What does MCP Threat Intel ORKL do?
It provides MCP tools to query the ORKL API for threat reports, threat actors, and sources, enabling integration with MCP-compatible applications like Claude.
M
MCP Threat Intel ORKL
@fr0gger
Basic information
About MCP Threat Intel ORKL
This is a threat intel MCP server connected to the ORKL API to retrieve threat report and ask for IOCs, Threat Actors and breaches.
MCP Threat Intel ORKL config
Add this server to your MCP-compatible client using the configuration below.
{
"mcpServers": {
"orkl": {
"command": "uv",
"args": [
"--directory",
"/MyMCP/mcptest/orkl",
"run",
"orkl"
]
}
}
}MCP Threat Intel ORKL tools
Tool list not available yet
This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.
We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.
Overview
What is MCP Threat Intel ORKL?
MCP Threat Intel ORKL is a Model Context Protocol (MCP) server for querying the ORKL API. It provides tools for fetching and analyzing threat reports, threat actors, and sources, and integrates smoothly with MCP-compatible applications.
How to use MCP Threat Intel ORKL?
Edit or create the Claude desktop config file (claude_desktop_config.json) to add the server configuration with the command uv and the arguments --directory /path/to/orkl run orkl. The server is then available in MCP-compatible clients.
Key features of MCP Threat Intel ORKL
- Fetch latest threat reports with titles and IDs
- Retrieve detailed information for a specific threat report
- Fetch a list of known threat actors
- Get detailed information for a specific threat actor
- Fetch a list of sources used in threat intelligence
- Retrieve detailed metadata for a specific source
Use cases of MCP Threat Intel ORKL
- Automate retrieval of recent threat intelligence reports for analysis
- Quickly look up details on a specific threat actor during an investigation
- Enumerate known sources of threat intelligence for research
- Integrate ORKL data into a GenAI assistant for security reporting
Frequently asked questions
How do I install MCP Threat Intel ORKL?
Add the provided JSON configuration to your Claude desktop config file, specifying the path to the server directory and using `uv` to run the `orkl` command.
What runtime dependencies does MCP Threat Intel ORKL require?
The server is run via `uv`, which implies Python and the `uv` package manager are required. The exact Python version is not specified in the README.
Where does the threat intelligence data come from?
All data is fetched from the ORKL API. No local data storage is mentioned.
Does MCP Threat Intel ORKL require authentication?
The README does not mention any authentication requirements for the ORKL API or the MCP server itself.
More Developer Tools MCP servers
Termany
thinkany-aiAgent-Native Terminal
174
LastPing
LastPingKnow when your AI agents, cron jobs and CI pipelines fail, stall or go quiet. Your agent sets up monitors from a plain description, tells you what is broken and why, reads run history and traces, and writes notes on inci
Kilobat
seifipOpen-source Mac network diagnostics for AI agents and humans. Check connectivity, Wi-Fi, hotspots and traffic from the terminal or MCP.
Vibgrate MCP
VibgrateQuery your team's drift, vulnerability, and migration data from any AI assistant. Vibgrate MCP connects Cursor, Claude, ChatGPT, Windsurf, or VS Code to Vibgrate Cloud: 51 tools for DriftScores, CVEs and EOL runtimes, up
3
offprompt
offpromptMCP server that lets Claude Code, Cursor or Codex ask you for API keys on a local page and write them to .env. The agent only ever sees key names.
2
Comments