{
  "markdown": "# MCP Threat Intel Server\n\n[![npm version](https://img.shields.io/npm/v/mcp-threatintel-server.svg)](https://www.npmjs.com/package/mcp-threatintel-server)\n[![CI](https://github.com/aplaceforallmystuff/mcp-threatintel/actions/workflows/ci.yml/badge.svg)](https://github.com/aplaceforallmystuff/mcp-threatintel/actions/workflows/ci.yml)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![MCP](https://img.shields.io/badge/MCP-Compatible-blue)](https://modelcontextprotocol.io)\n\nMCP server providing unified access to multiple threat intelligence sources for security research and analysis.\n\n## Why Use This?\n\nIf you're doing security research, incident response, or threat analysis, this MCP server lets you:\n\n- **Unified lookups** - Query IPs, domains, hashes, and URLs across multiple sources simultaneously\n- **Reduce context switching** - No need to open multiple browser tabs for different intel sources\n- **Correlate intelligence** - See results from all configured sources in one response\n- **Free tier friendly** - Works with free API tiers, gracefully degrades when sources unavailable\n- **Works without keys** - Feodo Tracker (botnet C2s) works without any API keys\n\n## Features\n\n| Category | Capabilities |\n|----------|-------------|\n| **Unified Lookups** | Query IPs, domains, file hashes, URLs across all sources |\n| **AlienVault OTX** | Threat pulses, indicators of compromise, community intelligence |\n| **AbuseIPDB** | IP reputation, abuse reports, confidence scores |\n| **GreyNoise** | Internet noise vs targeted attacks, scanner identification |\n| **abuse.ch** | URLhaus, MalwareBazaar, ThreatFox, Feodo Tracker |\n\n## Prerequisites\n\n- Node.js 18+\n- API keys for your preferred threat intelligence sources (see below)\n\n## Installation\n\n### Using npm (Recommended)\n\n```bash\nnpx mcp-threatintel-server\n```\n\nOr install globally:\n\n```bash\nnpm install -g mcp-threatintel-server\n```\n\n### From Source\n\n```bash\ngit clone https://github.com/aplaceforallmystuff/mcp-threatintel.git\ncd mcp-threatintel\nnpm install\nnpm run build\n```\n\n## Configuration\n\n### For Claude Desktop\n\nAdd to your Claude Desktop config file:\n\n**macOS**: `~/Library/Application Support/Claude/claude_desktop_config.json`\n**Windows**: `%APPDATA%\\Claude\\claude_desktop_config.json`\n\n```json\n{\n  \"mcpServers\": {\n    \"threatintel\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"mcp-threatintel-server\"],\n      \"env\": {\n        \"OTX_API_KEY\": \"your-otx-api-key\",\n        \"ABUSEIPDB_API_KEY\": \"your-abuseipdb-api-key\",\n        \"GREYNOISE_API_KEY\": \"your-greynoise-api-key\",\n        \"ABUSECH_AUTH_KEY\": \"your-abusech-auth-key\"\n      }\n    }\n  }\n}\n```\n\n### For Claude Code\n\nAdd to `~/.claude.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"threatintel\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"mcp-threatintel-server\"],\n      \"env\": {\n        \"OTX_API_KEY\": \"your-otx-api-key\",\n        \"ABUSEIPDB_API_KEY\": \"your-abuseipdb-api-key\",\n        \"GREYNOISE_API_KEY\": \"your-greynoise-api-key\",\n        \"ABUSECH_AUTH_KEY\": \"your-abusech-auth-key\"\n      }\n    }\n  }\n}\n```\n\n### API Keys\n\n| Service | Required | Free Tier | Get Key |\n|---------|----------|-----------|---------|\n| AlienVault OTX | Optional | Yes (unlimited) | [otx.alienvault.com](https://otx.alienvault.com) |\n| AbuseIPDB | Optional | Yes (1,000/day) | [abuseipdb.com](https://www.abuseipdb.com) |\n| GreyNoise | Optional | Yes (limited) | [greynoise.io](https://www.greynoise.io) |\n| abuse.ch | Optional | Yes | [auth.abuse.ch](https://auth.abuse.ch) |\n| Feodo Tracker | No | Yes | Public JSON feeds |\n\n**Note:** Tools are dynamically enabled based on which API keys you provide. Feodo Tracker works without authentication (public JSON feeds).\n\n## Usage Examples\n\n### Check Available Sources\n> \"What threat intel sources are configured?\"\n\n> \"Show me threatintel status\"\n\n### IP Investigation\n> \"Check if 185.220.101.1 is malicious\"\n\n> \"Look up this IP across all threat intel sources\"\n\n### Domain Analysis\n> \"Is evil-domain.com known to be malicious?\"\n\n> \"Check domain reputation\"\n\n### Malware Hash Lookup\n> \"Look up this SHA256 hash in threat intel\"\n\n> \"Is this file hash known malware?