Enrichment MCP Server

Name: Enrichment MCP Server
Author: MSAdministrator

@MSAdministrator

代码仓库

关于 Enrichment MCP Server

A Model Context Protocol server for enriching data from multiple security products

#enrichment #security-tools #mcp-server

基本信息

分类

其他

运行时

python

传输方式

stdio

发布者

MSAdministrator

配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "enrichment-mcp": {
      "command": "uv",
      "args": [
        "run",
        "--env-file",
        ".env",
        "server.py"
      ]
    }
  }
}

工具

未检测到工具

工具是从 README 中自动提取的。维护者可以在 ## Tools 标题下列出工具,即可填充这部分内容。

概览

What is Enrichment MCP Server?

Enrichment MCP Server is a Model Context Protocol (MCP) server that performs third-party enrichment on a provided observable. It uses the security-cli Python package and configured services (such as VirusTotal, HybridAnalysis, and Shodan) to determine which enrichment services to call based on the observable type.

How to use Enrichment MCP Server?

Run locally with uv run --env-file .env server.py after creating a .env file with the required API keys. For use with Claude Desktop, add the server to your claude_desktop_config.json file under mcpServers, pointing command to the uv binary and passing the directory and server.py as arguments.

Key features of Enrichment MCP Server

Exposes a single lookup-observable tool that routes observables to the correct enrichment service
Supports VirusTotal, HybridAnalysis, AlienVault, Shodan, Urlscan.io, AbuseIPDB, and HaveIBeenPwned
Handles IP addresses, domains, URLs, and email addresses
Uses environmental variables for API key configuration
Customizable prompt templates via Jinja2 files in the templates directory
All enrichment services require API keys

Use cases of Enrichment MCP Server

Enrich an IP address with VirusTotal and Shodan from an MCP client
Look up a domain reputation using AlienVault and HybridAnalysis
Check if an email address appears in known data breaches via HaveIBeenPwned
Automate observable analysis within Claude Desktop using the exposed MCP tool

FAQ from Enrichment MCP Server

What services are supported?

VirusTotal, HybridAnalysis, AlienVault, Shodan, Urlscan.io, AbuseIPDB, and HaveIBeenPwned. All require API keys.

How do I configure API keys?

Set environmental variables in the format ENRICHMENT_MCP_VIRUSTOTAL_KEY, ENRICHMENT_MCP_HYBRIDANALYSIS_KEY, etc., and load them via a .env file when starting the server.

What observable types are supported?

Currently supported types: ipaddress, domain, url, and email. File hashes (md5, sha1, sha256) are defined but not yet implemented.

Where does enrichment data come from?

Data is fetched live from each configured third-party service. No local storage of results is implemented.

How do I run the server with Claude Desktop?

Add an entry to claude_desktop_config.json under mcpServers with the command pointing to uv, the directory path to the cloned repository, and the argument run server.py.