Mcp Threatintel

io.github.aplaceforallmystuffPublished by GitHub account aplaceforallmystuffv1.0.1Updated Oct 24, 2026

Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker

VerifiedSTDIODesktop onlyWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that gives an assistant unified threat intelligence lookups for IPs, domains, hashes and URLs across OTX, AbuseIPDB, GreyNoise and abuse.ch.

What you can do
  • Check which threat intel sources are configured and working
  • Look up IPs, domains, file hashes and URLs across all configured sources at once
  • Check IP reputation and abuse history, and tell internet noise from targeted attacks
  • Search and list AlienVault OTX threat pulses
  • Query URLhaus, MalwareBazaar and ThreatFox for malicious URLs, samples and IOCs
  • List active botnet command-and-control servers from Feodo Tracker without any key
When to use it
Useful for security research, incident response and threat analysis where you want to check an indicator against several intel sources in one step instead of opening multiple sites. It also works as a keyless starting point for botnet C2 lookups.
Requirements
Runs locally over stdio via npx or a global npm install; Node.js 18 or newer. Optional API keys, each enabling its source: OTX_API_KEY, ABUSEIPDB_API_KEY, GREYNOISE_API_KEY and ABUSECH_AUTH_KEY. Feodo Tracker needs no key. Network access to the providers is required.
Before you install
The four API keys are secrets stored in the client configuration; anyone with access to that file can read them. Lookups send the indicators you query to third-party services, so avoid submitting sensitive internal addresses or hashes. Free tiers have rate limits, and results are partial when a source fails.

Installation

In SourceWeft

  1. Open Mcp Threatintel in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

MCP Threat Intel Server

[npm version] [CI] [License: MIT] [MCP]

MCP server providing unified access to multiple threat intelligence sources for security research and analysis.

Why Use This?

If you're doing security research, incident response, or threat analysis, this MCP server lets you:

  • Unified lookups - Query IPs, domains, hashes, and URLs across multiple sources simultaneously
  • Reduce context switching - No need to open multiple browser tabs for different intel sources
  • Correlate intelligence - See results from all configured sources in one response
  • Free tier friendly - Works with free API tiers, gracefully degrades when sources unavailable
  • Works without keys - Feodo Tracker (botnet C2s) works without any API keys

Features

CategoryCapabilities
Unified LookupsQuery IPs, domains, file hashes, URLs across all sources
AlienVault OTXThreat pulses, indicators of compromise, community intelligence
AbuseIPDBIP reputation, abuse reports, confidence scores
GreyNoiseInternet noise vs targeted attacks, scanner identification
abuse.chURLhaus, MalwareBazaar, ThreatFox, Feodo Tracker

Prerequisites

  • Node.js 18+
  • API keys for your preferred threat intelligence sources (see below)

Installation

Using npm (Recommended)

bash
npx mcp-threatintel-server

Or install globally:

bash
npm install -g mcp-threatintel-server

From Source

bash
git clone https://github.com/aplaceforallmystuff/mcp-threatintel.gitcd mcp-threatintelnpm installnpm run build

Configuration

For Claude Desktop

Add to your Claude Desktop config file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

json
{  "mcpServers": {    "threatintel": {      "command": "npx",      "args": ["-y", "mcp-threatintel-server"],      "env": {        "OTX_API_KEY": "your-otx-api-key",        "ABUSEIPDB_API_KEY": "your-abuseipdb-api-key",        "GREYNOISE_API_KEY": "your-greynoise-api-key",        "ABUSECH_AUTH_KEY": "your-abusech-auth-key"      }    }  }}

For Claude Code

Add to ~/.claude.json:

json
{  "mcpServers": {    "threatintel": {      "command": "npx",      "args": ["-y", "mcp-threatintel-server"],      "env": {        "OTX_API_KEY": "your-otx-api-key",        "ABUSEIPDB_API_KEY": "your-abuseipdb-api-key",        "GREYNOISE_API_KEY": "your-greynoise-api-key",        "ABUSECH_AUTH_KEY": "your-abusech-auth-key"      }    }  }}

API Keys

ServiceRequiredFree TierGet Key
AlienVault OTXOptionalYes (unlimited)otx.alienvault.com
AbuseIPDBOptionalYes (1,000/day)abuseipdb.com
GreyNoiseOptionalYes (limited)greynoise.io
abuse.chOptionalYesauth.abuse.ch
Feodo TrackerNoYesPublic JSON feeds

Note: Tools are dynamically enabled based on which API keys you provide. Feodo Tracker works without authentication (public JSON feeds).

