#threat-intelligence

MCP server for Threat info collection in cyber security

MCP server for ORKL Threat Intelligence Library

AlienVault/USM Anywhere MCP Server - Threat intelligence and security monitoring

A Model Context Protocol (MCP) server that integrates with the MISP (Malware Information Sharing Platform) to provide threat intelligence capabilities to Large Language Models.

MCP Server for mallory.ai intelligence

AgentNull: AI System Security Threat Catalog + Proof-of-Concepts. Collection of PoCs for using Agents, MCP, and RAG in bad ways.

Kaspersky OpenTIP Model Context Protocol Server This server gives access to Kaspersky OpenTIP API to agentic applications.

Kaspersky OpenTIP Model Context Protocol Server This server gives access to Kaspersky OpenTIP API to agentic applications.

MCP server for Microsoft Sentinel. Enables access to Sentinel logs, incidents, analytics, and Entra ID data via a modular, queryable interface. Strictly non-production. Designed for use with Claude and other LLMs.

Connect real-time cybersecurity threat intelligence to your AI workflows through standardized tools and resources. Access comprehensive IOCs, CVEs, TTPs, and threat actor data from FalconFeeds.io with seamless integration across Claude Desktop, VS Code, and other MCP-enabled applications.

AI security intelligence on Base. Three paid MCP tools: CVE vulnerability lookup ($0.01), IP/domain reputation check ($0.01), and secret/credential scan ($0.05). Pay-per-call via x402 USDC on Base. No API keys required for callers. Hosted on Cloudflare Workers with per-tool x402 payment challenges.

x402-paid threat intelligence and market data for AI agents on Solana. Real-time threat feeds from URLhaus, ThreatFox, and MalwareBazaar. Live market data from CoinGecko, DeFi Llama, and Coinbase. Network health monitoring. All endpoints pay-per-call via x402 USDC micropayments. Part of the RelayZero agent economy network.

28 WhoisXML API tools for AI agents — WHOIS lookups & history, reverse WHOIS, DNS lookup & history, reverse DNS/MX/NS, IP geolocation, IP netblocks, SSL certificates, subdomain discovery, threat intelligence, domain categorization, email verification, typosquatting detection, and bulk variants for batched lookups. Stdio and Streamable-HTTP transports, OAuth 2.1 with PKCE for hosted mode, npm and Docker distributions.

MCP server with 53 security intelligence tools — CVE/KEV, MITRE ATLAS+D3FEND, Sigma detection rules, email security posture (SPF/DMARC), domain & web intel, threat intel.

Threat intelligence MCP server for SOC analysts, DFIR and security researchers. Scan and enrich IOCs directly from Claude, Cursor or any MCP client: IP addresses (IPv4/IPv6), domains, file hashes and blockchain addresses. Search CVEs by keyword, vendor or product, retrieve full CVE records, and explore a threat actor database (APTs, groups, TTPs) with reverse CVE-to-actor lookup. Includes scan history, bookmarks and quota management. Free tier available — no credit card required. Built by mlab.sh, the IOC & file intelligence platform.