Intelthreadlinqs MCP server

Read from the package source without running it. The installed server may list more.

• bulk_get_cves

  Fetch multiple CVE details in a single call. Returns enriched CVE data with CVSS, EPSS, KEV status, and linked threats. Max 20 IDs per call.

• bulk_get_threats

  Fetch multiple threats by ID in a single call. Returns full threat objects with flat MITRE arrays. Max 20 IDs per call. Use this instead of calling get_threat N times in parallel.

• enrich_iocs

  Get enrichment metadata for IOCs — cross-references with ThreatFox, MalwareBazaar, AbuseIPDB/IPsum, and DNS data. Returns enrichment status and any matching threat intelligence from external feeds.

• export_detection

  Export a specific detection rule in a chosen format — returns the raw SPL query, KQL query, Sigma YAML, or full JSON with all metadata.

• generate_c2_blocklist

  Generate a firewall-ready C2 IOC blocklist from active beacons. Filter by framework (cobalt-strike, sliver, etc.), recency window, and output format. Returns CIDR list (default), hosts file, or plain IP list. Requires Purple tier ($11.99/mo).

• get_actor_intelligence

  Composite actor intelligence — actor_profile + active C2 infrastructure + cross-actor shared entities (from corr_attribution) + recent threat activity timeline. Single call for full adversary picture. Requires Purple tier ($11.99/mo).

• get_actor_profile

  Get a lean threat actor profile. Requires Purple tier ($11.99/mo). Returns: actor metadata + attribution counts + attributed-threat summary rows + MITRE tactic rollup with technique ids + IOC category counts (no raw values) + CVE/CWE/tool summaries + relationships. For heavy detail use follow-up tools: get_threat(id), get_detections(threat_id) / get_detection_detail, search_iocs.

• get_c2_configs

  Get full C2 beacon configurations — sleep times, jitter, user agents, spawnto paths, kill dates, crypto schemes, domain fronting details, and aggregate statistics.

• get_c2_cross_correlations

  Get C2 cross-intelligence correlations — IP matches, tag matches, MITRE technique overlaps, domain fronting detection, behavioral fingerprints, and watermark clusters across beacons.

• get_c2_operators

  Get C2 operator cluster analysis — behavioral fingerprints, shared infrastructure, and attributed operator groups.

• get_c2_stats

  Get C2 intelligence statistics — framework distribution, geographic spread, watermark clusters, and operator activity summary.

• get_c2_timeline

  Get C2 beacon timeline — monthly version distribution showing C2 framework evolution over time.

• get_c2_watermarks

  Get C2 watermark clusters — groupings of beacons sharing the same Cobalt Strike watermark, indicating shared operator or license.

• get_campaign_intelligence

  Pivot on a named campaign / operation by name (e.g. Snowflake campaign, ClickFix). Returns the threats in the campaign, the actors involved, prevalence, and common ATT&CK techniques.

• get_changelog

  Get the platform changelog — recent updates, new features, bug fixes, and improvements.

• get_correlation_engine

  Get detailed data from a specific correlation engine. Engines: mitre-heatmap (technique risk scores), adversary-infra (threat actor infrastructure), ioc-consensus (cross-source IOC validation), cve-velocity (exploit timeline analysis), attribution (cross-actor shared entities), detection-debt (uncovered technique gaps), enrichment (data source health).

• get_correlations_overview

  Get advanced correlations overview — aggregated intelligence from 7 correlation engines: MITRE heatmap, adversary infrastructure, IOC consensus, CVE velocity, attribution network, detection debt, and enrichment overview.

• get_cve_details

  Look up details for a specific CVE identifier. Returns description, severity, CVSS score, affected products, references, and linked threats.

• get_cve_intelligence

  Composite CVE dossier — CVE detail + linked threats + EPSS exploitation velocity + KEV status + detection coverage % + simulation availability + exploitation timeline. Requires Purple tier ($11.99/mo).

• get_cwe_details

  Look up details for a specific CWE identifier. Returns weakness name, description, severity, related CVEs, and mitigation guidance.

• get_daily_intel_bundle

  One-shot daily intelligence bundle — combines latest debrief + platform stats + top threats with detail + correlations overview in a single response. Replaces 7+ workflow nodes. This is the ideal starting point for any 'what happened today' analysis.

