Threatcluster

io.github.Jam0kPublished by GitHub account Jam0kv0.2.3Updated Oct 26, 2026

Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

ThreatCluster MCP gives an assistant live cyber threat intelligence: incident clusters, actor and malware profiles, CVEs with KEV/EPSS, and ransomware…

What you can do
  • Search incident clusters by keyword, or search clusters, entity profiles and dark-web hits in one call
  • List what is new over 1h, 24h, 7d or 30d, and fetch a full cluster record with timeline, articles, entities and optional validated indicators
  • Look up profiles of actors, malware, tools, vendors, products, countries, industries and CVEs, and see which entities are trending
  • Check a single CVE for CVSS, EPSS, KEV due date and exploits, or list exploited vulnerabilities filtered by KEV, exploit, severity, vendor or product
  • Browse ransomware leak-site victims by sector, group, country or victim, with a tally of the window
  • Report remaining API credits and rate state without spending a call
When to use it
Useful when an assistant needs current, citable answers about breaking incidents, threat actors, exploited CVEs or ransomware victims, for example in security research, vulnerability triage or briefing work. It is a read-only intelligence lookup, not a scanner or a feed of raw indicators.
Requirements
A ThreatCluster API key in THREATCLUSTER_API_KEY (or sent as the X-API-Key header); free keys are available. Runs as a local process via npx (Node 18+) or uvx (Python 3.10+), or as a hosted remote endpoint. Optional THREATCLUSTER_API_BASE and THREATCLUSTER_SITE override the API and site base URLs. Network access to the ThreatCluster API is required.
Before you install
The API key is a secret: it is sent as the X-API-Key header to the configured API base, so a changed THREATCLUSTER_API_BASE would send it elsewhere. Calls spend API credits (free keys get 100 a day, 30 requests a minute, 7-day lookback), and some tools cost several credits per call. Queries and their terms go to ThreatCluster. Leak-site listings are claims, not verified facts.

Installation

In SourceWeft

  1. Open Threatcluster in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.Jam0k%2Fthreatcluster/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "threatcluster": {
      "type": "http",
      "url": "https://threatcluster.io/mcp"
    }
  }
}

README

ThreatCluster: free CTI API and MCP server

A free threat intelligence API (100 credits a day, no card) and an MCP server over it. Ask Claude, Cursor or any MCP client what is new, who was hit, whether a CVE is exploited, and get answers from a live corpus of deduplicated incident clusters, actor and malware profiles, CVEs with KEV and EPSS, and ransomware leak-site victims.

An MCP server that gives Claude, Cursor, VS Code, Windsurf, Zed and any other MCP client live threat intelligence from ThreatCluster (setup guide): incident clusters (one deduplicated story per incident, with a threat score, timeline and extracted entities), entity profiles (actors, malware, tools, vendors, CVEs), CVE records with KEV / EPSS / exploit status, and ransomware leak-site victims.

It is a thin, auditable wrapper over the public REST API. Every tool call is one or two GETs to https://threatcluster.io/api/public/v1 with your API key; nothing else leaves your machine, and there is no telemetry.

Why this and not a feed aggregator

Most free CTI MCP servers wrap other people's indicator feeds (OTX, abuse.ch, AbuseIPDB). ThreatCluster is the corpus itself: every story is one cluster built from every source that covered it, with a threat score, a timeline and the entities extracted from the text, plus the leak-site victim list and CVE exploit status in the same API. The free key covers all of it with a 7-day lookback; paid plans extend the window. Details and the hosted endpoint (https://threatcluster.io/mcp) are at threatcluster.io/about/free-api.

Published twice from one tool spec, so both are identical:

RuntimeInstallPackage
Python 3.10+uvx threatcluster-mcp (or pipx run threatcluster-mcp)PyPI: threatcluster-mcp
Node 18+npx -y threatcluster-mcpnpm: threatcluster-mcp

1. Get a key

Free keys carry the five read scopes, 100 credits a day, 30 requests a minute and a 7-day lookback: https://threatcluster.io/api. Put it in THREATCLUSTER_API_KEY. If you use the tc CLI and have run tc auth login, the Python server picks that credential up automatically (keyring or the ~/.config/tc-cli/credentials file); the Node server reads the file only.

2. Add the server

Claude Code

bash
claude mcp add threatcluster -e THREATCLUSTER_API_KEY=tc_live_... -- npx -y threatcluster-mcp# or the Python build:claude mcp add threatcluster -e THREATCLUSTER_API_KEY=tc_live_... -- uvx threatcluster-mcp

Claude Desktop (claude_desktop_config.json, Settings > Developer > Edit Config)

json
{  "mcpServers": {    "threatcluster": {      "command": "npx",      "args": ["-y", "threatcluster-mcp"],      "env": { "THREATCLUSTER_API_KEY": "tc_live_..." }    }  }}

Cursor — one-click: see listings/cursor-deeplink.md, or add to ~/.cursor/mcp.json / .cursor/mcp.json:

json
{ "mcpServers": { "threatcluster": { "command": "npx", "args": ["-y", "threatcluster-mcp"], "env": { "THREATCLUSTER_API_KEY": "tc_live_..." } } } }

VS Code (.vscode/mcp.json; the input prompts for the key instead of storing it in the file)

json
{  "inputs": [{ "type": "promptString", "id": "tc-key", "description": "ThreatCluster API key", "password": true }],  "servers": {    "threatcluster": { "type": "stdio", "command": "npx", "args": ["-y", "threatcluster-mcp"], "env": { "THREATCLUSTER_API_KEY": "${input:tc-key}" } }  }}

Windsurf (~/.codeium/windsurf/mcp_config.json) — same mcpServers block as Claude Desktop.

