Mlab - IOC & Threat Intelligence MCP Server

@mlab-sh

代码仓库

基本信息

分类

开发工具

传输方式

stdio

作者

mlab-sh

提交者

Alice Snow

关于 Mlab - IOC & Threat Intelligence MCP Server

Threat intelligence MCP server for SOC analysts, DFIR and security researchers. Scan and enrich IOCs directly from Claude, Cursor or any MCP client: IP addresses (IPv4/IPv6), domains, file hashes and blockchain addresses. Search CVEs by keyword, vendor or product, retrieve full C

#security #threat-intelligence#ioc#cybersecurity #cve #vulnerability #malware#soc#dfir #osint#ip-reputation#threat-actors

Mlab - IOC & Threat Intelligence MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "mlab": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mlab.sh/mcp",
        "--header",
        "Authorization: Bearer mcp_xxx"
      ]
    }
  }
}

Mlab - IOC & Threat Intelligence MCP Server 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

点击上方按钮,在临时沙箱中运行此服务器并实时获取工具列表。

概览

What is Mlab - IOC & Threat Intelligence?

Mlab - IOC & Threat Intelligence is a remote MCP server that connects MCP-compatible clients like Claude and Cursor to the mlab.sh platform, providing real-time IOC scanning, vulnerability intelligence, and threat actor research for SOC analysts, DFIR teams, and security researchers. No local installation is required — it operates as a remote server accessible via a URL.

How to use Mlab - IOC & Threat Intelligence?

Configure your MCP client to point to the remote server URL https://mlab.sh/mcp and authenticate with a Mlab account (free tier available). For Claude Desktop, add the URL to claude_desktop_config.json under mcpServers. For Claude.ai (web), add it as a custom connector under Settings → Connectors. For other MCP clients, add a remote MCP server and authenticate.

Key features of Mlab - IOC & Threat Intelligence

17 tools covering IOC scanning, CVE search, and threat actors
Auto-detect indicator type with detect_ioc
Full domain scans and IP enrichment
Reverse CVE lookup for threat actors
Workspace bookmarks, scan history, and account info
Remote server — no npm or Docker needed

Use cases of Mlab - IOC & Threat Intelligence

Incident triage: extract IOCs from logs and check each against Mlab
Vulnerability watch: search critical CVEs and discover which actors exploit them
Threat actor research: build briefs on APT groups with TTPs and aliases
Real-time intelligence queries via AI assistant

常见问题

Do I need to install anything locally?

No. Mlab is a remote MCP server — zero npm, zero Docker, just a URL.

How do I authenticate and is there a free tier?

Authentication is done with a Mlab account. A free tier is available with no credit card required; quotas apply per organization.

What tools are available?

The server provides 17 tools including `detect_ioc`, `scan_ip`, `start_domain_scan`, `get_domain_scan_results`, `scan_crypto`, `cve_search`, `cve_detail`, `actors_by_cve`, `search_actors`, `get_actor`, `add_bookmark`, `remove_bookmark`, `get_bookmarks`, `get_scan_history`, `get_scan_limits`, `get_account_info`, and `hello_world`.

How can I check my remaining scan quotas?

Use the `get_scan_limits` tool to view your remaining scan quotas.

What are the system requirements?

A MCP-compatible client (e.g., Claude Desktop, Claude.ai, Cursor) and internet access. No local dependencies.

开发工具分类下的更多 MCP 服务器

offprompt

MCP server that lets Claude Code, Cursor or Codex ask you for API keys on a local page and write them to .env. The agent only ever sees key names.

Perfex CRM

themesic

Turn Perfex CRM into an AI-ready workspace. This MCP server exposes your full REST API to Claude, ChatGPT and any AI agent, so leads, invoices and tasks are one prompt away.

Vibgrate MCP

Vibgrate

Query your team's drift, vulnerability, and migration data from any AI assistant. Vibgrate MCP connects Cursor, Claude, ChatGPT, Windsurf, or VS Code to Vibgrate Cloud: 51 tools for DriftScores, CVEs and EOL runtimes, up

Yocoolab

MCP server for AI Agents — exposes Yocoolab feedback threads and design selections as tools

OrangePro

Aamir Siddiqui

OrangePro local-first CLI + MCP server for behavior mapping, grounded test generation, and dynamic proof.