DugganUSA Edge Shield

DugganUSA turns scattered public threat reporting into feeds and pre-install checks a small team can use in minutes. It cites its sources, says what it does not know, and corrects itself in public.

Free API key: https://analytics.dugganusa.com/stix/register. One key covers the feed, the API, the MCP servers, Edge Shield and the Checks Action. Questions: https://docs.dugganusa.com/faq/

Docs: https://docs.dugganusa.com/firewall/edge-shield/

You do you. I do me. We share contexts.

Your origin keeps its core; the Worker enforces the DugganUSA Feed's context at your edge, before traffic reaches you.

We watched the open internet, then built the membrane between your AI agents and everything they install, call, read and obey. Edge Shield is the membrane's edge plane.

Threat intelligence you can check, enforced at the Cloudflare edge. Free. Open source.

Posture:

DugganUSA's threat feed at your edge, plus behavioral blocking. Deploy in 30 seconds.

Behavioral blocking at the edge, alongside the list. Over 16 measured days the shield stopped 1,638 distinct attacking hosts, where the blocklist working alone would have stopped 55.

Get Your Free API Key  •  DugganUSA Feed  •  Blog  •  AIPM

---

Set it up with Claude

Clone the repo, open it in Claude Code, and say "set this up for me."

git clone https://github.com/pduggusa/dugganusa-edge-shield.git
cd dugganusa-edge-shield
claude

Claude follows the playbook in CLAUDE.md, one question at a time with a recommended default for each: which of your hosts to protect and which are sensors that must never be shielded, block or observe-first, your min_confidence, honeypots, rate limits and feed-hit reporting. It writes your wrangler.local.toml, has you set the API key yourself (never in chat), shows a dry run before deploying, and proves the result with live probes (scripts/verify.sh). Every policy knob is a documented [vars] entry in wrangler.example.toml.

What's New in 2.5.0

Your security preferences are config, not code. Block or observe mode, IOC on/off, min_confidence, feed window, refresh interval, scanner 418, rate limits, feed-hit reporting, schema hosts and sensor hosts are all [vars]. Defaults match 2.4.0, so an existing deployment behaves the same. Observe mode blocks nothing and records everything it would have blocked: a Workers Logs line, an X-DugganUSA-Observed response header, and an observed feed-hit report. Run it for a week before you block. Sensor hosts are passed through untouched. The feed is now pulled once per data center, not once per isolate.

What's New in 2.4.0

NetScaler ADC / Gateway canaries. CVE-2026-88771 and CVE-2026-88772 were exploited for weeks before disclosure. Our own honeypots logged 126,873 attack records and not one of them was a NetScaler probe, because nothing we ran looked like a NetScaler. The Worker now answers the paths NetScaler scanners fingerprint first, tags each catch citrix-netscaler, and is off by default on customer zones (see Privacy). Known limit: CVE-2026-88772 is reached over DTLS (UDP), which an HTTP Worker never sees.

What's New in 2.3.0

This Worker now closes the loop on feed liveness. When one of our published indicators blocks real traffic at your edge, the Worker reports the hit back to the feed-efficacy axis — privacy-preserving (it sends only the indicator we already published, never your visitors or assets). That turns "we have 653,342 distinct IOCs" into "here's proof they fire in the wild."

Don't take our word for the feed — verify it yourself. The DugganUSA platform serves four live, no-auth, durable validation endpoints (durable across our deploys; each response carries a source field of live, durable, or baseline):

• Novelty — /api/v1/feed-uniqueness: how much of our independently sourced data is not already in ThreatFox, so you can see what this feed adds beside the feeds you already run.
• Timeliness — /api/v1/kev-lead: a live ledger of when each exploited CVE entered our corpus next to its CISA KEV listing date, with receipts, including the ones we had no record of.
• Accuracy — /api/v1/spamhaus-validation: Spamhaus independently corroborates our first-hand contributions.
• Liveness — /api/v1/feed-efficacy: opt-in consumer reports of when our indicators actually fire on real traffic — proof the feed is operationally live, not just large. This Worker is a reporter for that axis.

This is the beginning of the README. Read the rest at the original. Read the full README ↗