@Deltabridge
Basic information
Transport
Streamable HTTP
Authentication
OAuth
Last updated
Category
AI & Agents
Author
Deltabridge
Submitted by
Mayan Stegmann
Deltabridge is an AI threat intelligence platform for security teams. Athena, its AI analyst, turns 300+ public sources into intelligence briefs, answers questions across a connected threat graph and enriches IOCs. Its remote MCP server gives Claude, ChatGPT, Cursor and other agents secure OAuth access to your briefs, threat actors, malware, CVEs, ATT&CK techniques and indicators.
https://mcp.deltabridge.aiclaude mcp add deltabridge-threat-intelligence --transport http https://mcp.deltabridge.aiSearch the Intel Graph across every entity type at once. Suited to names that could be a threat actor, a malware family, a campaign or a tool. Optionally narrow with `entity_types` (STIX types, e.g. `["threat-actor", "malware"]`).
Find threat actors and intrusion sets by name or alias. Covers STIX `:ThreatActor` (a named group) and `:IntrusionSet` (clustered activity, how MITRE models APT28, Lazarus, ShinyHunters), with the ATT&CK techniques attributed to each. Search one name per call.
Find malware families and tools by name or alias, with their known relationships (who uses it, what it targets). Search one name per call.
Find CVEs by identifier, vendor or product, with CISA KEV status and remediation deadline where known, and who has been seen exploiting them.
Find MITRE ATT&CK techniques by id (e.g. `T1566`) or name, with the actors known to use each one.
Search indicators of compromise by substring. `indicator_type` is `ipv4-addr`, `domain-name`, `url`, `file`, `email-addr` or `any`.
Look up one exact IOC (IP, domain, URL or file hash) in the Intel Graph, with the threat actors and malware it is linked to. A graph lookup, not a live reputation check.
Fetch one Intel Graph entity in full by its STIX id, as returned in search results (e.g. `intrusion-set--…`).
Traverse the Intel Graph outward from one entity: `{nodes, edges}` for pivoting from an actor to its malware, an IOC to its campaign, and so on. `depth` is capped at 3 hops and `limit` at 200 nodes.
Shortest path in the Intel Graph between two entities: "is this actor connected to that malware, and how". Empty when there's no path within `max_depth` (capped at 10).
An entity's ATT&CK techniques grouped by tactic (the kill-chain view), for coverage-gap analysis against your detections.
Everything needed to write detections for an Intel Graph entity: its name and type, up to 50 associated observables and up to 20 ATT&CK techniques, as input for Sigma, KQL, SPL or other detection rules.
Search Deltabridge intelligence briefs by title, summary and tags, newest first with a short summary. For recent activity pass `since_hours` (24 = the last day), with or without a query; keyword results alone are not a list of recent briefs.
One intelligence brief in full: narrative, timeline, impact assessment, technical details, response recommendations and IOCs.
The full ATT&CK Enterprise matrix for the view to draw.
Enrich an IOC against live reputation sources using your organisation's own VirusTotal, AbuseIPDB and AlienVault OTX keys (set in Settings, Integrations; unconfigured providers are skipped). IPs also get GeoIP, WHOIS and reverse DNS. Results are written to the matching Intel Graph node, which is why this needs the `enrich` scope. `type` is `ip`, `domain`, `url`, `hash` or `auto`.
Read a public web page (an advisory, a vendor write-up) and extract its indicators of compromise. The indicators are saved to the Intel Graph as your organisation's private nodes, so later lookups find them. Returns the page text (truncated) and the IOCs found.
The workspaces you can open, default first, each with the `id` that the `workspace_id` parameters accept.
Your Athena threads (and your team's shared ones), most recently updated first.
One Athena thread: its title and the most recent messages (user questions and Athena's answers), oldest first.
Scheduled Athena prompts (recurring briefings and watches): what each asks, how often it runs, and when it last and next runs.
Recent runs of one schedule, newest first, with each run's summary and the id of the thread its output went to.
Threat Radar assessments (forward-looking forecasts), newest first, with each one's summary and confidence.
One Threat Radar assessment in full: the forecast, key judgements, sources, sectors, regions and time horizon.
AI threat intelligence for security teams, and for the AI agents they use.
Deltabridge reads the threat landscape so your team doesn't have to. It monitors 300+ public sources, including threat feeds, vendor advisories, vulnerability databases and security research, and turns them into intelligence you can act on.
Connect your own AI tools to Deltabridge through its remote MCP server.
| Endpoint | https://mcp.deltabridge.ai |
| Transport | Streamable HTTP |
| Auth | OAuth 2.1, approved per client; admins can revoke access |
| Clients | Claude, ChatGPT, Cursor, VS Code and any MCP client |
What agents can do
Two tools write to your workspace: indicator enrichment, and saving a public URL to your library. Everything else is read-only.
Built-in prompts: entity profile, IOC investigation, CVE exposure, sector brief.
MCP access is included on Researcher (2,000 tool calls a day), Business (10,000 per organisation) and Enterprise (unlimited). Start with a 14-day Business trial.
The Deltabridge Threat Intelligence remote MCP server is a hosted Model Context Protocol endpoint at https://mcp.deltabridge.ai, so AI assistants can connect to it without installing or running anything locally.
Add the endpoint https://mcp.deltabridge.ai to any MCP-compatible client such as Claude Code, Cursor, or VS Code. The setup snippets on this page configure each client in one step.
Yes. Deltabridge Threat Intelligence uses OAuth: the first time you connect, your MCP client opens a browser window to sign in and authorize access, then reuses the credentials for future sessions.
Deltabridge Threat Intelligence exposes a Streamable HTTP endpoint, the transport used by remote MCP servers and supported by all major MCP clients.
APIR is the evidence record for AI agents
Hosted AdLoop: Google Ads, Reddit Ads, GA4 and Tag Manager in claude.ai, ChatGPT and more, with a preview before every change.
Pay-per-use data and tools for AI agents: crypto token safety and rug checks, web search with cited answers, page-to-Markdown, up-to-date library docs, package safety, company research and UK/EU open data. 160 tools, 20
ARVX™ reads client relationship health using the science of why partnerships last. It models two people, factors in what's influencing each of them, and reads their relationship across five areas, with what moved since t
App Store keyword research, rank tracking, competitor analysis and authorized performance data.
Comments