Skip to content
DugganUSA Docs

DugganUSA developer docs

Threat-intelligence feeds, search and pre-flight checks for AI agents. One API key works everywhere.
QuickstartGet a free key

DugganUSA turns scattered public threat reporting into feeds and pre-install checks a small team can use in minutes. It cites its sources, says what it does not know, and corrects itself in public. Questions people ask.

Pick your integration

Section titled “Pick your integration”
Blocklists (CSV)IPs, domains, URLs, hashes and malicious packages as plain CSV for firewalls and scripts.
STIX 2.1 and TAXII 2.1A standard feed for Microsoft Sentinel, OpenCTI, MISP and any TAXII client.
Firewalls and IDSOPNsense URL tables, Suricata rules, an Unbound DNS blocklist and a Cloudflare Worker.
SIEM and detectionSentinel, Splunk, and Sigma, YARA, KQL and SPL rule exports.
Search and enrichmentLook up an IP, domain, hash or actor across the corpus.
Agent security (MCP)Two MCP servers: threat-intel lookups, and a pre-flight verdict before an agent installs or connects.

What every integration has in common

Section titled “What every integration has in common”
  • One key. The same dugusa_ key works for the feed, the API, both MCP servers, the Edge Shield worker and the Checks Action.
  • Send it in a header. Authorization: Bearer <key>. Keys in URLs end up in logs. See Authentication.
  • Read-only. Nothing you call changes anything on your side. You pull; you decide what to block.
  • You set the threshold. Every indicator carries a confidence score from 0 to 95. Filter with min_confidence.