Mcp Threatintel

Overview

Mcp Threatintel is a Model Context Protocol server that unifies threat intelligence from multiple sources including OTX, AbuseIPDB, GreyNoise, abuse.ch, and Feodo Tracker. It exposes these capabilities as tools that AI assistants can invoke directly, enabling security researchers and developers to query threat data seamlessly within their workflow.

The server runs locally via the npm package mcp-threatintel-server, communicating over stdio on your machine. Installation is simple with npx -y mcp-threatintel-server. You'll need API keys for the threat intelligence services you want to use. The current release is v1.0.1, published under the MIT license with source code available at aplaceforallmystuff/mcp-threatintel on GitHub.

Mcp Threatintel is listed in the Security category on mcp.site and works with MCP clients including Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, and Zed. If you maintain this server, claim this listing to verify ownership and keep the information current.

Installation

// claude_desktop_config.json
{
  "mcpServers": {
    "mcp_threatintel": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-threatintel-server"
      ]
    }
  }
}