{"name":"io.github.threadlinqs-cmd/intelthreadlinqs-mcp","slug":"threadlinqs-cmd-intelthreadlinqs-mcp","title":null,"description":"Threadlinqs threat-intelligence MCP — 49 tools: threats, detections, IOCs, actors, C2, MITRE, CVEs","url":"https://mcp.market/server/threadlinqs-cmd-intelthreadlinqs-mcp","rating":null,"grade":"B","score":75,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":19,"stars":0,"forks":0,"downloads_week":53,"last_push_at":"2026-08-23T21:21:55.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/threadlinqs-cmd/intelthreadlinqs-mcp","website":null,"version":"7.1.3","remotes":[],"packages":[{"registryType":"npm","identifier":"intelthreadlinqs-mcp","version":"7.1.3","transport":{"type":"stdio"},"environmentVariables":[{"description":"Threadlinqs API key (Purple or Gold tier, tl_...) — get one at https://intel.threadlinqs.com/profile","isRequired":true,"format":"string","isSecret":true,"name":"THREADLINQS_API_KEY"},{"description":"Override the API base URL (defaults to https://intel.threadlinqs.com)","format":"string","name":"THREADLINQS_API_URL"}]}],"tools":[{"name":"bulk_get_cves","description":"Fetch multiple CVE details in a single call. Returns enriched CVE data with CVSS, EPSS, KEV status, and linked threats. Max 20 IDs per call.","write_action":false,"price_micros":0,"input_schema":null},{"name":"bulk_get_threats","description":"Fetch multiple threats by ID in a single call. Returns full threat objects with flat MITRE arrays. Max 20 IDs per call. Use this instead of calling get_threat N times in parallel.","write_action":false,"price_micros":0,"input_schema":null},{"name":"enrich_iocs","description":"Get enrichment metadata for IOCs — cross-references with ThreatFox, MalwareBazaar, AbuseIPDB/IPsum, and DNS data. Returns enrichment status and any matching threat intelligence from external feeds.","write_action":false,"price_micros":0,"input_schema":null},{"name":"export_detection","description":"Export a specific detection rule in a chosen format — returns the raw SPL query, KQL query, Sigma YAML, or full JSON with all metadata.","write_action":false,"price_micros":0,"input_schema":null},{"name":"generate_c2_blocklist","description":"Generate a firewall-ready C2 IOC blocklist from active beacons. Filter by framework (cobalt-strike, sliver, etc.), recency window, and output format. Returns CIDR list (default), hosts file, or plain IP list. Requires Purple tier ($11.99/mo).","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_actor_intelligence","description":"Composite actor intelligence — actor_profile + active C2 infrastructure + cross-actor shared entities (from corr_attribution) + recent threat activity timeline. Single call for full adversary picture. Requires Purple tier ($11.99/mo).","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_actor_profile","description":"Get a lean threat actor profile. Requires Purple tier ($11.99/mo). Returns: actor metadata + attribution counts + attributed-threat summary rows + MITRE tactic rollup with technique ids + IOC category counts (no raw values) + CVE/CWE/tool summaries + relationships. For heavy detail use follow-up tools: get_threat(id), get_detections(threat_id) / get_detection_detail, search_iocs.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_c2_configs","description":"Get full C2 beacon configurations — sleep times, jitter, user agents, spawnto paths, kill dates, crypto schemes, domain fronting details, and aggregate statistics.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_c2_cross_correlations","description":"Get C2 cross-intelligence correlations — IP matches, tag matches, MITRE technique overlaps, domain fronting detection, behavioral fingerprints, and watermark clusters across beacons.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_c2_operators","description":"Get C2 operator cluster analysis — behavioral fingerprints, shared infrastructure, and attributed operator groups.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_c2_stats","description":"Get C2 intelligence statistics — framework distribution, geographic spread, watermark clusters, and operator activity summary.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_c2_timeline","description":"Get C2 beacon timeline — monthly version distribution showing C2 framework evolution over time.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_c2_watermarks","description":"Get C2 watermark clusters — groupings of beacons sharing the same Cobalt Strike watermark, indicating shared operator or license.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_campaign_intelligence","description":"Pivot on a named campaign / operation by name (e.g. Snowflake campaign, ClickFix). Returns the threats in the campaign, the actors involved, prevalence, and common ATT&CK techniques.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_changelog","description":"Get the platform changelog — recent updates, new features, bug fixes, and improvements.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_correlation_engine","description":"Get detailed data from a specific correlation engine. Engines: mitre-heatmap (technique risk scores), adversary-infra (threat actor infrastructure), ioc-consensus (cross-source IOC validation), cve-velocity (exploit timeline analysis), attribution (cross-actor shared entities), detection-debt (uncovered technique gaps), enrichment (data source health).","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_correlations_overview","description":"Get advanced correlations overview — aggregated intelligence from 7 correlation engines: MITRE heatmap, adversary infrastructure, IOC consensus, CVE velocity, attribution network, detection debt, and enrichment overview.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_cve_details","description":"Look up details for a specific CVE identifier. Returns description, severity, CVSS score, affected products, references, and linked threats.