Rösti Threat Intel

dev.rostiPublished by rosti.devOfficial publisherv0.2.1Updated Nov 5, 2026

Look up IOCs and search threat-intel reports, YARA rules, MITRE ATT&CK ids and CVEs from rosti.dev

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

Rösti Threat Intel lets an assistant look up indicators of compromise and search public threat-intelligence reports, YARA rules, MITRE ATT&CK ids and CVEs.

What you can do
  • Look up one or many IOC values and see which reports mention them, with refanging of defanged values and false-positive verdicts
  • Search IOCs across reports by text, type, tag, category and creation time
  • Search reports by text, source, CVE, MITRE ATT&CK id and publication date, and read one report's metadata and IOC counts
  • List a report's IOCs, get its YARA rules, find related reports sharing IOCs, and get a signed export link
  • List collected sources and the taxonomy of IOC types, tags, categories, export formats and false-positive risk scale
When to use it
Useful when investigating suspicious domains, IPs, hashes or emails, triaging alerts, or researching a campaign, CVE or ATT&CK technique against published threat-intelligence reports.
Requirements
Remote streamable HTTP endpoint at mcp.rosti.dev; no local install. Works without credentials on a shared anonymous quota, or with a Rösti account sign-in or a personal Rösti API key sent in the X-API-Key header for your own quota.
Before you install
Without sign-in or your own key, calls share an anonymous quota that can run out. A match only means the value was mentioned in a report, and report titles, IOC comments and YARA rules are third-party content. Export links are signed and expire after 15 minutes and are meant to be opened by the user.

Installation

In SourceWeft

  1. Open Rösti Threat Intel in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.rosti%2Frosti/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "r-sti-threat-intel": {
      "type": "http",
      "url": "https://mcp.rosti.dev/mcp"
    }
  }
}

Tools

11

lookup_iocs

Look up IOCs

Check many IOCs (indicators of compromise) at once against Rösti's threat-intelligence reports. Defanged values (hxxps://evil[.]com, 1.2.3[.]4, user[at]evil[.]com) are refanged before the lookup; `refanged` shows which. Matching is exact, with a case-insensitive fallback. For each value that is found, returns the reports it appears in (newest first) with the IOC's type, category, tags, IDS flag, comment and false-positive risk. Values that are not found are listed in `not_found`. Every value is also checked against the Rösti False Positive Warninglist (popular domains, public DNS resolvers, ...): found values carry `false_positive_verdict`, not-found values appear in `false_positive_verdicts`; values without a verdict are left out. Use lookup_ioc for all matches of a single value.

Parametersvaluesrequiredmax_matches_per_value

lookup_ioc

Look up an IOC

Check whether one IOC (indicator of compromise) appears in Rösti's threat-intelligence reports. A defanged value (hxxps://evil[.]com, 1.2.3[.]4) is refanged before the lookup; `input` then shows the value as given. Matching is exact, with a case-insensitive fallback. Returns every report the value appears in (newest first, up to max_matches) with the IOC's type, category, tags, IDS flag, comment and false-positive risk. Also checks the value against the Rösti False Positive Warninglist (popular domains, public DNS resolvers, ...) and returns its verdict in `false_positive_verdict`, also when Rösti does not know the value; null when the warninglist has no verdict.

Parametersvaluerequiredmax_matches

search_iocs

Search IOCs

Search IOCs across all Rösti reports by text, type, tag, category and creation time. Without filters, lists IOCs from all reports. Each IOC carries its report id (use get_report for the report), type, category, tags, IDS flag, comment and false-positive risk. Use lookup_ioc or lookup_iocs to check whether specific values are known.

Parameterstagsexactlimitquerysincetypescursorcategories

search_reports

Search reports

Search Rösti's threat-intelligence reports by text, source, CVE, MITRE ATT&CK id and publication date. Returns report summaries: title, date, source, authors, tags, counts of IOCs, YARA rules and MITRE ids, and links to the original report and rosti.dev. Use get_report for the details of one report.

Parameterscvessortlimitquerycursorsourcesmitre_idspublished_afterpublished_before

get_report

Get a report

Get one Rösti report: metadata, MITRE ATT&CK ids, CVEs, available export formats, and how many of its IOCs there are per type and per tag. Use list_report_iocs for the IOCs themselves and get_yara_rules for its YARA rules.

Parametersreport_idrequired

list_report_iocs

List a report's IOCs

List the IOCs of one Rösti report, optionally filtered by type, tag, category or text. IOCs with the same entity_ref belong together, e.g. the MD5, SHA-1 and SHA-256 of one file. Each IOC carries its IDS flag and false-positive risk.

Parameterstagslimitquerytypescursorreport_idrequiredcategories

get_yara_rules

Get YARA rules

Get the YARA rules published with one Rösti report, with their full source.

Parametersreport_idrequired

list_sources

List sources

List the publishers whose reports Rösti collects (vendor blogs, CERTs, researchers), with report counts, the newest report date and whether the source is still active. Source ids work as the sources filter of search_reports.

Parameterslimitquerycursor

describe_taxonomy

Describe the taxonomy

List the values Rösti uses for IOC types, IOC tags (with descriptions), IOC categories and export formats, and explain the false-positive risk scale. Use these values for the filters of the search and list tools.

Takes no parameters.

Version history

2
  1. v0.2.1LatestNov 5, 2026
  2. v0.1.0Nov 4, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.