15 个#threat-intelligence MCP 服务器和客户端

MISP MCP Server

bornpresident

A Model Context Protocol (MCP) server that integrates with the MISP (Malware Information Sharing Platform) to provide threat intelligence capabilities to Large Language Models.

ThreatNews

xue20010808

MCP server for Threat info collection in cyber security

ORKL MCP Server

heiths

MCP server for ORKL Threat Intelligence Library

🧠 AgentNull: AI System Security Threat Catalog + Proof-of-Concepts

jaschadub

AgentNull: AI System Security Threat Catalog + Proof-of-Concepts. Collection of PoCs for using Agents, MCP, and RAG in bad ways.

Virustotal Mcp

yassinech-99

MCP server that enables LLMs to interact with the VirusTotal API for malware analysis, URL scanning, and threat intelligence.

Mlab - IOC & Threat Intelligence

mlab-sh

Threat intelligence MCP server for SOC analysts, DFIR and security researchers. Scan and enrich IOCs directly from Claude, Cursor or any MCP client: IP addresses (IPv4/IPv6), domains, file hashes and blockchain addresses. Search CVEs by keyword, vendor or product, retrieve full C

Real-time phishing detection, IP reputation, and CVE risk analysis API for AI agents. Powered by live threat feeds (OpenPhish, Feodo Tracker, URLhaus). Pay per request via x402 micropayments (USDC on Base). First 1,000 requests free, no signup required.

Microsoft Sentinel MCP Server

dstreefkerk

MCP server for Microsoft Sentinel. Enables access to Sentinel logs, incidents, analytics, and Entra ID data via a modular, queryable interface. Strictly non-production. Designed for use with Claude and other LLMs.

FalconFeeds MCP server

Technisanct

Connect real-time cybersecurity threat intelligence to your AI workflows through standardized tools and resources. Access comprehensive IOCs, CVEs, TTPs, and threat actor data from FalconFeeds.io with seamless integration across Claude Desktop, VS Code, and other MCP-enabled appl

Basic Network Data Query Tool

qax-xlab

Core network security data includes PassiveDNS resolution records, domain and IP registration details, website certificate information, and IOC (Indicators of Compromise) database queries.

This is a threat intel MCP server connected to the ORKL API to retrieve threat report and ask for IOCs, Threat Actors and breaches.

WhoisJSON MCP Server exposes four domain intelligence tools directly inside Claude, Cursor, and Windsurf — no code required.

Kaspersky Opentip Mcp Server

KasperskyLab

Kaspersky OpenTIP Model Context Protocol Server

Anywhere MCP Server

javierb507

AlienVault/USM Anywhere MCP Server - Threat intelligence and security monitoring