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_cve_intelligence","description":"Composite CVE dossier — CVE detail + linked threats + EPSS exploitation velocity + KEV status + detection coverage % + simulation availability + exploitation timeline. Requires Purple tier ($11.99/mo).","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_cwe_details","description":"Look up details for a specific CWE identifier. Returns weakness name, description, severity, related CVEs, and mitigation guidance.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_daily_intel_bundle","description":"One-shot daily intelligence bundle — combines latest debrief + platform stats + top threats with detail + correlations overview in a single response. Replaces 7+ workflow nodes. This is the ideal starting point for any 'what happened today' analysis.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_debrief","description":"Get a specific daily debrief by date. Returns full briefing with threat summaries, MITRE techniques covered, IOC breakdown, detection coverage, and threat actor activity. Use fallback='latest' if the requested date may not have a published debrief yet.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_detection_detail","description":"Get full details for a specific detection rule by ID — includes query content (SPL/KQL/Sigma), MITRE ATT&CK mapping, data sources, false positive guidance, confidence level, and associated threat.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_detections","description":"Get detection rules with filtering. Filter by threat ID, detection type (spl/kql/sigma), severity, or keyword search. Returns detection name, query/rule content, severity, confidence, data sources, and MITRE mappings.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_enrichment_overview","description":"Get enrichment source health overview — hit rates, coverage percentages, and data freshness across all enrichment sources (NVD, EPSS, CISA KEV, MITRE CWE, ThreatFox, MalwareBazaar, IPsum, DNS, GitHub GHSA). Use this to assess data quality and identify enrichment gaps.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_ioc_dns","description":"Get passive DNS enrichment data for a specific IOC value (IP, domain, or URL). Returns DNS resolution history, reverse lookups, and infrastructure mapping. If the IOC has no DNS data, returns {known: false} instead of an error.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_ioc_intelligence","description":"Given an IOC (IP, domain, hash, URL), return a complete dossier: all threats touching it + actor attribution + DNS enrichment trail + infrastructure pivots (cross-IOC links) + corr_ioc_consensus confidence score from 7 external feeds (Pulsedive, GreyNoise, Yaraify, MalwareBazaar, URLScan, VxVault, OpenPhish). Powers 'I found this in a log — tell me everything' workflows. Requires Purple tier ($11.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_latest_debrief","description":"Get the most recent published daily debrief regardless of date. Use this when you don't know the exact date or want today's/yesterday's briefing without guessing. Returns the full debrief with its actual_date field.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_malware_intelligence","description":"Pivot on a malware FAMILY by name (e.g. LockBit, Vidar, Emotet). Returns the canonical family + type, prevalence (threat/actor counts, first/last seen), the threats deploying it, the actors using it, and its most-common ATT&CK techniques. For an offensive TOOL (Cobalt Strike, Mimikatz) use get_tool_intelligence. Use resolve_entity first if unsure of the canonical name.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_mitre_coverage","description":"Get MITRE ATT&CK framework coverage — all techniques and tactics mapped across the threat intelligence database with detection coverage statistics.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_mitre_gap_analysis","description":"Prioritized list of uncovered MITRE techniques sorted by detection debt score (combines threat exposure + KEV exposure + EPSS). Each entry includes threat examples + recommended detection types to deploy. Powers 'what should I write detections for next?' workflows. Requires Purple tier ($11.99/mo).","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_mitre_technique","description":"Get detailed information about a specific MITRE ATT&CK technique — its mitigations, detection data sources, parent technique, and the threats that map to it.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_platform_stats","description":"Get current platform statistics — total threats, detections, IOCs, MITRE coverage, category breakdown, and operational status.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_recent_threats","description":"Get the most recently published threats on the platform, ordered by creation date descending.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_roadmap","description":"Get the platform roadmap — planned features, ideas in progress, and completed items with priorities and status.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_similar_threats","description":"Find threats similar to a given threat by precomputed similarity score (shared TTPs / IOC overlap / actor attribution). Requires Purple tier ($11.99/mo). Reveals lateral threats the LLM otherwise wouldn't surface.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_threat","description":"Get full details for a specific threat by ID. Returns complete threat intelligence: summary, description, severity, CVSS scores, attribution, CVEs/CWEs, MITRE mappings, timeline, IOCs, detections, tags, and references.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_threat_bundle","description":"One-shot threat intelligence bundle — combines threat detail + simulations + IOCs + transcripts + flat MITRE arrays in a single response. Replaces 4 separate tool calls. Use instead of calling get_threat + get_threat_simulations + search_iocs + get_threat_transcripts individually.