Mcp Threatintel
by aplaceforallmystuffcommunityv1.0.1
6
1
MCP Threat Intel Server provides unified access to multiple threat intelligence sources for security research and analysis.
From the registry: Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker
Install & configure
Prerequisites
- required
Install in your client
Paste into the AI you're chatting with — it will figure out the rest
Please install the `mcp-threatintel` MCP server into my current AI client (that's you).
Required prerequisites (do these first if not already done):
- **Node.js 18+** — Required to run the npx package (https://nodejs.org)
Canonical MCP server config (stdio transport):
- command: `npx`
- args: ["-y","mcp-threatintel-server"]
- optional environment variables:
- `OTX_API_KEY`: AlienVault OTX API key (example: `<your-otx-api-key>`)
- `ABUSEIPDB_API_KEY`: AbuseIPDB API key (example: `<your-abuseipdb-api-key>`)
- `GREYNOISE_API_KEY`: GreyNoise API key (example: `<your-greynoise-api-key>`)
- `ABUSECH_AUTH_KEY`: abuse.ch auth key (URLhaus, MalwareBazaar, ThreatFox) (example: `<your-abusech-auth-key>`)
Note: Tools are dynamically enabled per configured API key. Feodo Tracker works with zero keys.
Add this MCP server to my current client's config in the correct format for you. If you need secrets or credentials I haven't provided, ASK me — do not invent values or leave raw placeholders. After adding it, tell me how to verify the server is connected.Note: Tools are dynamically enabled per configured API key. Feodo Tracker works with zero keys.
Tools (17)
threatintel_status
Check which threat intelligence sources are configured
threatintel_lookup_ip
Look up IP across all configured sources
threatintel_lookup_domain
Look up domain across all configured sources
threatintel_lookup_hash
Look up file hash (MD5/SHA1/SHA256) across sources
threatintel_lookup_url
Look up URL across sources
abuseipdb_check
Check IP reputation and abuse history
otx_get_pulses
Get recent threat intelligence pulses
otx_search_pulses
Search pulses by keyword
greynoise_ip
Check if IP is internet noise or targeted threat
urlhaus_lookup
Look up URL, domain, or IP in URLhaus
urlhaus_recent
Get recent malware URLs
malwarebazaar_hash
Look up malware sample by hash
malwarebazaar_recent
Get recent malware samples
malwarebazaar_tag
Search samples by tag
Environment variables
OTX_API_KEYrequiredAPI key for AlienVault OTXABUSEIPDB_API_KEYrequiredAPI key for AbuseIPDBGREYNOISE_API_KEYrequiredAPI key for GreyNoiseABUSECH_AUTH_KEYrequiredAuthentication key for abuse.ch servicesPrerequisites
- • Node.js 18+
Packages
mcp-threatintel-server
npmv1.0.1transport: stdio
Details
- Language
- JavaScript
- License
- MIT
- Released
- Nov 28, 2025
- Last commit
- Jun 20, 2026
- Registry name
- io.github.aplaceforallmystuff/mcp-threatintel