MCP Threat Intel Server MCP Server

MCP Threat Intel Server

MCP server providing unified access to multiple threat intelligence sources for security research and analysis.

Why Use This?

If you're doing security research, incident response, or threat analysis, this MCP server lets you:

• Unified lookups - Query IPs, domains, hashes, and URLs across multiple sources simultaneously
• Reduce context switching - No need to open multiple browser tabs for different intel sources
• Correlate intelligence - See results from all configured sources in one response
• Free tier friendly - Works with free API tiers, gracefully degrades when sources unavailable
• Works without keys - Feodo Tracker (botnet C2s) works without any API keys

Features

Prerequisites

• Node.js 18+
• API keys for your preferred threat intelligence sources (see below)

Installation

Using npm (Recommended)

npx mcp-threatintel-server

Or install globally:

npm install -g mcp-threatintel-server

From Source

git clone https://github.com/aplaceforallmystuff/mcp-threatintel.git
cd mcp-threatintel
npm install
npm run build

Configuration

For Claude Desktop

Add to your Claude Desktop config file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "threatintel": {
      "command": "npx",
      "args": ["-y", "mcp-threatintel-server"],
      "env": {
        "OTX_API_KEY": "your-otx-api-key",
        "ABUSEIPDB_API_KEY": "your-abuseipdb-api-key",
        "GREYNOISE_API_KEY": "your-greynoise-api-key",
        "ABUSECH_AUTH_KEY": "your-abusech-auth-key"
      }
    }
  }
}

For Claude Code

Add to ~/.claude.json:

{
  "mcpServers": {
    "threatintel": {
      "command": "npx",
      "args": ["-y", "mcp-threatintel-server"],
      "env": {
        "OTX_API_KEY": "your-otx-api-key",
        "ABUSEIPDB_API_KEY": "your-abuseipdb-api-key",
        "GREYNOISE_API_KEY": "your-greynoise-api-key",
        "ABUSECH_AUTH_KEY": "your-abusech-auth-key"
      }
    }
  }
}

API Keys

Note: Tools are dynamically enabled based on which API keys you provide. Feodo Tracker works without authentication (public JSON feeds).

Usage Examples

Check Available Sources

"What threat intel sources are configured?"

"Show me threatintel status"

IP Investigation

"Check if 185.220.101.1 is malicious"

"Look up this IP across all threat intel sources"

Domain Analysis

"Is evil-domain.com known to be malicious?"

"Check domain reputation"

Malware Hash Lookup

"Look up this SHA256 hash in threat intel"

"Is this file hash known malware?"

URL Analysis

"Check if this URL is in any blocklists"

Botnet Tracking (No API Key Required)

"Show me active botnet C2 servers"

"Get Feodo tracker data for Emotet"

Threat Pulses

"Search OTX for recent ransomware pulses"

"Get latest threat intelligence pulses"

Available Tools

Status

Unified Lookups

AbuseIPDB (re