MCP.Market

Threatintel MCP server

by aplaceforallmystuff·io.github.aplaceforallmystuff/mcp-threatintel·v1.0.1·8 stars
No reviews yet

Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker

B78/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B78/100

full report

Adoption
New

8 stars

Reviews

Write one

Nobody has reviewed Threatintel yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Threatintel tools (17)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • abuseipdb_check

    Check IP reputation on AbuseIPDB - returns abuse confidence score and recent reports

  • feodo_tracker

    Get active botnet C2 servers from Feodo Tracker (Emotet, Dridex, QakBot, etc.)

  • greynoise_ip

    Check if an IP is internet background noise or a targeted threat (GreyNoise)

  • malwarebazaar_hash

    Look up malware sample by hash on MalwareBazaar

  • malwarebazaar_recent

    Get recent malware samples from MalwareBazaar

  • malwarebazaar_tag

    Get malware samples by tag (e.g., 'emotet', 'cobalt-strike', 'ransomware')

  • otx_get_pulses

    Get recent threat intelligence pulses from AlienVault OTX

  • otx_search_pulses

    Search OTX pulses by keyword (malware name, campaign, threat actor)

  • threatfox_iocs

    Get recent IOCs from ThreatFox (C2 servers, malware infrastructure)

  • threatfox_search

    Search ThreatFox for IOCs by malware family or tag

  • threatintel_lookup_domain

    Look up a domain across threat intelligence sources (OTX, URLhaus)

  • threatintel_lookup_hash

    Look up a file hash (MD5, SHA1, SHA256) across threat intelligence sources (OTX, MalwareBazaar)

  • threatintel_lookup_ip

    Look up an IP address across all configured threat intelligence sources (OTX, AbuseIPDB, GreyNoise, Feodo Tracker)

  • threatintel_lookup_url

    Look up a URL for malware/phishing indicators (OTX, URLhaus)

  • threatintel_status

    Check which threat intelligence sources are configured. Currently available: …

  • urlhaus_lookup

    Check if a URL or domain is distributing malware (URLhaus)

  • urlhaus_recent

    Get recent malware URLs from URLhaus

Public scan report

scanner v0.1.10 · 2026-10-01 · same rubric, same numbers if you re-run it

no findings
  • Code scan3 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 50 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 78/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Threatintel compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
78/100
higher than 57% of 48,255 servers
Tools
17
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
8
more than 86% of 28,688 servers

What its tools let an agent do: 17 read

Install Threatintel in Claude Code, Cursor or VS Code

Runs npx -y mcp-threatintel-server on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add mcp-threatintel -- npx -y mcp-threatintel-server
Add to Cursor

What the publisher says

From the Threatintel repository's README, as published. We do not edit it. Read it on GitHub

MCP Threat Intel Server

MCP server providing unified access to multiple threat intelligence sources for security research and analysis.

Why Use This?

If you're doing security research, incident response, or threat analysis, this MCP server lets you:

  • Unified lookups - Query IPs, domains, hashes, and URLs across multiple sources simultaneously
  • Reduce context switching - No need to open multiple browser tabs for different intel sources
  • Correlate intelligence - See results from all configured sources in one response
  • Free tier friendly - Works with free API tiers, gracefully degrades when sources unavailable
  • Works without keys - Feodo Tracker (botnet C2s) works without any API keys

Features

Prerequisites

  • Node.js 18+
  • API keys for your preferred threat intelligence sources (see below)

Installation

Using npm (Recommended)

npx mcp-threatintel-server

Or install globally:

npm install -g mcp-threatintel-server

From Source

git clone https://github.com/aplaceforallmystuff/mcp-threatintel.git
cd mcp-threatintel
npm install
npm run build

Configuration

For Claude Desktop

Add to your Claude Desktop config file:

macOS: ~/Library/Application Support/Claude/claudedesktopconfig.json Windows: %APPDATA%\Claude\claudedesktopconfig.json

{
  "mcpServers": {
    "threatintel": {
      "command": "npx",
      "args": ["-y", "mcp-threatintel-server"],
      "env": {
        "OTX_API_KEY": "your-otx-api-key",
        "ABUSEIPDB_API_KEY": "your-abuseipdb-api-key",
        "GREYNOISE_API_KEY": "your-greynoise-api-key",
        "ABUSECH_AUTH_KEY": "your-abusech-auth-key"
      }
    }
  }
}

For Claude Code

Add to ~/.claude.json:

{
  "mcpServers": {
    "threatintel": {
      "command": "npx",
      "args": ["-y", "mcp-threatintel-server"],
      "env": {
        "OTX_API_KEY": "your-otx-api-key",
        "ABUSEIPDB_API_KEY": "your-abuseipdb-api-key",
        "GREYNOISE_API_KEY": "your-greynoise-api-key",
        "ABUSECH_AUTH_KEY": "your-abusech-auth-key"
      }
    }
  }
}

API Keys

Note: Tools are dynamically enabled based on which API keys you provide. Feodo Tracker works without authentication (public JSON feeds).

Usage Examples

Check Available Sources

"What threat intel sources are configured?"

"Show me threatintel status"

IP Investigation

"Check if 185.220.101.1 is malicious"

"Look up this IP across all threat intel sources"

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Threatintel: common questions

Is Threatintel MCP server safe?
Mostly: it is graded B (78/100). Read the Threatintel safety report
How do I install Threatintel?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Threatintel need an API key?
Yes. The registry entry asks for OTX_API_KEY, ABUSEIPDB_API_KEY, GREYNOISE_API_KEY, ABUSECH_AUTH_KEY.
Is Threatintel maintained?
The last commit was 84 days ago (2026-08-12). The latest release is v1.0.1.
How does Threatintel compare with other MCP servers?
safety score 78/100 (higher than 57% of 48,255 servers); tools 17 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

More from aplaceforallmystuff →