# Dragons Eye Cybersecurity Hub

> Read-only cybersecurity intelligence from ransomware-tracker.com across ten layers: ransomware, vulnerabilities, indicators, phishing, malware, supply_chain, network, ai_security, news, research. Records are observations from public reporting, not confirmed incidents.

## How to read the data

- Collection time (first_observed_at, last_observed_at) is not incident time (occurred_at) or publication time (published_at). Unknown dates are null.
- Counts describe overlapping observation records and retained history, not unique incidents, and are not exhaustive coverage. /stats counts records per kind; its layers list describes the ten layers and carries no per-layer counts.
- Shared identifiers (a CVE or an indicator) do not establish actor attribution. Network context is not automatically malicious.
- indicator.display is defanged; show it as plain text, never as a link.
- Every JSON answer has a delivery object. state "cached" means a dated snapshot served while the live connection is unavailable; it is stale after 900 seconds. With no snapshot the API answers 503 instead of empty data.
- Cursors are opaque and bound to their query; pass next_cursor back unchanged with the same parameters.

## REST endpoints

Base: https://ransomware-tracker.com/api/cyberhub (* = required). Unknown or repeated parameters are rejected with 400.

- GET https://ransomware-tracker.com/api/cyberhub/status: Hub status and dataset identity
- GET https://ransomware-tracker.com/api/cyberhub/stats: Record totals, counts per kind and layer descriptions
- GET https://ransomware-tracker.com/api/cyberhub/events (layer, query, cve, active, limit, cursor): Search observation records across all layers
- GET https://ransomware-tracker.com/api/cyberhub/indicators (value*, active, limit, cursor): Exact indicator lookup
- GET https://ransomware-tracker.com/api/cyberhub/vulnerabilities (cve, exploited_only, active, limit, cursor): Vulnerability records
- GET https://ransomware-tracker.com/api/cyberhub/related (cve, indicator, active, limit, cursor): Records related to exactly one CVE or indicator
- GET https://ransomware-tracker.com/api/cyberhub/exports (format*, layer, query, cve, active, limit, cursor): Download one page of records in an export format
- GET https://ransomware-tracker.com/api/cyberhub/snapshots: Completed full-dataset snapshots
- GET https://ransomware-tracker.com/api/cyberhub/snapshot-chunk (artifact_id*, offset*, length*): One verified base64 chunk of a snapshot file
- GET https://ransomware-tracker.com/api/cyberhub/snapshot-download (artifact_id*): one complete snapshot file, verified chunk by chunk. Files up to 2 GiB are streamed (larger ones answer 413). 2 downloads run at a time site-wide (503 with Retry-After when full) and 1 per address (429 while one is running). Each download must finish within 5 minutes plus the file size at 256 KiB/s, at most 3 hours, and is stopped after 60 seconds without progress. Content-Length and X-Cyberhub-Sha256 are sent before the body; a transfer that fails verification, stalls or runs out of time is cut short, so check the length and SHA-256 before use. Ranges and resuming are not supported.
- OpenAPI 3.1: https://ransomware-tracker.com/api/cyberhub/openapi.json

## MCP

POST https://ransomware-tracker.com/api/cyberhub/mcp — Streamable HTTP transport with JSON responses only, protocol version 2025-06-18, no sessions. Methods: initialize, notifications/initialized, ping, tools/list, tools/call. One JSON-RPC message per request, at most 16 KiB; batches are rejected.

- cyberhub_status: Current hub status (operational, degraded or unavailable), dataset identity and how fresh the statistics are. Includes a delivery object saying whether the answer is live or a dated cached snapshot.
- cyberhub_stats: Record totals and counts per record kind, plus a description of each layer (layers carry no counts). Counts describe overlapping observation records and retained history, not unique incidents, and are not exhaustive world coverage.
- cyberhub_search: Search observation records across the ransomware, vulnerabilities, indicators, phishing, malware, supply_chain, network, ai_security, news and research layers. Defaults: layer all, active true, limit 50. Collection time is not incident time.
- cyberhub_indicator: Exact lookup of one indicator value (IP address, domain, URL, hash and similar). Returns only records observing that exact value; a match is an observation, not proof of malicious use.
- cyberhub_vulnerabilities: Vulnerability records, optionally for one exact CVE or only known-exploited entries.
- cyberhub_related: Records linked to exactly one CVE or one indicator, with the relationships (references_cve, observes_indicator). Shared identifiers do not establish actor attribution.
- cyberhub_export: One page of matching records rendered as json, ndjson, csv, stix or misp. A page is never the complete dataset; follow next_cursor for more, or use a completed snapshot for a full download.

## Limits

- 60 reads per minute per address (120 for snapshot chunks); MCP calls share the read limit.
- Page size 1-200; query 1-256 characters; value, indicator and cursor at most 2048 characters; snapshot chunks at most 524288 bytes.
- Export pages are never complete datasets. Use /snapshots for completed full-dataset files.