Enrichment MCP Server

@synackpwn

代码仓库

基本信息

分类

其他

传输方式

stdio

作者

synackpwn

关于 Enrichment MCP Server

A Model Context Protocol (MCP) server for security data enrichment

#enrichment #mcp#security-data

Enrichment MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "enrichment-mcp-synackpwn": {
      "command": "uv",
      "args": [
        "run",
        "--env-file",
        ".env",
        "server.py"
      ]
    }
  }
}

Enrichment MCP Server 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

工具是从 README 中自动提取的。维护者可以在 ## Tools 标题下列出工具,即可填充这部分内容。

概览

What is Enrichment MCP Server?

A Model Context Protocol (MCP) server that performs third-party enrichment on observables (IP addresses, domains, URLs, email addresses) using configured services such as VirusTotal, Hybrid Analysis, AlienVault, Shodan, Urlscan.io, AbuseIPDB, and HaveIBeenPwned. It is intended for development and testing, not production.

How to use Enrichment MCP Server?

Install uv, clone the repository, and configure Claude for Desktop with a custom config file pointing to the server. Alternatively, run locally with uv run --env-file .env server.py after creating a .env file with API keys and copying config.yaml.example to config.yaml. The server exposes tools like observable-lookup, lookup-ipaddress, lookup-domain, lookup-url, and lookup-email.

Key features of Enrichment MCP Server

Routes observables to appropriate enrichment services automatically.
Supports IPv4, domain, URL, and email lookups.
Integrates with VirusTotal, HybridAnalysis, AlienVault, Shodan, Urlscan.io, AbuseIPDB, and HaveIBeenPwned.
Uses a custom YAML config file for service and template management.
Prompt templates are written in Jinja2 and customizable.
All services require an API key, which can be set via environment variables.

Use cases of Enrichment MCP Server

Enrich an IP address with reputation data from multiple threat intelligence feeds.
Investigate a suspicious domain or URL using aggregated service results.
Assess an email address against HaveIBeenPwned’s breach database.
Automate observable enrichment for security analysts via Claude for Desktop.
Test and develop MCP-based enrichment workflows in a sandboxed environment.

常见问题

What services are supported and do they require API keys?

All supported services (VirusTotal, HybridAnalysis, AlienVault, Shodan, Urlscan.io, AbuseIPDB, HaveIBeenPwned) require an API key. Keys can be provided in a `.env` file using specific environment variable names (e.g., `ENRICHMENT_MCP_VIRUSTOTAL_KEY`).

Where are the API keys and configuration data stored?

API keys are stored in an environment file (`.env`) or optionally in `config.yaml`. The server itself does not store any data; third-party enrichment results are returned as prompts.

What transport does the server use?

The server is configured to run via the command line, typically launched by Claude for Desktop using the MCP stdio transport. The example Claude config specifies a command with arguments.

Are there any known limitations?

This project has not been used in production. The tool relies on regex patterns for observable type detection, which may need updates. Not all observable types (e.g., MD5, SHA1, SHA256) are currently implemented for enrichment.

What are the runtime requirements?

Python and `uv` (Astral’s package manager) are required. The server depends on a `.env` file for secrets and a `config.yaml` file for service and template configuration.

其他分类下的更多 MCP 服务器

EverArt

modelcontextprotocol

Model Context Protocol Servers

88.1K

Hindsight

vectorize-io

Hindsight: Agent Memory That Learns

50.4K

PickFu MCP

PickFu MCP is a Model Context Protocol (MCP) server that connects AI assistants, developers, marketers, product managers, and AI agents to PickFu's consumer research platform. It enables users to create surveys, conduct

Sequential Thinking