15 #threat-intelligence MCP Servers & Clients
Every MCP server and client below is tagged #threat-intelligence — install one to give Claude, Cursor, VS Code, or any other MCP-compatible client access to threat-intelligence tools.
All
MISP MCP Server
bornpresident
A Model Context Protocol (MCP) server that integrates with the MISP (Malware Information Sharing Platform) to provide threat intelligence capabilities to Large Language Models.
ORKL MCP Server
heiths
MCP server for ORKL Threat Intelligence Library
ThreatNews
xue20010808
MCP server for Threat info collection in cyber security
🧠 AgentNull: AI System Security Threat Catalog + Proof-of-Concepts
jaschadub
AgentNull: AI System Security Threat Catalog + Proof-of-Concepts. Collection of PoCs for using Agents, MCP, and RAG in bad ways.
Mlab - IOC & Threat Intelligence
mlab-sh
Threat intelligence MCP server for SOC analysts, DFIR and security researchers. Scan and enrich IOCs directly from Claude, Cursor or any MCP client: IP addresses (IPv4/IPv6), domains, file hashes and blockchain addresses. Search CVEs by keyword, vendor or product, retrieve full C
Kaspersky Opentip Mcp Server
KasperskyLab
Kaspersky OpenTIP Model Context Protocol Server
MCP Threat Intel ORKL
fr0gger
This is a threat intel MCP server connected to the ORKL API to retrieve threat report and ask for IOCs, Threat Actors and breaches.
Microsoft Sentinel MCP Server
dstreefkerk
MCP server for Microsoft Sentinel. Enables access to Sentinel logs, incidents, analytics, and Entra ID data via a modular, queryable interface. Strictly non-production. Designed for use with Claude and other LLMs.
Virustotal Mcp
yassinech-99
MCP server that enables LLMs to interact with the VirusTotal API for malware analysis, URL scanning, and threat intelligence.
Whois, Dns, Ssl, And Domain Availability Lookups For Ai Assistants
Whoisjson
WhoisJSON MCP Server exposes four domain intelligence tools directly inside Claude, Cursor, and Windsurf — no code required.
Sentinelx402
splitfireai-hue
Real-time phishing detection, IP reputation, and CVE risk analysis API for AI agents. Powered by live threat feeds (OpenPhish, Feodo Tracker, URLhaus). Pay per request via x402 micropayments (USDC on Base). First 1,000 requests free, no signup required.
Whoisxml Api
whois-api-llc
FalconFeeds MCP server
Technisanct
Connect real-time cybersecurity threat intelligence to your AI workflows through standardized tools and resources. Access comprehensive IOCs, CVEs, TTPs, and threat actor data from FalconFeeds.io with seamless integration across Claude Desktop, VS Code, and other MCP-enabled appl
Basic Network Data Query Tool
qax-xlab
Core network security data includes PassiveDNS resolution records, domain and IP registration details, website certificate information, and IOC (Indicators of Compromise) database queries.
Anywhere MCP Server
javierb507
AlienVault/USM Anywhere MCP Server - Threat intelligence and security monitoring
Frequently asked questions
What is a #threat-intelligence MCP server?
- An MCP server tagged #threat-intelligence implements the Model Context Protocol so AI assistants like Claude, Cursor, and VS Code can access threat-intelligence-related tools, data, or APIs.
How many #threat-intelligence MCP servers and clients are there?
- mcp.so currently lists 15 MCP servers and clients tagged #threat-intelligence.
How do I install a #threat-intelligence MCP server?
- Open any server below and copy its install snippet into Claude Desktop, Cursor, VS Code, or another MCP client's configuration — remote servers need no separate download.