IOC Verdict
Score one IOC. Returns the verdict, signals and evidence.
Score the domain dawnrevealed[.]com
MCP SERVER
Run VerdictIQ from your AI host.
Connect Claude, ChatGPT or any MCP-compatible client to VerdictIQ. Paste the connector URL, sign in, allow access and you are done. Nothing to install.
Copy the connector URL
The same hosted endpoint every host uses. Nothing secret rides in it: Claude signs in with OAuth, so there is no API key to paste here.
https://mcp.verdictiq.io/mcpAdd it in Claude
Open the connector settings with the link below and add a custom connector. The dialog asks for two things: name it verdictiq and paste the URL.
Connect it in the list
Then find verdictiq in the list and click Connect on its row. A row that is already connected shows a check instead.
Sign in and allow access
Claude hands you to VerdictIQ. Sign in, or create a free account, then choose Allow access on the approval screen.
Verify
- Ask your AI host
Use verdictiq to check the domain dawnrevealed[.]com - Expect a verdict
The host calls the verdict tool and answers with a score and the top signals.
AVAILABLE TOOLS
Six tools, one conversation away.
Each tool wraps a single VerdictIQ endpoint. Same response shape as the HTTP API.
Bulk Replay
Score up to 10 000 IOCs in a single call.
Check these 50 IOCs from yesterday's SIEM export.
Signal Catalog
Browse the domain signal taxonomy: name, direction, group and subgroup, with the full description on request.
What signals exist for domain IOCs?
Search History
Search the lookups your tenant already ran, by date, indicator type or risk band. Reads your stored results, no new feed query.
Have we looked this domain up before?
Risk Distribution
Score histogram and risk band counts across your own lookups for a rolling window.
How risky were our lookups this month?
Blind Spot Analysis
Compare the actions you reported against the VerdictIQ verdict: agreed, coverage gap, over-block.
Where did we allow something the verdict called malicious?
TROUBLESHOOTING
Common questions.
Eight short answers for the things that usually go sideways on the first try.
verdictiq does not show as connected in Claude
Confirm the connector URL is exactly https://mcp.verdictiq.io/mcp, with nothing appended. Endpoint health: curl https://mcp.verdictiq.io/mcp/health returns 200 with status ok. Then open the connector list, click Connect on the verdictiq row and finish the sign-in. On Claude Desktop, quit and reopen (Cmd-Q) rather than closing the window.
Tool not called
Add an explicit hint in the prompt: "use verdictiq to check…". Claude can pass on tool calls when the choice is ambiguous. Cursor and Cline weight tool descriptions higher and call without a hint.
401 Unauthorized
Reconnect first: disconnect verdictiq in the host's connector settings, connect again, sign in and choose Allow access. An expired or revoked sign-in is the usual cause. A host without OAuth sends an API key in the Authorization: Bearer header, never as a URL parameter; check the key is still active in the portal and rotate it if you suspect a leak.
Bulk limit exceeded
/verdict/bulk caps at 10 000 indicators per call. For more, batch the input and chunk via the HTTP API.
Rate limited (429)
MCP calls share the HTTP API quota. Check usage in the portal. Upgrade the plan or wait for the next quota window.
Multiple workspaces or projects
Project-level configs (for example .cursor/mcp.json) override the global file. Different projects can connect to the same endpoint under different VerdictIQ accounts.
Behind a corporate proxy
Most hosts honour HTTPS_PROXY. SSL inspection (corporate MITM) can break the TLS handshake; install your corporate CA into the system trust store.
mcp.verdictiq.io unreachable
Streamable HTTP on /mcp runs over HTTPS on 443 and holds a response stream open while a tool runs; the older SSE endpoint keeps one long-lived connection. A proxy that buffers responses or a firewall with a short idle timeout drops either one. Allow-list mcp.verdictiq.io and *.verdictiq.io. Cloud-only service: there is no alternate deployment.
Is the server up?
Check the hosted server before debugging your own config. No sign-in or API key needed for this endpoint.
curl https://mcp.verdictiq.io/mcp/health
# {"status":"ok"}Paste the URL. You're connected.
Free tier, no credit card. MCP and the HTTP API draw on the same account and the same quota; current limits are on the pricing page.
TLS 1.3Cloud-hostedOAuth sign-inSame quota as API
All product names are trademarks of their respective owners.