\"\n\n### URL Analysis\n> \"Check if this URL is in any blocklists\"\n\n### Botnet Tracking (No API Key Required)\n> \"Show me active botnet C2 servers\"\n\n> \"Get Feodo tracker data for Emotet\"\n\n### Threat Pulses\n> \"Search OTX for recent ransomware pulses\"\n\n> \"Get latest threat intelligence pulses\"\n\n## Available Tools\n\n### Status\n| Tool | Description |\n|------|-------------|\n| `threatintel_status` | Check which threat intelligence sources are configured |\n\n### Unified Lookups\n| Tool | Description |\n|------|-------------|\n| `threatintel_lookup_ip` | Look up IP across all configured sources |\n| `threatintel_lookup_domain` | Look up domain across all configured sources |\n| `threatintel_lookup_hash` | Look up file hash (MD5/SHA1/SHA256) across sources |\n| `threatintel_lookup_url` | Look up URL across sources |\n\n### AbuseIPDB (requires API key)\n| Tool | Description |\n|------|-------------|\n| `abuseipdb_check` | Check IP reputation and abuse history |\n\n### AlienVault OTX (requires API key)\n| Tool | Description |\n|------|-------------|\n| `otx_get_pulses` | Get recent threat intelligence pulses |\n| `otx_search_pulses` | Search pulses by keyword |\n\n### GreyNoise (requires API key)\n| Tool | Description |\n|------|-------------|\n| `greynoise_ip` | Check if IP is internet noise or targeted threat |\n\n### URLhaus (requires abuse.ch auth key)\n| Tool | Description |\n|------|-------------|\n| `urlhaus_lookup` | Look up URL, domain, or IP in URLhaus |\n| `urlhaus_recent` | Get recent malware URLs |\n\n### MalwareBazaar (requires abuse.ch auth key)\n| Tool | Description |\n|------|-------------|\n| `malwarebazaar_hash` | Look up malware sample by hash |\n| `malwarebazaar_recent` | Get recent malware samples |\n| `malwarebazaar_tag` | Search samples by tag |\n\n### ThreatFox (requires abuse.ch auth key)\n| Tool | Description |\n|------|-------------|\n| `threatfox_iocs` | Get recent IOCs from ThreatFox |\n| `threatfox_search` | Search ThreatFox IOCs |\n\n### Feodo Tracker (no key required)\n| Tool | Description |\n|------|-------------|\n| `feodo_tracker` | Get active botnet C2 servers (QakBot, Emotet, Dridex, etc.) |\n\n## Development\n\n```bash\n# Watch mode for development\nnpm run watch\n\n# Build TypeScript\nnpm run build\n\n# Run locally\nnode dist/index.js\n```\n\n## Troubleshooting\n\n### \"No threat intel sources configured\"\nYou can use the server without any API keys - Feodo Tracker will still work. For other sources, add the appropriate API keys to your configuration.\n\n### \"API error: 401 Unauthorized\"\nYour API key is invalid or expired. Generate a new one from the respective service.\n\n### \"API error: 429 Too Many Requests\"\nYou've exceeded the rate limit for a service. Wait a while or upgrade your API tier.\n\n### Partial results\nIf some sources return errors, the unified lookup tools will still return results from working sources. Check `threatintel_status` to see which sources are configured correctly.\n\n## Data Sources\n\n### AlienVault OTX\nOpen Threat Exchange - community-driven threat intelligence platform with pulses containing indicators of compromise.\n\n### AbuseIPDB\nCrowdsourced IP reputation database with abuse reports from network administrators worldwide.\n\n### GreyNoise\nIdentifies IPs scanning the internet vs targeted attacks. Helps reduce false positives in threat detection.\n\n### abuse.ch Projects\n- **URLhaus** - Malware distribution URLs\n- **MalwareBazaar** - Malware sample repository\n- **ThreatFox** - IOC sharing platform\n- **Feodo Tracker** - Botnet C2 infrastructure tracking\n\n## Contributing\n\nContributions are welcome! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.\n\n## License\n\nMIT - see [LICENSE](LICENSE) for details.\n\n## Links\n\n- [Model Context Protocol](https://modelcontextprotocol.io)\n- [MCP Specification](https://spec.modelcontextprotocol.io)\n- [GitHub Repository](https://github.com/aplaceforallmystuff/mcp-threatintel)\n\n## Related Projects\n\nFor additional threat intelligence capabilities, consider:\n- [@burtthecoder/mcp-shodan](https://www.npmjs.com/package/@burtthecoder/mcp-shodan) - Shodan internet scanning\n- [@burtthecoder/mcp-virustotal](https://www.npmjs.com/package/@burtthecoder/mcp-virustotal) - VirusTotal malware analysis\n",
  "bytes": 8354,
  "sha": "6d0595d685bd334376e3733aca3a1433764985292b20e772af85532e0af02b24",
  "repo_slug": "aplaceforallmystuff/mcp-threatintel",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_aplaceforallmystuff_mcp_threat_7fea3840/readme"
}