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_threat_enrichment","description":"Reference-grounded enrichment for one threat by ID: the malware families and tools used, targeted sectors/regions, affected operating systems, named campaigns, AI/ML (ATLAS) techniques, and per-technique mitigations + detection data sources. Complements get_threat (overview/MITRE/IOCs/detections) — call this for the 'what malware/tools were used and who was targeted' view.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_threat_hunting_bundle","description":"FLAGSHIP PURPLE TOOL. Single-call complete threat dossier — wraps threat detail + IOCs + detection queries + similar threats + simulation commands + infrastructure pivots (cross-threat IOC links + DNS trail) into one response. Saves 5-7 MCP round-trips. Requires Purple tier ($11.99/mo).","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_threat_simulations","description":"Get all simulation commands for a specific threat. Returns detailed simulation steps with platform-specific commands (PowerShell, Bash, Python), MITRE mappings, caution levels, and requirements.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_threat_transcripts","description":"Get agent analysis transcripts for a threat — multi-agent intelligence reports with phases, signals, participant roles, and summary assessments.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_tool_intelligence","description":"Pivot on an offensive tool / utility / RMM / LOLBin by name (e.g. Cobalt Strike, Mimikatz, AnyDesk, PsExec). Returns the canonical tool + class, prevalence, the threats and actors using it, and its most-common ATT&CK techniques.","write_action":false,"price_micros":0,"input_schema":null},{"name":"health","description":"Lightweight health check — returns server status, version, uptime, key stats, and API key validity. Sub-second response, no heavy queries. Use this instead of get_platform_stats for liveness probes.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_c2_beacons","description":"List Wild C2 beacons — command-and-control infrastructure intelligence including framework identification, watermark analysis, and geolocation.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_debriefs","description":"List all daily intelligence debriefs. Returns dates, threat counts, and summary information for each briefing.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_simulations","description":"List all attack simulation scenarios available on the platform. Returns threats with simulation counts, platforms (windows/linux/python), severity, and threat actor attribution.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_threat_categories","description":"List all threat categories with counts. Returns category names and how many threats belong to each.","write_action":false,"price_micros":0,"input_schema":null},{"name":"predict_attack_path","description":"Given a MITRE technique, predict the most likely next techniques based on observed chains across 160+ threats. Returns top-N transitions with probability + transition_count + example threats per branch. Powers attack-chain reasoning. Requires Purple tier ($11.99/mo).","write_action":false,"price_micros":0,"input_schema":null},{"name":"resolve_entity","description":"Normalize an actor / malware / tool / sector / region / technique name or alias to its canonical reference form + stable UUID (e.g. 'fancy bear' → 'APT28'). Call this BEFORE pivoting (get_actor / get_malware_intelligence / get_tool_intelligence / search_threats) when unsure of the canonical name. Optional type narrows the lookup.","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_actors","description":"Search threat actors by name, alias, nation-state, or motivation. Requires Purple tier ($11.99/mo). Returns actors with threat_count, severity_levels, categories, and nation_state.","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_detections","description":"Search detection rules by keyword — matches against detection names and descriptions. Filter by type and severity. WHEN TO USE: for finding detections by topic (e.g. 'ransomware', 'lateral movement', 'credential dumping'). To list every detection for a specific threat, use get_detections(threat_id=...) instead. Returns has_more/next_offset for paging.","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_iocs","description":"Search indicators of compromise — IPs, domains, hashes, URLs, behavioral indicators. Filter by IOC type category.","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_threats","description":"Deterministic threat-catalog search. Returns LEAN rows {id, title, severity, category, status, threat_actor, nation_state, affected_products, cves, cvss_score, summary, created} — call get_threat for full detail. Combine free-text `query` with any structured filters; ALL filters AND-combine (e.g. query=\"supply chain\" + threat_actor=\"TeamPCP\" + category=\"SUPPLY_CHAIN\"). Paginated via limit + offset","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":75,"grade":"B","scanned_at":"2026-09-25T17:26:03.466Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-25T17:26:03.339Z","components":{"code":{"score":25,"max":25,"notes":["3 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":12,"max":15,"notes":["last push 33 days ago"]},"identity":{"score":6,"max":10,"notes":["registry namespace matches repository owner"]}},"findings":[],"inputs":{"packages":[{"registryType":"npm","identifier":"intelthreadlinqs-mcp","version":"7.1.3","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":2,"publishedAt":"2026-07-18T20:37:19.967Z","repositoryUrl":"git+https://github.com/threadlinqs-cmd/intelthreadlinqs-mcp.git","weeklyDownloads":53}],"repo":{"found":true,"owner":"threadlinqs-cmd","repo":"intelthreadlinqs-mcp","archived":false,"pushedAt":"2026-08-23T21:21:55Z","stars":0,"forks":0,"openIssues":1,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/238787130?v=4","ownerCreatedAt":"2025-10-18T02:09:30Z","license":"MIT"},"icon":{"url":"https://avatars.githubusercontent.com/u/238787130?v=4&s=128","source":"github"},"presence":{"stars":0,"forks":0,"downloadsWeek":53,"license":"MIT","lastPushAt":"2026-08-23T21:21:55.000Z","score":19}}}},"grade_history":[],"reviews":[]}