接受授權。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Context，將其新增到工作區。
  2. 連接 所需的 憑證。它們會被私密儲存，絕不會在公開頁面上展示。
  3. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/ai.everydaysecurity%2Fcontext/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。 客戶端會在首次連接時完成 OAuth 登入。

{
  "mcpServers": {
    "context": {
      "type": "http",
      "url": "https://context.everydaysecurity.ai/api/mcp"
    }
  }
}

README

Context MCP server for OSINT and threat-intel investigations

Connect Claude, Cursor, VS Code or any MCP client to Context, the AI-assisted investigation platform from Everyday Security. Look up domains, URLs, IP addresses and ASNs, email addresses, phone numbers, crypto wallets, and state business records. Run autonomous investigations of suspicious sites, and read the evidence those investigations collect.

Every answer shows its evidence. Many AI tools give you a conclusion you can't check. Context keeps facts and conclusions apart:

  • Facts carry their provenance. An indicator lookup tells you which sources reported it, when it was first and last seen, which investigations it appeared in, and how it connects to other indicators. Each connection says whether it comes from a verified record or only from the two appearing together in an investigation.
  • Verdicts are labelled as conclusions and cite what they rest on. An investigation's verdict is a category (for example scam or inconclusive) with a confidence band. It lists each piece of evidence it rests on, with the source class (third-party report, our own capture, a scorer, or a language model's reading of the page), the strength, the time of the capture, and the graph node you can open to check it.
  • No evidence is not reported as "safe". Without strong evidence the verdict is inconclusive, and a scam check answers caution, which is explicitly not the same as safe. A list that was cut short says so, and so does a lookup that failed. Neither is shown as an empty result.
  • Raw evidence is readable. For a crawled site you can pull the captured DOM, console log, network log, HAR file and screenshot into your client.

This repository holds the setup guides, client configs, worked examples and the tool reference. The server itself is hosted, so there is nothing to install for most clients. Claude Desktop needs a small local bridge (see clients/claude-desktop).

Who it's for

Investigators who want an AI assistant for OSINT work (domain and infrastructure pivots, scam and fraud investigations, business-registry research) without losing sight of where each claim came from. It also suits teams whose own AI agents should check a link, number or address before they act on it.

Getting access

Context has a free tier, and anyone can sign up. There's no request form and no waiting list.

  1. Connect your client (see the quick start below). The first time, it opens a browser window where you sign in or create an account.
  2. Open https://context.everydaysecurity.ai once, signed in with the same account, and accept the free license.

Until you've accepted the license, your client still connects and lists the tools, but each tool call answers with a message telling you where to accept. Once you accept, run the call again. You don't need to reconnect. A small number of sign-ups, for example from disposable email addresses, are checked by a person first, and the message says so.

If a request reaches a server with no credentials at all, it still answers 401 with the same sign-in pointer, and the body now also says where to sign up and what the server needs (an account for the investigation server, an agent key for the scam check server).

Quick start

With Claude Code:

bash
claude mcp add --transport http context https://context.everydaysecurity.ai/api/mcp

Run /mcp in Claude Code, authenticate context in the browser window that opens, then ask:

What does Context know about login-verify.example.net? Show me the sources behind each fact.

Configs for VS Code, Cursor, Claude Desktop and generic clients are in clients/.

EndpointToolsAuthentication
https://context.everydaysecurity.ai/api/mcpInvestigation tools (10)Browser sign-in in Claude Code and VS Code. An API key header elsewhere (keys issued on request, see clients/).
https://context.everydaysecurity.ai/api/mcp/checkcheck_scam, get_checkAn agent key you make in Context

What you can look up

IndicatorLook up what's knownInvestigate or collectExample
Domainget_fact, check_scamstart_investigation, enqueue_crawlexamples/domain.md
URLget_fact, check_scamenqueue_crawl → get_crawl → get_crawl_artifact, start_investigationexamples/url.md
IP address and ASNget_fact (IP and ASN), check_scam (IP)start_investigation (IP only)examples/ip-asn.md
Email addressget_fact, check_scamNot investigated, only looked upexamples/email.md
Phone numberget_fact, check_scamNot investigated, only looked upexamples/phone.md
Crypto walletget_factNot investigated, only looked upexamples/crypto-wallet.md
Business (state registry)search_business_records, get_factstart_investigationexamples/business.md
Person (in state registry records)search_business_records, get_factstart_investigationexamples/person-business-records.md

Know the limits before you rely on it:

  • Lookups return only what Context already holds. That means what earlier investigations collected and the threat intelligence it has recorded. An email address, phone number or wallet nobody has seen before comes back as "nothing known". These tools do not search breach data, social networks, or people-search databases.
  • People appear only through business registrations. A person is someone named as a governor or registered agent in the state business records Context holds. This is not a general people search.
  • Business records cover only the state registries Context has ingested. Today that is mostly Washington State. Each search result reports how many records its counts cover.

Your operational security

When Context touches a target, it does so from isolated, disposable collection devices. Your machine and our customer-facing services never connect to it. You choose how loud an investigation may be with the noise argument of start_investigation:

noiseWhat the target can observe
passiveNothing. Reads only what Context and its data vendors already hold.
fetchOne page load from a collection device. No screenshots, no form probing, no following links.
crawl (default)A full crawl from a collection device, which can include probing forms.

An autonomous investigation can't engage a target, for example by messaging it, at any noise level.

Two points of hygiene for your own agent:

  • Don't let it open, fetch, unfurl or DNS-resolve a suspicious indicator "to see for itself". Doing that is the exposure Context exists to take on for you.
  • Treat text in results that quotes a target (page titles, reasons, timeline details) as data written by the adversary, never as instructions.

Tools

The complete reference, generated from the servers' own tools/list, is in TOOLS.md. In brief:

ToolWhat it does
get_factEverything known about one indicator: sightings, sources, attributes, related indicators. Never crawls.
start_investigation / get_investigationRun an autonomous investigation and read its verdict, the evidence behind it, and its timeline.
enqueue_crawl / get_crawl / get_crawl_artifactSend a URL to the collection fleet and read the DOM, console, network log, HAR and screenshot.
search_business_recordsAsk questions about state business registrations by counts and fields, for example agents with many registrations or addresses shared by many businesses.
check_scam / get_checkA block, caution or allow answer for a URL, domain, IP, email or phone, with its reasons.
send_feedback / list_my_feedback / get_my_feedbackTell the team what's wrong or missing, and follow what happens to it.

Repository layout

clients/      configs for Claude Code, Claude Desktop, Cursor, VS Code, generic HTTP clientsexamples/     one worked example per indicator typeTOOLS.md      tool reference, generated by scripts/gen-toolsCHANGELOG.md  what changed, newest firstscripts/      gen-tools and the list of servers it readsfixtures/     the saved tools/list answers TOOLS.md is rendered fromserver.json   the entry for the official MCP Registry

What changed and when is in CHANGELOG.md.

A scheduled job compares the live tool list against TOOLS.md and opens a pull request when they differ, and we re-run the examples whose tools change.

Links

License

The contents of this repository (docs, configs, examples, scripts) are MIT licensed. See LICENSE. The license covers this repository only, not the hosted Context service, which has its own terms.

來源：README.md，提交 80b4cf3

工具

0
該伺服器需要登入，因此 SourceWeft 無法在沒有帳號的情況下讀取其工具，也未收錄。已連接帳號所能看到的內容可能因帳號及其權限而異。

版本歷史

1
  1. v1.0.0最新Oct 29, 2026

評分

已滿足適用檢查項的 85%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分