• get_debrief

  Get a specific daily debrief by date. Returns full briefing with threat summaries, MITRE techniques covered, IOC breakdown, detection coverage, and threat actor activity. Use fallback='latest' if the requested date may not have a published debrief yet.

• get_detection_detail

  Get full details for a specific detection rule by ID — includes query content (SPL/KQL/Sigma), MITRE ATT&CK mapping, data sources, false positive guidance, confidence level, and associated threat.

• get_detections

  Get detection rules with filtering. Filter by threat ID, detection type (spl/kql/sigma), severity, or keyword search. Returns detection name, query/rule content, severity, confidence, data sources, and MITRE mappings.

• get_enrichment_overview

  Get enrichment source health overview — hit rates, coverage percentages, and data freshness across all enrichment sources (NVD, EPSS, CISA KEV, MITRE CWE, ThreatFox, MalwareBazaar, IPsum, DNS, GitHub GHSA). Use this to assess data quality and identify enrichment gaps.

• get_ioc_dns

  Get passive DNS enrichment data for a specific IOC value (IP, domain, or URL). Returns DNS resolution history, reverse lookups, and infrastructure mapping. If the IOC has no DNS data, returns {known: false} instead of an error.

• get_ioc_intelligence

  Given an IOC (IP, domain, hash, URL), return a complete dossier: all threats touching it + actor attribution + DNS enrichment trail + infrastructure pivots (cross-IOC links) + corr_ioc_consensus confidence score from 7 external feeds (Pulsedive, GreyNoise, Yaraify, MalwareBazaar, URLScan, VxVault, OpenPhish). Powers 'I found this in a log — tell me everything' workflows. Requires Purple tier ($11.

• get_latest_debrief

  Get the most recent published daily debrief regardless of date. Use this when you don't know the exact date or want today's/yesterday's briefing without guessing. Returns the full debrief with its actual_date field.

• get_malware_intelligence

  Pivot on a malware FAMILY by name (e.g. LockBit, Vidar, Emotet). Returns the canonical family + type, prevalence (threat/actor counts, first/last seen), the threats deploying it, the actors using it, and its most-common ATT&CK techniques. For an offensive TOOL (Cobalt Strike, Mimikatz) use get_tool_intelligence. Use resolve_entity first if unsure of the canonical name.

• get_mitre_coverage

  Get MITRE ATT&CK framework coverage — all techniques and tactics mapped across the threat intelligence database with detection coverage statistics.

• get_mitre_gap_analysis

  Prioritized list of uncovered MITRE techniques sorted by detection debt score (combines threat exposure + KEV exposure + EPSS). Each entry includes threat examples + recommended detection types to deploy. Powers 'what should I write detections for next?' workflows. Requires Purple tier ($11.99/mo).

• get_mitre_technique

  Get detailed information about a specific MITRE ATT&CK technique — its mitigations, detection data sources, parent technique, and the threats that map to it.

• get_platform_stats

  Get current platform statistics — total threats, detections, IOCs, MITRE coverage, category breakdown, and operational status.

• get_recent_threats

  Get the most recently published threats on the platform, ordered by creation date descending.

• get_roadmap

  Get the platform roadmap — planned features, ideas in progress, and completed items with priorities and status.

• get_similar_threats

  Find threats similar to a given threat by precomputed similarity score (shared TTPs / IOC overlap / actor attribution). Requires Purple tier ($11.99/mo). Reveals lateral threats the LLM otherwise wouldn't surface.

• get_threat

  Get full details for a specific threat by ID. Returns complete threat intelligence: summary, description, severity, CVSS scores, attribution, CVEs/CWEs, MITRE mappings, timeline, IOCs, detections, tags, and references.

• get_threat_bundle

  One-shot threat intelligence bundle — combines threat detail + simulations + IOCs + transcripts + flat MITRE arrays in a single response. Replaces 4 separate tool calls. Use instead of calling get_threat + get_threat_simulations + search_iocs + get_threat_transcripts individually.

• get_threat_enrichment

  Reference-grounded enrichment for one threat by ID: the malware families and tools used, targeted sectors/regions, affected operating systems, named campaigns, AI/ML (ATLAS) techniques, and per-technique mitigations + detection data sources. Complements get_threat (overview/MITRE/IOCs/detections) — call this for the 'what malware/tools were used and who was targeted' view.

• get_threat_hunting_bundle

  FLAGSHIP PURPLE TOOL. Single-call complete threat dossier — wraps threat detail + IOCs + detection queries + similar threats + simulation commands + infrastructure pivots (cross-threat IOC links + DNS trail) into one response. Saves 5-7 MCP round-trips. Requires Purple tier ($11.99/mo).

• get_threat_simulations

  Get all simulation commands for a specific threat. Returns detailed simulation steps with platform-specific commands (PowerShell, Bash, Python), MITRE mappings, caution levels, and requirements.

• get_threat_transcripts

  Get agent analysis transcripts for a threat — multi-agent intelligence reports with phases, signals, participant roles, and summary assessments.

• get_tool_intelligence

  Pivot on an offensive tool / utility / RMM / LOLBin by name (e.g. Cobalt Strike, Mimikatz, AnyDesk, PsExec). Returns the canonical tool + class, prevalence, the threats and actors using it, and its most-common ATT&CK techniques.

• health

  Lightweight health check — returns server status, version, uptime, key stats, and API key validity. Sub-second response, no heavy queries. Use this instead of get_platform_stats for liveness probes.

• list_c2_beacons

  List Wild C2 beacons — command-and-control infrastructure intelligence including framework identification, watermark analysis, and geolocation.

• list_debriefs

  List all daily intelligence debriefs. Returns dates, threat counts, and summary information for each briefing.

• list_simulations

  List all attack simulation scenarios available on the platform. Returns threats with simulation counts, platforms (windows/linux/python), severity, and threat actor attribution.

• list_threat_categories

  List all threat categories with counts. Returns category names and how many threats belong to each.

• predict_attack_path

  Given a MITRE technique, predict the most likely next techniques based on observed chains across 160+ threats. Returns top-N transitions with probability + transition_count + example threats per branch. Powers attack-chain reasoning. Requires Purple tier ($11.99/mo).

• resolve_entity

  Normalize an actor / malware / tool / sector / region / technique name or alias to its canonical reference form + stable UUID (e.g. 'fancy bear' → 'APT28'). Call this BEFORE pivoting (get_actor / get_malware_intelligence / get_tool_intelligence / search_threats) when unsure of the canonical name. Optional type narrows the lookup.

• search_actors

  Search threat actors by name, alias, nation-state, or motivation. Requires Purple tier ($11.99/mo). Returns actors with threat_count, severity_levels, categories, and nation_state.

• search_detections

  Search detection rules by keyword — matches against detection names and descriptions. Filter by type and severity. WHEN TO USE: for finding detections by topic (e.g. 'ransomware', 'lateral movement', 'credential dumping'). To list every detection for a specific threat, use get_detections(threat_id=...) instead. Returns has_more/next_offset for paging.

• search_iocs

  Search indicators of compromise — IPs, domains, hashes, URLs, behavioral indicators. Filter by IOC type category.

• search_threats

  Deterministic threat-catalog search. Returns LEAN rows {id, title, severity, category, status, threat_actor, nation_state, affected_products, cves, cvss_score, summary, created} — call get_threat for full detail. Combine free-text `query` with any structured filters; ALL filters AND-combine (e.g. query="supply chain" + threat_actor="TeamPCP" + category="SUPPLY_CHAIN"). Paginated via limit + offset

• Code scan3 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitystatic API keys via environment variables6/15
• Maintenancelast push 33 days ago12/15
• Maintainer identityregistry namespace matches repository owner6/10

Safety score

75/100

higher than 45% of 48,255 servers

Tools

54

the typical server has 7

Tools that change things

0%

typical: 0%. Fewer write tools means less an agent can break

Downloads a week

53

more than 44% of 12,191 servers with a package

Intelthreadlinqs: common questions

Is Intelthreadlinqs MCP server safe?

Mostly: it is graded B (75/100). Read the Intelthreadlinqs safety report

How do I install Intelthreadlinqs?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Intelthreadlinqs need an API key?

Yes. The registry entry asks for THREADLINQS_API_KEY.

Is Intelthreadlinqs maintained?

The last commit was 73 days ago (2026-08-23). The latest release is v7.1.3.

How does Intelthreadlinqs compare with other MCP servers?

safety score 75/100 (higher than 45% of 48,255 servers); tools 54 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.