Truss Threat Intelligence

com.truss-securityPublished by truss-security.comOfficial publisherv1.1.0Updated Oct 25, 2026

Query Truss threat intelligence via hosted MCP (OAuth). Growth+ plans.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringData & Analytics

Overview

AI-generated overview

Hosted Truss threat intelligence MCP server that lets an assistant search threat data, build FilterQL queries, export STIX and draft SIEM/EDR detection rules.

What you can do
Search Truss threat intelligence products and threat background via the hosted MCP endpoint, with the assistant confirming intent before querying the API (default 7-day window). Draft, validate and run FilterQL filters against the Truss API. Export results as JSON or STIX and generate hunting queries for Splunk, Falcon or Cortex. Optionally run a local stdio server and a guided terminal REPL with live MCP tools.
When to use it
Useful for security analysts and detection engineers who already have a Growth+ Truss account and want an assistant to query Truss threat intelligence, refine filters and turn results into SIEM/EDR detection queries inside Cursor, Claude Desktop or a similar MCP host.
Requirements
Remote endpoint at with OAuth browser consent; a Growth+ Truss account (Community accounts cannot consent). The optional local stdio mode needs Node.js 18+, the truss-mcp binary and a TRUSS_API_KEY; the terminal REPL also needs LLM_PROVIDER, LLM_MODEL and an ANTHROPIC_API_KEY or OPENAI_API_KEY.
Before you install
OAuth grants the assistant access to your Truss account data; the optional --save-token option writes the access token to disk (mode 0600) and should be deleted after debugging. Wider query windows may consume more API quota. The local stdio mode requires a TRUSS_API_KEY, and the REPL sends prompts to a third-party LLM provider using ANTHROPIC_API_KEY or OPENAI_API_KEY.

Installation

In SourceWeft

  1. Open Truss Threat Intelligence in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.truss-security%2Ftruss-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "truss-threat-intelligence": {
      "type": "http",
      "url": "https://api.truss-security.com/mcp"
    }
  }
}

README

truss-agent-mcp

Truss threat intelligence via Model Context Protocol and a terminal assistant — one binary: truss-mcp.

[smithery badge]

Truss MCP on Smithery

Two surfaces

SurfaceUse forAuth
Remote (recommended)Cursor, Claude Desktop, MCP registriesOAuth → https://api.truss-security.com/mcp
Local stdio (legacy)Air-gap / BYO-key / FilterQL REPL toolsTRUSS_API_KEY → REST

Hosted MCP (OAuth, Growth+ gate, five tools) is served by the Truss API. This package ships configs, validate-remote / doctor --remote, CLI search, and optional local stdio. Community accounts cannot consent to hosted MCP.

Not on npm yet. Install from this repo (npm install -g .). After publish: npm install -g @truss-security/truss-agent-mcp.

Quick start

bash
cd truss-agent-mcpnpm install && npm run buildnpm install -g .truss-mcp doctor --remote --strict-oauth   # OAuth path hosts usetruss-mcp init                            # for CLI search / legacy stdiotruss-mcp search

Node.js 18+. Binary name truss-mcp avoids conflict with @truss-security/truss-sdk's truss command.

What you can run

CommandWhat it does
truss-mcp searchGuided REPL with live MCP tools (local stdio or remote OAuth token)
truss-mcp mcpLocal stdio MCP server (legacy / air-gap)
truss-mcp initInteractive .env setup
truss-mcp doctorValidate keys and API access; --remote runs hosted OAuth doctor
truss-mcp validate-remote <url>OAuth + MCP doctor (discovery, DCR, PKCE, tools)
truss-mcp helpUsage summary

Guided search workflow

One REPL with MCP tools always connected. The assistant classifies your intent and asks before querying Truss API:

  1. Knowledge — Truss platform, cyber security context, threat background
  2. Build filter — draft FilterQL, validate, confirm
  3. Query — run executes confirmed filter (default 7 days)
  4. Format — stix for STIX export; JSON summaries in-thread
  5. Detection rules — detect splunk, detect falcon, detect cortex from search results

The assistant offers next steps explicitly: build a filter, refine it, query Truss API, export JSON/STIX, or generate SIEM/EDR hunting queries.