Usage Examples

Check Available Sources

"What threat intel sources are configured?"

"Show me threatintel status"

IP Investigation

"Check if 185.220.101.1 is malicious"

"Look up this IP across all threat intel sources"

Domain Analysis

"Is evil-domain.com known to be malicious?"

"Check domain reputation"

Malware Hash Lookup

"Look up this SHA256 hash in threat intel"

"Is this file hash known malware?"

URL Analysis

"Check if this URL is in any blocklists"

Botnet Tracking (No API Key Required)

"Show me active botnet C2 servers"

"Get Feodo tracker data for Emotet"

Threat Pulses

"Search OTX for recent ransomware pulses"

"Get latest threat intelligence pulses"

Available Tools

Status

ToolDescription
threatintel_statusCheck which threat intelligence sources are configured

Unified Lookups

ToolDescription
threatintel_lookup_ipLook up IP across all configured sources
threatintel_lookup_domainLook up domain across all configured sources
threatintel_lookup_hashLook up file hash (MD5/SHA1/SHA256) across sources
threatintel_lookup_urlLook up URL across sources

AbuseIPDB (requires API key)

ToolDescription
abuseipdb_checkCheck IP reputation and abuse history

AlienVault OTX (requires API key)

ToolDescription
otx_get_pulsesGet recent threat intelligence pulses
otx_search_pulsesSearch pulses by keyword

GreyNoise (requires API key)

ToolDescription
greynoise_ipCheck if IP is internet noise or targeted threat

URLhaus (requires abuse.ch auth key)

ToolDescription
urlhaus_lookupLook up URL, domain, or IP in URLhaus
urlhaus_recentGet recent malware URLs

MalwareBazaar (requires abuse.ch auth key)

ToolDescription
malwarebazaar_hashLook up malware sample by hash
malwarebazaar_recentGet recent malware samples
malwarebazaar_tagSearch samples by tag

ThreatFox (requires abuse.ch auth key)

ToolDescription
threatfox_iocsGet recent IOCs from ThreatFox
threatfox_searchSearch ThreatFox IOCs

Feodo Tracker (no key required)

ToolDescription
feodo_trackerGet active botnet C2 servers (QakBot, Emotet, Dridex, etc.)

Development

bash
# Watch mode for developmentnpm run watch
# Build TypeScriptnpm run build
# Run locallynode dist/index.js

Troubleshooting

"No threat intel sources configured"

You can use the server without any API keys - Feodo Tracker will still work. For other sources, add the appropriate API keys to your configuration.

"API error: 401 Unauthorized"

Your API key is invalid or expired. Generate a new one from the respective service.

"API error: 429 Too Many Requests"

You've exceeded the rate limit for a service. Wait a while or upgrade your API tier.

Partial results

If some sources return errors, the unified lookup tools will still return results from working sources. Check threatintel_status to see which sources are configured correctly.

Data Sources

AlienVault OTX

Open Threat Exchange - community-driven threat intelligence platform with pulses containing indicators of compromise.

AbuseIPDB

Crowdsourced IP reputation database with abuse reports from network administrators worldwide.

GreyNoise

Identifies IPs scanning the internet vs targeted attacks. Helps reduce false positives in threat detection.

abuse.ch Projects

  • URLhaus - Malware distribution URLs
  • MalwareBazaar - Malware sample repository
  • ThreatFox - IOC sharing platform
  • Feodo Tracker - Botnet C2 infrastructure tracking

Contributing

Contributions are welcome! Please see CONTRIBUTING.md for guidelines.

License

MIT - see LICENSE for details.

Links

Related Projects

For additional threat intelligence capabilities, consider:

Source: README.md at commit b71210b

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts