Medusa Security Intelligence
STIX 2.1 threat intelligence from live honeypots, OSINT, and behavioral analysis
~293K published IOCs · free tier · no card required
Get your free API key
No card. 30 seconds. Live the moment you hit the button.
Your API Key
Payment
- Full STIX 2.1 bundle
- CSV exports (IPs, domains)
- 7-day lookback
- Community support
- No behavioral scoring
- No precursor signals
- Everything in Free
- Edge Shield on hourly refresh
- Month-to-month, cancel anytime
- No behavioral scoring
- No precursor signals
- Everything in Free
- 90-day lookback
- Behavioral scoring
- Precursor signals (1–5hr)
- Supply chain IOCs (38–43)
- Cross-index correlation
- Best-effort email support
- Everything in Pro
- Full history lookback
- Medustone + Meduskip + Medusactive
- NET-30 / PO invoicing
- Best-effort email support
Feature Comparison
| Feature | Free | Shield | Pro | Enterprise |
|---|---|---|---|---|
| STIX 2.1 Bundle (1.14M+ IOCs) | ✓ | ✓ | ✓ | ✓ |
| CSV Exports (IPs, domains, hashes) | ✓ | ✓ | ✓ | ✓ |
| Behavioral Scoring (assholeScore) | — | — | ✓ | ✓ |
| Precursor Signals (1–5hr early warning) | — | — | ✓ | ✓ |
| GitHub Supply Chain IOCs (Pattern 38–43) | — | — | ✓ | ✓ |
| Cross-Index Correlation | — | — | ✓ | ✓ |
| Medustone / Meduskip / Medusactive | — | — | — | ✓ |
| Threat Lookback | 7 days | 7 days | 90 days | Full history |
| Daily Requests | 10 | 300 | 2,000 | 50,000 |
| Support | Best-effort email | Best-effort email | Best-effort email | Best-effort email |
Payment
Stripe Checkout
Card, Link, Cash App, Klarna, Affirm, Apple Pay, Google Pay, ACH. Instant key activation.
Cancel anytime. Annual billing: 2 months free.
Frequently Asked Questions
How is this different from Recorded Future or ThreatConnect?
Behavioral scoring from live honeypots — not aggregated third-party reports. 1–5 hour precursor signals before attacks materialize. GitHub supply chain IOCs (Pattern 38–43) and brand-impersonation repos (fake-installer orgs impersonating wallets, VPNs, and enterprise clients) nobody else detects. 244 unique discoveries. 1.14M+ indicators growing daily.
Who uses it?
Pulled daily by production CTI integrations — MISP, OpenCTI, SIEM connectors and firewall blocklists. We do not name who consumes the feed.
Why 10 requests/day on free?
Each request pulls the full 1.14M+ IOC bundle. 10/day is enough to test one SIEM integration's daily pull and a handful of manual searches — true evaluation. Shield ($24/mo, 300/day) covers Edge Shield on an hourly refresh. Pro unlocks the operational tier at 2,000/day with real-time data and Tor + OPNsense feeds.
Can a free key run Edge Shield?
Yes, on a daily refresh. Edge Shield pulls 2 calls (IPs + domains) per Cloudflare data center per refresh. Set IOC_REFRESH_MINUTES=1440 and a free key fits a small site in one or two data centers (a restarted worker pulls again, so it is not a guarantee). The default hourly refresh needs at least 48 calls per data center per day — hourly needs Shield ($24/mo, 300/day, enough for a handful of data centers) or Pro (2,000/day) beyond that. Hourly freshness is what you pay for; the blocking itself is free. Set it up with Claude Code →
What does Enterprise include?
Full Medusa product bundle: Medustone (threat intel assessment), Meduskip (financial/crypto tracing), Medusactive (DLP), graph traversal, CARVER/DREAD framework analysis. 50,000 requests/day and full history lookback. Support is best-effort email, the same as every tier; “Enterprise” is the highest-volume tier, not a service-level promise.
Can I cancel anytime?
Yes. All subscriptions are cancel-anytime via your Stripe dashboard. No lock-in. Annual billing saves 2 months but is fully refundable within 14 days.