  • Wider windows (run 30, days 30) may use more API quota
  • Context-only follow-ups (IOC dedupe, reformat) use thread history without re-querying

Full REPL reference: guides/truss-cli.md

Terminal display (REPL)

truss-mcp search uses color-coded, ASCII-bordered output:

  • You — your message
  • MCP — live tool trace (→ search_threats on remote, or → search_products on stdio)
  • Results — structured product table before the assistant summary
  • Truss — assistant reply (cyan), guided offers (yellow), FilterQL blocks (magenta)

Controls: color / color on / color off / color auto · env TRUSS_MCP_COLOR · standard NO_COLOR=1

MCP host (Cursor / Claude) — remote OAuth (recommended)

No API key in host config. Growth+ Truss account; browser OAuth consent.

json
{  "mcpServers": {    "truss-mcp": {      "url": "https://api.truss-security.com/mcp"    }  }}

Samples: config/cursor.mcp.json · config/claude_desktop_config.json · guides/client-setup-cursor.md.

Legacy stdio (air-gap)

json
{  "mcpServers": {    "truss-mcp": {      "command": "truss-mcp",      "args": ["mcp"],      "env": { "TRUSS_API_KEY": "YOUR_KEY" }    }  }}

See config/cursor.mcp.stdio.json and guides/getting-started.md.

Remote MCP OAuth validation (registry gate)

Use as the OAuth + MCP doctor before registry publish or release. After OAuth it requires search_threats to return at least one Truss product (id + title). The access token stays in memory for that process only unless you pass --save-token.

bash
truss-mcp doctor --remote --strict-oauth# or:truss-mcp validate-remote https://api.truss-security.com/mcp --strict-oauth

After token exchange it prints an OAuth compatibility checklist (resource URI, redirects, PKCE S256, issuer match, audience vs MCP resource, truss_role), then proves MCP access with real Truss data.

Options:

bash
truss-mcp validate-remote https://api.truss-security.com/mcp --verbosetruss-mcp validate-remote https://api.truss-security.com/mcp --strict-oauthtruss-mcp validate-remote https://api.truss-security.com/mcp --save-token /tmp/truss-mcp-tokentruss-mcp validate-remote https://api.truss-security.com/mcp --token-file /tmp/truss-mcp-tokentruss-mcp validate-remote https://api.truss-security.com/mcp --port 9877truss-mcp validate-remote https://api.truss-security.com/mcp --no-open
  • --verbose — HTTP statuses, key headers, truncated bodies (tokens redacted)
  • --strict-oauth — exit 2 if the OAuth checklist has WARN/FAIL (even when Truss MCP calls succeed)
  • --save-token PATH — write the access token for local replay (mode 0600; delete after debugging)
  • --token-file PATH — skip browser OAuth; reuse a saved token to re-check MCP access + Truss data

Optional automated OAuth data tests (saved token + TRUSS_RUN_MCP_OAUTH=1) are documented in guides/publishing.md.

Official listing: server.json (com.truss-security/truss-mcp) · Tracker: guides/registry-submission.md · Internal metadata: config/mcp-registry.json · Architecture: docs/05-hosted-mcp-oauth-architecture.md

Configuration

Env load order (shell vars win): ~/.config/truss/env → ~/.truss/.env → ./.env

VariableRequired forNotes
TRUSS_API_KEYlocal mcp / stdio searchFrom Truss dashboard (legacy air-gap only)
TRUSS_MCP_URLremote search / doctorDefault https://api.truss-security.com/mcp
TRUSS_MCP_OAUTH_TOKEN_FILEremote searchBearer token from validate-remote --save-token
LLM_PROVIDERsearchanthropic or openai — set via init
LLM_MODELsearchSet via init
ANTHROPIC_API_KEY / OPENAI_API_KEYsearchPer provider

Full list: env.example

Documentation

Guides — install, REPL, MCP clients, FilterQL examples

Reference — API contract, tools, architecture (docs/README.md — docs 01–06)

Development

bash
npm install && npm run buildnpm testnpm run truss:search    # from source without global install

Contributors / AI agents: see AGENTS.md for repo operations and conventions.

Publish: guides/publishing.md · Changes: CHANGELOG.md

Related

MIT

Source: README.md at commit e900a45

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

1
  1. v1.1.0LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts