Self-hosted threat intelligence platform — 10 open-source feeds, OCSF Class 4001, REST API, MCP server, self-healing feeds
Agent Claude Code
Implements FastAPI REST endpoints and FastMCP tool definitions for the IP Intel Platform. Use when building app/main.py, app/mcptools.py, or any REST route. Knows the 6 REST endpoints (GET /lookup/{ip}, POST /bulk, GET /health, GET /export/{format}, GET /asn/{asn}/ranges, POST /admin/), the 6 MCP tools (iplookup…
Agent Claude Code
Implements feed updater scripts for the IP Intel Platform. Use when building or modifying any file in app/updaters/. Knows the updater contract: async fetch, parse, validate record count, write to IntelStore via swap(), handle network errors gracefully. Knows all feed endpoint URLs, sapics dual-list requirement…
Agent Claude Code
Implements the SelfRepairAgent and feed health monitoring for the IP Intel Platform. Use when building app/repairagent.py or app/scheduler.py. Knows the four failure types (liveness, schemadrift, dataquality, contentdrift), the state machine (HEALTHY→DEGRADED→QUARANTINED→RESTORED/ESCALATED), exact FeedHealthRecord…
Agent Claude Code
Implements Pydantic v2 models for the IP Intel Platform: OCSF class 4001 output model, per-feed data models, FeedConfig model, and UpdateResult model. Also implements app/ocsf.py (buildocsfresponse), app/config.py (FeedConfig, loadfeedsconfig), and the LookupEngine.fromfixtures() classmethod stub. Knows all OCSF class…
Agent Claude Code
Writes pytest test files for the IP Intel Platform following the spec fixtures and the 7-step systematic testing process. Use when asked to write or update any file in tests/. Knows all conftest.py fixture signatures (including LookupEngine.fromfixtures, mockschemadrift, mockhttpfailure, mockwebhook, dropfixture…