Mcp Threatintel
Connects to five threat intelligence sources: AlienVault OTX for community threat pulses, AbuseIPDB for IP reputation scoring, GreyNoise to distinguish internet noise from targeted attacks, and abuse.ch projects including URLhaus, MalwareBazaar, ThreatFox, and Feodo Tracker. Exposes unified lookup tools that query IPs, domains, file hashes, and URLs across all configured sources simultaneously, plus source-specific operations like searching OTX pulses or pulling active botnet C2 lists from Feodo. Works without any API keys for Feodo Tracker data, and gracefully degrades when other sources aren't configured. Reach for this when you're doing security research or incident response and want to correlate intelligence without opening browser tabs for each service.
- GitHub stars
- 6
- tools
- 17
- auth
- Secret needed
- transport
- STDIO
- env vars
- 4
- last updated
- Nov 28, 2025
Tools
17 toolsPublic tool metadata for what this MCP can expose to an agent.
threatintel_statusCheck which threat intelligence sources are configured
Check which threat intelligence sources are configured
No parameter schema in public metadata yet.
threatintel_lookup_ipLook up IP across all configured sources
Look up IP across all configured sources
No parameter schema in public metadata yet.
threatintel_lookup_domainLook up domain across all configured sources
Look up domain across all configured sources
No parameter schema in public metadata yet.
threatintel_lookup_hashLook up file hash (MD5/SHA1/SHA256) across sources
Look up file hash (MD5/SHA1/SHA256) across sources
No parameter schema in public metadata yet.
threatintel_lookup_urlLook up URL across sources
Look up URL across sources
No parameter schema in public metadata yet.
abuseipdb_checkCheck IP reputation and abuse history
Check IP reputation and abuse history
No parameter schema in public metadata yet.
otx_get_pulsesGet recent threat intelligence pulses
Get recent threat intelligence pulses
No parameter schema in public metadata yet.
otx_search_pulsesSearch pulses by keyword
Search pulses by keyword
No parameter schema in public metadata yet.
greynoise_ipCheck if IP is internet noise or targeted threat
Check if IP is internet noise or targeted threat
No parameter schema in public metadata yet.
urlhaus_lookupLook up URL, domain, or IP in URLhaus
Look up URL, domain, or IP in URLhaus
No parameter schema in public metadata yet.
urlhaus_recentGet recent malware URLs
Get recent malware URLs
No parameter schema in public metadata yet.
malwarebazaar_hashLook up malware sample by hash
Look up malware sample by hash
No parameter schema in public metadata yet.
malwarebazaar_recentGet up to 100 recent malware samples
Get up to 100 recent malware samples
No parameter schema in public metadata yet.
malwarebazaar_tagSearch samples by tag
Search samples by tag
No parameter schema in public metadata yet.
threatfox_iocsGet recent IOCs from ThreatFox
Get recent IOCs from ThreatFox
No parameter schema in public metadata yet.
threatfox_searchSearch ThreatFox for a domain, IP:port, or URL IOC value
Search ThreatFox for a domain, IP:port, or URL IOC value
No parameter schema in public metadata yet.
feodo_trackerGet active botnet C2 servers (QakBot, Emotet, Dridex, etc.)
Get active botnet C2 servers (QakBot, Emotet, Dridex, etc.)
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
OTX_API_KEYsecretAlienVault OTX API key (free at otx.alienvault.com)
ABUSEIPDB_API_KEYsecretAbuseIPDB API key (free at abuseipdb.com)
GREYNOISE_API_KEYsecretGreyNoise API key (free at greynoise.io)
ABUSECH_AUTH_KEYsecretabuse.ch Auth Key for URLhaus, MalwareBazaar, ThreatFox (free at auth.abuse.ch)
Readme
MCP Threat Intel Server
MCP server providing unified access to multiple threat intelligence sources for security research and analysis.
Why Use This?
If you're doing security research, incident response, or threat analysis, this MCP server lets you:
Details
- Repository
- github.com/aplaceforallmystuff/mcp-threatintel
- Package
mcp-threatintel-server- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active