What is a #threat-intelligence MCP server?
An MCP server tagged #threat-intelligence implements the Model Context Protocol so AI assistants like Claude, Cursor, and VS Code can access threat-intelligence-related tools, data, or APIs.
15 #threat-intelligence MCP Servers & Clients
Every MCP server and client below is tagged #threat-intelligence — install one to give Claude, Cursor, VS Code, or any other MCP-compatible client access to threat-intelligence tools.
All
MISP MCP Server
bornpresident
A Model Context Protocol (MCP) server that integrates with the MISP (Malware Information Sharing Platform) to provide threat intelligence capabilities to Large Language Models.
Added last year
ThreatNews
xue20010808
MCP server for Threat info collection in cyber security
Added last year
ORKL MCP Server
heiths
MCP server for ORKL Threat Intelligence Library
Added last year
🧠 AgentNull: AI System Security Threat Catalog + Proof-of-Concepts
jaschadub
AgentNull: AI System Security Threat Catalog + Proof-of-Concepts. Collection of PoCs for using Agents, MCP, and RAG in bad ways.
Added last year
FalconFeeds MCP server
Technisanct
Connect real-time cybersecurity threat intelligence to your AI workflows through standardized tools and resources. Access comprehensive IOCs, CVEs, TTPs, and threat actor data from FalconFeeds.io with seamless integration across Claude Desktop, VS Code, and other MCP-enabled appl
Added last year
S
Sentinelx402
splitfireai-hue
Real-time phishing detection, IP reputation, and CVE risk analysis API for AI agents. Powered by live threat feeds (OpenPhish, Feodo Tracker, URLhaus). Pay per request via x402 micropayments (USDC on Base). First 1,000 requests free, no signup required.
Added 4 months ago
Basic Network Data Query Tool
qax-xlab
Core network security data includes PassiveDNS resolution records, domain and IP registration details, website certificate information, and IOC (Indicators of Compromise) database queries.
Added last year
WA
Whoisxml Api
whois-api-llc
Added 4 months ago
Virustotal Mcp
yassinech-99
MCP server that enables LLMs to interact with the VirusTotal API for malware analysis, URL scanning, and threat intelligence.
Added 5 months ago
Kaspersky Opentip Mcp Server
KasperskyLab
Kaspersky OpenTIP Model Context Protocol Server
Added last year
Anywhere MCP Server
javierb507
AlienVault/USM Anywhere MCP Server - Threat intelligence and security monitoring
Added last year
Mlab - IOC & Threat Intelligence
mlab-sh
Threat intelligence MCP server for SOC analysts, DFIR and security researchers. Scan and enrich IOCs directly from Claude, Cursor or any MCP client: IP addresses (IPv4/IPv6), domains, file hashes and blockchain addresses. Search CVEs by keyword, vendor or product, retrieve full C
Added 2 months ago
Microsoft Sentinel MCP Server
dstreefkerk
MCP server for Microsoft Sentinel. Enables access to Sentinel logs, incidents, analytics, and Entra ID data via a modular, queryable interface. Strictly non-production. Designed for use with Claude and other LLMs.
Added last year
MT
MCP Threat Intel ORKL
fr0gger
This is a threat intel MCP server connected to the ORKL API to retrieve threat report and ask for IOCs, Threat Actors and breaches.
Added last year
WD
Whois, Dns, Ssl, And Domain Availability Lookups For Ai Assistants
Whoisjson
WhoisJSON MCP Server exposes four domain intelligence tools directly inside Claude, Cursor, and Windsurf — no code required.
Added 4 months ago
Frequently asked questions
Common questions about MCP servers and clients tagged #threat-intelligence
How many #threat-intelligence MCP servers and clients are there?
mcp.so currently lists 15 MCP servers and clients tagged #threat-intelligence.
How do I install a #threat-intelligence MCP server?
Open any server below and copy its install snippet into Claude Desktop, Cursor, VS Code, or another MCP client's configuration — remote servers need no separate download.