Mlab - IOC & Threat Intelligence MCP Server

@mlab-sh

代码仓库

基本信息

分类

开发工具

传输方式

stdio

作者

mlab-sh

提交者

Alice Snow

关于 Mlab - IOC & Threat Intelligence MCP Server

Threat intelligence MCP server for SOC analysts, DFIR and security researchers. Scan and enrich IOCs directly from Claude, Cursor or any MCP client: IP addresses (IPv4/IPv6), domains, file hashes and blockchain addresses. Search CVEs by keyword, vendor or product, retrieve full C

#security #threat-intelligence#ioc#cybersecurity #cve #vulnerability #malware#soc#dfir #osint#ip-reputation#threat-actors

Mlab - IOC & Threat Intelligence MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "mlab": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mlab.sh/mcp",
        "--header",
        "Authorization: Bearer mcp_xxx"
      ]
    }
  }
}

Mlab - IOC & Threat Intelligence MCP Server 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

点击上方按钮,在临时沙箱中运行此服务器并实时获取工具列表。

概览

What is Mlab - IOC & Threat Intelligence?

Mlab - IOC & Threat Intelligence is a remote MCP server that connects MCP-compatible clients like Claude and Cursor to the mlab.sh platform, providing real-time IOC scanning, vulnerability intelligence, and threat actor research for SOC analysts, DFIR teams, and security researchers. No local installation is required — it operates as a remote server accessible via a URL.

How to use Mlab - IOC & Threat Intelligence?

Configure your MCP client to point to the remote server URL https://mlab.sh/mcp and authenticate with a Mlab account (free tier available). For Claude Desktop, add the URL to claude_desktop_config.json under mcpServers. For Claude.ai (web), add it as a custom connector under Settings → Connectors. For other MCP clients, add a remote MCP server and authenticate.

Key features of Mlab - IOC & Threat Intelligence

17 tools covering IOC scanning, CVE search, and threat actors
Auto-detect indicator type with detect_ioc
Full domain scans and IP enrichment
Reverse CVE lookup for threat actors
Workspace bookmarks, scan history, and account info
Remote server — no npm or Docker needed

Use cases of Mlab - IOC & Threat Intelligence

Incident triage: extract IOCs from logs and check each against Mlab
Vulnerability watch: search critical CVEs and discover which actors exploit them
Threat actor research: build briefs on APT groups with TTPs and aliases
Real-time intelligence queries via AI assistant

常见问题

Do I need to install anything locally?

No. Mlab is a remote MCP server — zero npm, zero Docker, just a URL.

How do I authenticate and is there a free tier?

Authentication is done with a Mlab account. A free tier is available with no credit card required; quotas apply per organization.

What tools are available?

The server provides 17 tools including `detect_ioc`, `scan_ip`, `start_domain_scan`, `get_domain_scan_results`, `scan_crypto`, `cve_search`, `cve_detail`, `actors_by_cve`, `search_actors`, `get_actor`, `add_bookmark`, `remove_bookmark`, `get_bookmarks`, `get_scan_history`, `get_scan_limits`, `get_account_info`, and `hello_world`.

How can I check my remaining scan quotas?

Use the `get_scan_limits` tool to view your remaining scan quotas.

What are the system requirements?

A MCP-compatible client (e.g., Claude Desktop, Claude.ai, Cursor) and internet access. No local dependencies.

开发工具分类下的更多 MCP 服务器

Banking Assistant (Metabind demo)

Metabind

Interactive MCP App demo built on Metabind: personal-finance answers render as UI cards (net worth, spending, subscriptions) in Claude and ChatGPT, and natively in iOS/Android apps.

Casefile

azimov777

One case file per task — shared by every session, agent and person that touches it. Self-hosted MCP server and live board. MIT.

Agent Conductor

icohangar-ops

Agent conductor — AGENTS.md contract parser, SKILL.md registry, CHP decision engine over MCP

Mcp-Warden

ermoluk

Local-first credential broker for MCP. AI coding agents (Claude Code, Cursor, Codex…) call APIs, SSH and databases through scoped presets; secrets stay in your OS keychain and never enter the agent's context.

OrangePro

Aamir Siddiqui

OrangePro local-first CLI + MCP server for behavior mapping, grounded test generation, and dynamic proof.