Skip to content
View pduggusa's full-sized avatar
💭
Deploying, Breaking, Repeating
💭
Deploying, Breaking, Repeating
11 followers · 1 following

Achievements

Achievement: Pull Sharkx2Achievement: Pair Extraordinairex3Achievement: YOLOAchievement: Quickdraw

Achievements

Achievement: Pull Sharkx2Achievement: Pair Extraordinairex3Achievement: YOLOAchievement: Quickdraw

Highlights

  • Pro

Block or report pduggusa

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
pduggusa/README.md

Patrick Duggan · DugganUSA

npm VS Code Marketplace MCP Registry IETF Hackathon Free API

Developer docs: https://docs.dugganusa.com (for AI: https://docs.dugganusa.com/llms.txt)

Threat intelligence you can check. I build and run DugganUSA, AI security you can check, built with AI as a working partner: the DugganUSA Feed (free STIX/TAXII/MISP, live counts), and research on MCP and AI-agent security. Every claim links to its source, confidence is capped at 95%, and mistakes are corrected in public.

Before this: lead architect for Dell EMC's Azure Stack hybrid cloud, then cloud security architecture at Check Point and Palo Alto Networks.

For agent builders: add a second opinion in one line

Keep the tools and vendors you already use. These sit beside them, read-only, and need no key, no signup and none of your data.

  • Before your agent installs a package or calls an MCP server, give it our checks. Claude Code: claude mcp add --transport http dugganusa https://analytics.dugganusa.com/api/v1/mcp Any other MCP client: point it at https://analytics.dugganusa.com/api/v1/mcp. The check-package tool answers allow, review or block for npm, PyPI, RubyGems and GitHub Actions, with the reason and the source.
  • Before a pull request merges a new dependency or MCP server, add dugganusa-checks-action to the workflow. It runs without a key at anonymous limits.
  • Before your agent obeys an instruction file, run npx github:pduggusa/dugganusa-agent-guard in the repo to find hidden Unicode in CLAUDE.md, .cursorrules and AGENTS.md (source).

Support matrix

What each check covers, and what it asks of you.

Check Runs where Covers Needs a key? What leaves your machine
check-package (MCP tool) Your agent, via https://analytics.dugganusa.com/api/v1/mcp npm, PyPI, RubyGems, GitHub Actions; exact version adds an OSV vulnerability check No The package name and version you ask about
Dredd check_mcp_server (MCP tool) Your agent, via https://analytics.dugganusa.com/api/v1/dredd/mcp MCP servers, including their full npm/PyPI dependency graph No The server name you ask about
dugganusa-checks-action GitHub Actions, on pull requests package-lock, npm-shrinkwrap, requirements*.txt, pyproject, poetry.lock, Gemfile(.lock), MCP config files, workflow uses: lines No (anonymous limits); a free key raises them Package, server and action identities from the diff
dugganusa-agent-guard Locally or in CI, zero dependencies Hidden Unicode in CLAUDE.md, .cursorrules, AGENTS.md and similar files No Nothing
dugganusa-cli Terminal, CI, or as a local MCP server IPs, domains, hashes, CVEs, and known-bad packages in lockfiles Yes, a free key The indicators it extracts, never the file

All of them are read-only: they give a verdict and change nothing. Anything that could not be checked is reported as unknown, never as clean.

Every verdict cites where it came from: OSV, abuse.ch, CISA, the researchers who found the thing, and our own hunting. If one is wrong, tell us and we will fix it in public.

Use it free

  • API key in 30 seconds: analytics.dugganusa.com/stix/register
  • Feeds: STIX 2.1 / TAXII 2.1 / MISP, CSV blocklists for firewalls and SIEMs
  • CLI: npx dugganusa-cli · MCP server: listed in the official MCP Registry as io.github.pduggusa/dugganusa-threat-intel

Tools

Repo What it does
dredd-mcp Pre-flight security check for MCP servers before an agent calls them
dugganusa-agent-guard Finds invisible Unicode prompt injection in CLAUDE.md, .cursorrules, AGENTS.md
dugganusa-edge-shield Cloudflare Worker that blocks known-bad traffic at the edge
dugganusa-sentinel Microsoft Sentinel data connector for the free feed
dugganusa-action GitHub Action that flags known-bad indicators in pull requests
dugganusa-vscode VS Code extension: threat lookups inside your editor
dugganusa-ietf IETF Hackathon contributions on agentic-attack vectors and MCP verification

Read the work

dugganusa.com · LinkedIn

Pinned Loading

  1. dugganusa-edge-shield dugganusa-edge-shield Public

    Edge Shield: Cloudflare Worker that enforces the DugganUSA Feed at your edge. Scanner detection, behavioral blocking, geo headers. Threat intelligence you can check.

    JavaScript 5

  2. dugganusa-cli dugganusa-cli Public

    CLI threat intel scanner + local STDIO MCP server: check IPs, domains, hashes, CVEs against the DugganUSA Feed from your terminal. npx dugganusa-cli

    JavaScript 2

  3. dugganusa-scanner-core dugganusa-scanner-core Public

    Core IOC scanning engine for DugganUSA integrations. Extract IPs, domains, hashes, CVEs from text and correlate against the DugganUSA Feed.

    JavaScript 1

  4. dugganusa-action dugganusa-action Public

    GitHub Action: scan PRs for threat indicators (IPs, domains, hashes, CVEs) against the DugganUSA Feed. Block merges containing known-bad indicators.

    JavaScript 2

  5. dugganusa-vscode dugganusa-vscode Public

    VS Code extension: scan code for IPs, domains, hashes, and CVEs against the DugganUSA Feed in real time.

    JavaScript

  6. dredd-mcp dredd-mcp Public

    Dredd: pre-flight verdict on MCP servers and their dependency trees. Blocks known-compromised dependencies, tool drift and remote URL hijacks. HMAC-signed verdicts; honest unknown when we can't see.