Threatcluster MCP server

Threat Intelligence MCP Server

An MCP server that gives Claude, Cursor, VS Code, Windsurf, Zed and any other MCP client live threat intelligence from ThreatCluster: incident clusters (one deduplicated story per incident, with a threat score, timeline and extracted entities), entity profiles (actors, malware, tools, vendors, CVEs), CVE records with KEV / EPSS / exploit status, and ransomware leak-site victims.

It is a thin, auditable wrapper over the public REST API. Every tool call is one or two GETs to https://threatcluster.io/api/public/v1 with your API key; nothing else leaves your machine, and there is no telemetry.

Published twice from one tool spec, so both are identical:

1. Get a key

Free keys carry the five read scopes, 100 credits a day, 30 requests a minute and a 7-day lookback: . Put it in THREATCLUSTERAPIKEY. If you use the tc CLI and have run tc auth login, the Python server picks that credential up automatically (keyring or the ~/.config/tc-cli/credentials file); the Node server reads the file only.

2. Add the server

Claude Code

claude mcp add threatcluster -e THREATCLUSTER_API_KEY=tc_live_... -- npx -y threatcluster-mcp
# or the Python build:
claude mcp add threatcluster -e THREATCLUSTER_API_KEY=tc_live_... -- uvx threatcluster-mcp

Claude Desktop (claudedesktopconfig.json, Settings > Developer > Edit Config)

{
  "mcpServers": {
    "threatcluster": {
      "command": "npx",
      "args": ["-y", "threatcluster-mcp"],
      "env": { "THREATCLUSTER_API_KEY": "tc_live_..." }
    }
  }
}

Cursor — one-click: see listings/cursor-deeplink.md, or add to ~/.cursor/mcp.json / .cursor/mcp.json:

{ "mcpServers": { "threatcluster": { "command": "npx", "args": ["-y", "threatcluster-mcp"], "env": { "THREATCLUSTER_API_KEY": "tc_live_..." } } } }

VS Code (.vscode/mcp.json; the input prompts for the key instead of storing it in the file)

{
  "inputs": [{ "type": "promptString", "id": "tc-key", "description": "ThreatCluster API key", "password": true }],
  "servers": {
    "threatcluster": { "type": "stdio", "command": "npx", "args": ["-y", "threatcluster-mcp"], "env": { "THREATCLUSTER_API_KEY": "${input:tc-key}" } }
  }
}

Windsurf (~/.codeium/windsurf/mcp_config.json) — same mcpServers block as Claude Desktop.

Zed (settings.json)

{ "context_servers": { "threatcluster": { "command": { "path": "npx", "args": ["-y", "threatcluster-mcp"], "env": { "THREATCLUSTER_API_KEY": "tc_live_..." } } } } }

Check a configuration without starting a client: THREATCLUSTERAPIKEY=... npx -y threatcluster-mcp --check (prints where the key came from and where it will be sent — never the key).

3. Tools

Costs are ThreatCluster API credits (free keys: 100 a day). Every result carries cost (credits this call spent), budget (remaining today, from the response headers), as_of, and url fields on every cluster, entity, victim and CVE for citation.

Shortened. The full README is on GitHub.