Critical-risk tools in Nullcone Threat Intelligence

Critical severity Nullcone Threat Intelligence MCP Server 3 of 30 tools

3 of the 30 tools in Nullcone Threat Intelligence are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at critical risk

drain_subscription Destructive

Drain the buffer of a stateful subscription created by subscribe_threats(). Returns all IOCs delivered to this subscription since the last drain. Each subscription...
revoke_ioc Destructive

Revoke an IOC by its value hash, pushing the expiration event to all active subscriptions in real-time. Call this when an IOC is determined to be a false positive,...
unsubscribe Destructive

Cancel a stateful subscription and free its buffer. Call this when you no longer need the subscription to release memory. Subscriptions also auto-expire after 1 ho...

Attacks that target this class

Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

Destructive Action Autonomy
Privilege escalation via admin-only tools
Data exfiltration via tool chaining
Runaway Tool Loops

Critical-risk tools in Nullcone Threat Intelligence

Tools at critical risk

Attacks that target this class

More on Nullcone Threat Intelligence

Let agents act without letting them run wild.