MCP.Market

Otx MCP server

by w0h1v·io.github.w0h1v/otx·v1.2.0·1 stars
No reviews yet

MCP server for AlienVault OTX threat intelligence: indicators, pulses, search, and users.

B83/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B83/100

full report

Adoption
New

1 stars

Reviews

Write one

Nobody has reviewed Otx yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Otx tools (29, 3 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • create_pulsewrite action

    Create a new OTX pulse owned by the authenticated user.

  • export_indicators

    Bulk export indicators across all subscribed pulses (feed sync).

  • follow_user

    Follow a user (their activity shows in your OTX dashboard).

  • get_current_user

    Get the authenticated user's own OTX profile (whoami).

  • get_indicator_details

    Get threat intelligence details for an indicator from AlienVault OTX.

  • get_pulse_details

    Get full details of an OTX pulse by ID.

  • get_pulse_events

    List events from your subscription stream (pulse lifecycle changes).

  • get_pulse_indicators

    List the indicators contained in a pulse (paginated).

  • get_related_pulses

    Get pulses that share indicators (IOCs) with the given pulse.

  • get_subscribed_pulse_ids

    Get just the IDs of your subscribed pulses (lightweight sync).

  • get_user

    Get an OTX user's profile.

  • list_indicator_types

    List every indicator type usable in OTX pulses, with descriptions.

  • list_my_pulses

    List pulses authored by the authenticated user (your own pulses).

  • list_pulse_activity

    List the latest pulses across the whole OTX community.

  • list_submitted_files

    List files previously submitted for analysis by your account.

  • list_submitted_urls

    List URLs previously submitted for analysis by your account.

  • list_subscribed_pulses

    List pulses from your OTX subscriptions.

  • list_user_pulses

    List pulses authored by a specific OTX user.

  • search_pulses

    Full-text search across all public OTX pulses.

  • search_related_pulses

    Find pulses related to a pulse, malware family, or adversary.

  • search_users

    Search OTX users by username.

  • submit_urlwrite action

    Submit a URL to OTX for analysis.

  • submit_urlswrite action

    Submit multiple URLs to OTX for bulk analysis.

  • subscribe_pulse

    Subscribe to a pulse so its indicators enter your feeds.

  • subscribe_user

    Subscribe to a user; their pulses enter your subscribed feed.

  • unfollow_user

    Unfollow a user.

  • unsubscribe_pulse

    Unsubscribe from a pulse.

  • unsubscribe_user

    Unsubscribe from a user.

  • validate_indicator

    Validate an indicator value/type pair before using it in a pulse.

Public scan report

scanner v0.1.10 · 2026-10-13 · same rubric, same numbers if you re-run it

no findings
  • Code scan16 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Otx compares

Against every graded Web search MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
83/100
higher than 70% of 3,470 Web search servers
Tools
29
the typical Web search server has 5
Tools that change things
10%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
1
more than 55% of 1,786 Web search servers

What its tools let an agent do: 24 read · 1 create · 2 change · 2 delete

Install Otx in Claude Code, Cursor or VS Code

claude mcp add otx -- uvx otx-mcp
Add to Cursor

What the publisher says

From the Otx repository's README, as published. We do not edit it. Read it on GitHub

Quickstart · Tools · HTTP · Security · Troubleshooting · Docs

mcp-otx is an MCP server that gives AI agents access to AlienVault OTX (Open Threat Exchange, now LevelBlue). Hand your agent an IP, domain, file hash, URL or CVE, or a malware family or adversary to research, and get back what the OTX community knows: pulses, reputation, passive DNS, whois, sandbox analysis and related indicators.

[!NOTE]

Independent project, not affiliated with AlienVault or LevelBlue. You need your own OTX API key; a free account is enough.

Highlights

  • Full API coverage. 29 tools across pulses, indicators, users, subscriptions and URL submissions, plus resource templates for pulses and indicators.
  • One-call indicator enrichment. Every OTX indicator type (IPv4, IPv6, domain, hostname, file hash, URL, CVE) and detail section: reputation, geo, passive DNS, malware, whois, URL lists, HTTP scans, sandbox analysis.
  • Read-only by default. The 9 tools that change your OTX account only appear with --read-write.
  • Context-sized output. Large OTX objects are summarized and capped, with the API's total counts kept, so one lookup doesn't fill the model's context.
  • Safe HTTP. stdio for desktop clients, plus streamable HTTP with bearer-token auth. The server refuses to listen on a network-facing address without a token.
  • Tested. Unit tests against a mocked OTX API run in CI on Python 3.10 to 3.13.

How it works

flowchart LR
    A["AI agent<br/>(Claude, Codex, Gemini, VS Code)"] -->|"MCP over stdio or HTTP"| S["mcp-otx"]
    S -->|"HTTPS + X-OTX-API-KEY"| O["OTX DirectConnect API"]
    O -->|"JSON"| S
    S -->|"summarized, capped JSON"| A

Quickstart

Requirements: Python 3.10 or newer, uv (or pip), and an OTX API key.

# Claude Code
claude mcp add --transport stdio --env OTX_API_KEY=your-key otx -- uvx otx-mcp

# Codex CLI
codex mcp add otx --env OTX_API_KEY=your-key -- uvx otx-mcp

# Gemini CLI
gemini mcp add -e OTX_API_KEY=your-key otx uvx otx-mcp

With pip: pip install otx-mcp, then use the command otx-mcp. For Claude Desktop, VS Code, Cline, Docker and running from source, see Connect a client.

Then ask your agent: "What does OTX know about 8.8.8.8, and are there recent pulses about Emotet?" More prompts are in example workflows.

Tools

20 read tools, plus 9 write tools with --read-write. Full parameters and real sample output are in the tool reference.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Otx: common questions

Is Otx MCP server safe?
Mostly: it is graded B (83/100). Read the Otx safety report
How do I install Otx?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Otx need an API key?
Yes. The registry entry asks for OTX_API_KEY.
Is Otx maintained?
The last commit was 23 days ago (2026-10-12). The latest release is v1.2.0.
What can I use instead of Otx?
Servers from other publishers that do the same job: Mapbox MCP server and Codeseeker MCP server.
How does Otx compare with other Web search MCP servers?
safety score 83/100 (higher than 70% of 3,470 Web search servers); tools 29 (the typical Web search server has 5); tools that change things 10% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Otx

Same job from other publishers: the closest match first, then the best rated.

  • Mapbox
    Geospatial intelligence with Mapbox APIs like geocoding, POI search, directions, isochrones, etc.
    A
  • Codeseeker
    Graph-powered code intelligence with semantic search and knowledge graph for AI assistants
    C