Zed (settings.json)

json
{ "context_servers": { "threatcluster": { "command": { "path": "npx", "args": ["-y", "threatcluster-mcp"], "env": { "THREATCLUSTER_API_KEY": "tc_live_..." } } } } }

Check a configuration without starting a client: THREATCLUSTER_API_KEY=... npx -y threatcluster-mcp --check (prints where the key came from and where it will be sent — never the key).

3. Tools

Costs are ThreatCluster API credits (free keys: 100 a day). Every result carries cost (credits this call spent), budget (remaining today, from the response headers), as_of, and url fields on every cluster, entity, victim and CVE for citation.

ToolWhat it answersAPI endpoint(s)Credits
search_threatsKeyword search over incident clusters; phrase, then all words, then any word; matched_stage says whichGET /threats?keyword= per term1 per term (max 8 calls)
search_everythingClusters, entity profiles and dark-web hits in one callGET /search5
newest_threatsWhat is new in 1h / 24h / 7d / 30d, by first report or by momentumGET /threats1
get_threatFull record for one cluster: summary, timeline, articles, entities; include_iocs adds validated indicatorsGET /threats/{id} (+ /iocs)1 (+1)
leak_site_victimsRansomware leak-site listings by sector / group / country / victim, plus a tally of the whole windowGET /darkweb/ransomware/victims + /facets2
lookup_entityProfile of an actor, malware, tool, vendor, product, country, industry or CVEGET /entities/search + GET /entities/{type}/{value}2
get_vulnerabilityOne CVE: CVSS, EPSS, KEV with due date, exploits, vendors, productsGET /vulnerabilities/{cve_id}1
exploited_vulnerabilitiesCVEs in a window filtered to KEV / public exploit / severity / vendor / productGET /vulnerabilities1
trending_entitiesActors, malware, tools, vendors, CVEs, countries rising over a windowGET /entities/trending1
api_budgetRemaining credits and rate state from the last responses — no API call—0

One prompt, threatcluster_analyst, carries the analyst rules (tools first, cite every fact with the returned url, say what period you searched, leak-site listings are claims).

Errors come back as MCP tool errors with the API's own message: 401 tells the agent to set THREATCLUSTER_API_KEY and where a free key comes from, 429 carries the Retry-After, 403 names the missing scope or the lookback window and the plan that lifts it.

More on threatcluster.io

Security

  • The key is read from THREATCLUSTER_API_KEY (then TC_REFRESH_TOKEN, then the tc-cli store) and sent only as the X-API-Key header (or Authorization: Bearer for a JWT minted by tc login) to THREATCLUSTER_API_BASE.
  • It is never logged, never printed by --check, never written to disk, and scrubbed from every error string; the test suites assert the key is absent from all stdout and stderr bytes, including on a 401 whose body quotes it.
  • stdio only. No outbound connection other than the API. No analytics.
  • All tools are read-only (readOnlyHint: true) and validate arguments against the spec before any request is made.

Environment

VariableDefaultPurpose
THREATCLUSTER_API_KEY—your key (tc_live_…, tc_agent_…) or a bearer from tc login
THREATCLUSTER_API_BASEhttps://threatcluster.io/api/public/v1API base (self-hosted or local test servers)
THREATCLUSTER_SITEhttps://threatcluster.iobase for the url fields in results

Repository layout

tools/tools.json   the single source of truth: tools, schemas, endpoint mapping, credits, promptpython/            PyPI package (hatchling; mcp + httpx)          -> console script threatcluster-mcpnode/              npm package (TypeScript; @modelcontextprotocol/sdk + zod) -> bin threatcluster-mcptests/fixtures/    recorded API responses and tool outputs; both packages must replay them identicallylistings/          directory manifests and submission copy (Smithery, MCP registry, Glama, mcp.so, Cursor, VS Code).github/workflows/ CI (both suites) and tag-triggered publishing (PyPI trusted publishing, npm provenance)

python3 tools/sync_tools.py copies the spec into both packages; CI fails if the copies drift.

Development

bash
pip install -e "python/[test]" && (cd python && pytest)cd node && npm install && npm test# live validation against a real API (spends ~30 credits, re-records tests/fixtures):THREATCLUSTER_LIVE=1 THREATCLUSTER_API_KEY=... THREATCLUSTER_API_BASE=... pytest python/tests/test_live.py

Related: the tc CLI, the API reference, the agent-tool recipe for a bare tool-calling function, and the integration guide.

GPL-3.0-or-later © ThreatCluster Ltd.

Source: README.md at commit f914fbb

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

1
  1. v0.2.3LatestSep 26, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts