MCP.Market

Truss Threat Intelligence MCP server

online · 100% uptime
by truss-security.com·com.truss-security/truss-mcp·v1.1.0
No reviews yet

Query Truss threat intelligence via hosted MCP (OAuth). Growth+ plans.

A90/100grade A
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
A90/100

full report

Adoption
Growing

0 stars

Reviews

Write one

Nobody has reviewed Truss Threat Intelligence yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Truss Threat Intelligence tools

Tool list not cached yet. `describe` through the gateway fetches it live.

Public scan report

scanner v0.1.9 · 2026-09-24 · same rubric, same numbers if you re-run it

no findings
  • –Code scanremote-only server, no package to scann/a
  • Live reliabilityremote reachable in 421ms (auth required)20/20
  • –Tool poisoningtools not inspected (endpoint requires auth); not countedn/a
  • Auth qualityauth enforced (unknown)9/15
  • Maintenancelast push 4 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year; website matches verified namespace10/10
Overall 90/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Truss Threat Intelligence compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
90/100
higher than 83% of 48,255 servers
Uptime
100%
of our recent checks; the typical remote server answers 100%
Response time
157 ms
faster than 72% of 30,031 servers

Install Truss Threat Intelligence in Claude Code, Cursor or VS Code

claude mcp add --transport http truss-mcp https://api.truss-security.com/mcp
Add to Cursor

What the publisher says

From the Truss Threat Intelligence repository's README, as published. We do not edit it. Read it on GitHub

truss-agent-mcp

Truss threat intelligence via Model Context Protocol and a terminal assistant — one binary: truss-mcp.

Truss MCP on Smithery

Two surfaces

Hosted MCP (OAuth, Growth+ gate, five tools) is served by the Truss API. This package ships configs, validate-remote / doctor --remote, CLI search, and optional local stdio. Community accounts cannot consent to hosted MCP.

Not on npm yet. Install from this repo (npm install -g .). After publish: npm install -g @truss-security/truss-agent-mcp.

Quick start

cd truss-agent-mcp
npm install && npm run build
npm install -g .
truss-mcp doctor --remote --strict-oauth   # OAuth path hosts use
truss-mcp init                            # for CLI search / legacy stdio
truss-mcp search

Node.js 18+. Binary name truss-mcp avoids conflict with @truss-security/truss-sdk's truss command.

What you can run

Guided search workflow

One REPL with MCP tools always connected. The assistant classifies your intent and asks before querying Truss API:

  1. Knowledge — Truss platform, cyber security context, threat background
  2. Build filter — draft FilterQL, validate, confirm
  3. Query — run executes confirmed filter (default 7 days)
  4. Format — stix for STIX export; JSON summaries in-thread
  5. Detection rules — detect splunk, detect falcon, detect cortex from search results

The assistant offers next steps explicitly: build a filter, refine it, query Truss API, export JSON/STIX, or generate SIEM/EDR hunting queries.

  • Wider windows (run 30, days 30) may use more API quota
  • Context-only follow-ups (IOC dedupe, reformat) use thread history without re-querying

Full REPL reference: guides/truss-cli.md

Terminal display (REPL)

truss-mcp search uses color-coded, ASCII-bordered output:

  • You — your message
  • MCP — live tool trace (→ searchthreats on remote, or → searchproducts on stdio)
  • Results — structured product table before the assistant summary
  • Truss — assistant reply (cyan), guided offers (yellow), FilterQL blocks (magenta)

Controls: color / color on / color off / color auto · env TRUSSMCPCOLOR · standard NO_COLOR=1

MCP host (Cursor / Claude) — remote OAuth (recommended)

No API key in host config. Growth+ Truss account; browser OAuth consent.

{
  "mcpServers": {
    "truss-mcp": {
      "url": "https://api.truss-security.com/mcp"
    }
  }
}

Samples: config/cursor.mcp.json · config/claudedesktopconfig.json · guides/client-setup-cursor.md.

Legacy stdio (air-gap)

{
  "mcpServers": {
    "truss-mcp": {
      "command": "truss-mcp",
      "args": ["mcp"],
      "env": { "TRUSS_API_KEY": "YOUR_KEY" }
    }
  }
}

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Truss Threat Intelligence: common questions

Is Truss Threat Intelligence MCP server safe?
Yes, by our scan: it is graded A (90/100). Read the Truss Threat Intelligence safety report
How do I install Truss Threat Intelligence?
It runs remotely at api.truss-security.com. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does Truss Threat Intelligence need an API key?
Yes. The endpoint refuses requests without credentials; the publisher's docs say how to get them.
Is Truss Threat Intelligence maintained?
The last commit was 44 days ago (2026-09-21). The latest release is v1.1.0.
Is Truss Threat Intelligence up?
100% of our last 28 checks got an answer. We check remote servers about four times a day.
How does Truss Threat Intelligence compare with other MCP servers?
safety score 90/100 (higher than 83% of 48,255 servers); uptime 100% (of our recent checks; the typical remote server answers 100%); response time 157 ms (faster than 72% of 30,031 servers). Full comparison.