IOC Verdict
Score one IOC. Returns the verdict, signals and evidence.
Score the domain example.com
MCP SERVER
Run VerdictIQ from your AI host.
Connect Claude, ChatGPT or any MCP-compatible client to VerdictIQ. Paste a URL, paste your key, you are done. Nothing to install.
Copy the connector URL
The same hosted endpoint every host uses. Nothing secret rides in it: Claude signs in with OAuth, so there is no API key to paste here.
https://mcp.verdictiq.io/mcpAdd it in Claude
Open the connector settings with the link below and add a custom connector. The dialog asks for two things: name it verdictiq and paste the URL.
Connect it in the list
Then find verdictiq in the list and click Connect on its row. A row that is already connected shows a check instead.
Sign in and allow access
Claude hands you to VerdictIQ. Sign in, or create a free account, then choose Allow access on the approval screen.
Verify
- Ask your AI host
Use verdictiq to check the domain example.com - Expect a verdict
The host calls the verdict tool and answers with a score and the top signals.
AVAILABLE TOOLS
Six tools, one conversation away.
Each tool wraps a single VerdictIQ endpoint. Same response shape as the HTTP API.
Bulk Replay
Score up to 10 000 IOCs in a single call.
Check these 50 IOCs from yesterday's SIEM export.
Signal Catalog
Browse the domain signal taxonomy: name, direction, group and subgroup, with the full description on request.
What signals exist for domain IOCs?
Search History
Search the lookups your tenant already ran, by date, indicator type or risk band. Reads your stored results, no new feed query.
Have we looked this domain up before?
Risk Distribution
Score histogram and risk band counts across your own lookups for a rolling window.
How risky were our lookups this month?
Blind Spot Analysis
Compare the actions you reported against the VerdictIQ verdict: agreed, coverage gap, over-block.
Where did we allow something the verdict called malicious?
TROUBLESHOOTING
Common questions.
Eight short answers for the things that usually go sideways on the first try.
No green dot in Claude Desktop
Validate the JSON: jq . claude_desktop_config.json. Confirm the URL is exactly https://mcp.verdictiq.io/mcp/sse. Endpoint health: curl https://mcp.verdictiq.io/mcp/health returns 200 with status ok. Quit and reopen Claude (Cmd-Q), not just close the window.
Tool not called
Add an explicit hint in the prompt: "use verdictiq to check…". Claude can pass on tool calls when the choice is ambiguous. Cursor and Cline weight tool descriptions higher and call without a hint.
401 Unauthorized
Confirm the key is set under headers (X-API-Key), not as a URL parameter. Check the key is still active in the portal. Rotate if you suspect a leak.
Bulk limit exceeded
/verdict/bulk caps at 10 000 indicators per call. For more, batch the input and chunk via the HTTP API.
Rate limited (429)
MCP calls share the HTTP API quota. Check usage in the portal. Upgrade the plan or wait for the next quota window.
Multiple workspaces or projects
Project-level configs (for example .cursor/mcp.json) override the global file. Different projects can run with different keys against the same endpoint.
Behind a corporate proxy
Most hosts honour HTTPS_PROXY. SSL inspection (corporate MITM) can break the TLS handshake; install your corporate CA into the system trust store.
mcp.verdictiq.io unreachable
SSE keeps a long-lived TCP connection on 443. If the firewall has a short idle timeout, the connection drops. Allow-list mcp.verdictiq.io and *.verdictiq.io. Cloud-only service: there is no alternate deployment.
Is the server up?
Check the hosted server before debugging your own config. No API key needed for this endpoint.
curl https://mcp.verdictiq.io/mcp/health
# {"status":"ok"}Paste the URL. You're connected.
Free tier, no credit card. MCP and HTTP share the same key and the same quota; current limits are on the pricing page.
TLS 1.3Cloud-hostedZero retentionSame quota as API
All product names are trademarks of their respective owners.