15 #threat-intelligence MCP Servers & Clients

MISP MCP Server

bornpresident

A Model Context Protocol (MCP) server that integrates with the MISP (Malware Information Sharing Platform) to provide threat intelligence capabilities to Large Language Models.

ORKL MCP Server

heiths

MCP server for ORKL Threat Intelligence Library

ThreatNews

xue20010808

MCP server for Threat info collection in cyber security

🧠 AgentNull: AI System Security Threat Catalog + Proof-of-Concepts

jaschadub

AgentNull: AI System Security Threat Catalog + Proof-of-Concepts. Collection of PoCs for using Agents, MCP, and RAG in bad ways.

Mlab - IOC & Threat Intelligence

mlab-sh

Threat intelligence MCP server for SOC analysts, DFIR and security researchers. Scan and enrich IOCs directly from Claude, Cursor or any MCP client: IP addresses (IPv4/IPv6), domains, file hashes and blockchain addresses. Search CVEs by keyword, vendor or product, retrieve full C

Kaspersky Opentip Mcp Server

KasperskyLab

Kaspersky OpenTIP Model Context Protocol Server

This is a threat intel MCP server connected to the ORKL API to retrieve threat report and ask for IOCs, Threat Actors and breaches.

Microsoft Sentinel MCP Server

dstreefkerk

MCP server for Microsoft Sentinel. Enables access to Sentinel logs, incidents, analytics, and Entra ID data via a modular, queryable interface. Strictly non-production. Designed for use with Claude and other LLMs.

Virustotal Mcp

yassinech-99

MCP server that enables LLMs to interact with the VirusTotal API for malware analysis, URL scanning, and threat intelligence.

WhoisJSON MCP Server exposes four domain intelligence tools directly inside Claude, Cursor, and Windsurf — no code required.

Real-time phishing detection, IP reputation, and CVE risk analysis API for AI agents. Powered by live threat feeds (OpenPhish, Feodo Tracker, URLhaus). Pay per request via x402 micropayments (USDC on Base). First 1,000 requests free, no signup required.

FalconFeeds MCP server

Technisanct

Connect real-time cybersecurity threat intelligence to your AI workflows through standardized tools and resources. Access comprehensive IOCs, CVEs, TTPs, and threat actor data from FalconFeeds.io with seamless integration across Claude Desktop, VS Code, and other MCP-enabled appl

Anywhere MCP Server

javierb507

AlienVault/USM Anywhere MCP Server - Threat intelligence and security monitoring

Basic Network Data Query Tool

qax-xlab

Core network security data includes PassiveDNS resolution records, domain and IP registration details, website certificate information, and IOC (Indicators of Compromise) database queries.