Intelthreadlinqs Mcp

io.github.threadlinqs-cmdPublished by GitHub account threadlinqs-cmdv7.1.3Updated Oct 24, 2026

Threadlinqs threat-intelligence MCP — 49 tools: threats, detections, IOCs, actors, C2, MITRE, CVEs

VerifiedSTDIODesktop onlyKnowledge & MemorySecurity & Monitoring

Overview

AI-generated overview

Threadlinqs threat-intelligence MCP server that lets an assistant query threats, IOCs, actors, C2 infrastructure, MITRE coverage and CVEs from a paid…

What you can do
  • Search and profile threats, threat actors and similar threats, with attribution and TTP detail
  • Look up IOCs, C2 beacons and infrastructure pivots, and generate firewall-ready C2 blocklists
  • Retrieve detection rules in Splunk SPL, KQL and Sigma, and map or draft detections against MITRE ATT&CK
  • Triage CVEs with exploitation velocity, KEV status and detection coverage
  • Run composite bundles such as threat-hunting dossiers, actor intelligence, MITRE gap analysis and technique-transition prediction
  • Invoke analyst-playbook prompts for triage, hunting, attribution review, purple-team planning and exports
When to use it
Useful for security analysts, detection engineers and SOC or purple-team work where the assistant should pull structured threat intelligence, hunt an indicator found in logs, or decide which detections to write next. Only worth adding if you already hold a Purple or Gold Threadlinqs subscription.
Requirements
Runs locally over stdio via npx, so Node.js 18 or newer is needed. Requires a THREADLINQS_API_KEY environment variable holding a Purple or Gold tier key; an optional THREADLINQS_API_URL overrides the API base URL. Network access to the Threadlinqs API is required for tool calls.
Before you install
Paid subscription required: tool calls are gated server-side and return access-denied errors without a Purple or Gold key, and signup alone only gives a lower tier. The API key is a secret passed in the environment. Queries and indicator values are sent to the Threadlinqs API and its external enrichment feeds. Generated blocklists and detection rules should be reviewed before deployment.

Installation

In SourceWeft

  1. Open Intelthreadlinqs Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

intelthreadlinqs-mcp

MCP server for Threadlinqs Intelligence — 81 tools and 25 analyst-playbook prompts across threat intelligence, detections, IOCs, threat actors, MITRE attack-chains, C2 infrastructure, and Purple-tier composite intelligence. Drop-in for Claude Code, Claude Desktop, Cursor, and any MCP-compatible client.

[npm version] [Node] [License: MIT]

What this gives your AI agent

  • 1,700+ threats with full metadata, severity, attribution, CVE/CWE, MITRE
  • 16,000+ detection rules in Splunk SPL, Microsoft KQL, and Sigma YAML
  • 47,000+ IOCs (IPs, domains, hashes, URLs, behavioral)
  • 500+ threat actors with TTPs profiles and cross-actor infrastructure links
  • 140+ live C2 beacons (Cobalt Strike) with watermark clustering + operator attribution
  • Daily intelligence debriefs + 7-engine correlation analytics
  • MITRE attack-chain prediction based on 4,271 observed technique transitions

Quick install

bash
# No install needed — npx will fetch itnpx -y intelthreadlinqs-mcp

Claude Code

bash
claude mcp add threadlinqs-intel \  -e THREADLINQS_API_KEY=tl_your_key_here \  -- npx -y intelthreadlinqs-mcp

The -e THREADLINQS_API_KEY is required in practice. The Threadlinqs Intelligence MCP server is a Purple-tier feature — it checks your key's tier at startup and warns if it is missing, invalid, or below Purple. The server still starts and exposes its tool catalog so clients and registries can introspect it, but tool calls are gated server-side: without a Purple or Gold key (tier ≥ 3) they return an Access denied error instead of data. There is no free or anonymous access to gated intelligence.

Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json:

json
{  "mcpServers": {    "threadlinqs-intel": {      "command": "npx",      "args": ["-y", "intelthreadlinqs-mcp"],      "env": {        "THREADLINQS_API_KEY": "tl_your_key_here"      }    }  }}

Cursor

.cursor/mcp.json:

json
{  "mcpServers": {    "threadlinqs-intel": {      "command": "npx",      "args": ["-y", "intelthreadlinqs-mcp"],      "env": {        "THREADLINQS_API_KEY": "tl_your_key_here"      }    }  }}

VS Code

.vscode/mcp.json:

json
{  "servers": {    "threadlinqs-intel": {      "type": "stdio",      "command": "npx",      "args": ["-y", "intelthreadlinqs-mcp"],      "env": {        "THREADLINQS_API_KEY": "tl_your_key_here"      }    }  }}

Getting an API key

Sign up at intel.threadlinqs.com, verify your email, and head to Profile → API Key. Note that signing up alone lands you on Blue (tier 1) — MCP tool calls need tier ≥ 3, so they return an under-tier error until you upgrade. A 7-day Purple free trial is offered at checkout on the pricing page.

Access — Purple tier only

The MCP server is a Purple-tier feature: all 81 tools require a Purple or Gold subscription (tier ≥ 3). The server checks your key's tier at startup and warns when it is missing, invalid, or below Purple — it still starts and lists its tools so clients can introspect the catalog, but the tier is enforced server-side on every call, so gated tools return Access denied rather than data. There is no free or anonymous access to gated intelligence.

TierPriceMCP access
Purple$11.99/mo✅ All 81 tools
GoldCustom✅ All 81 tools (team — contact sales)
Lower tiers—❌ No MCP access (the public website + REST API keep their own free Blue tier)

A 7-day Purple free trial is available at checkout on the pricing page — it is not granted by signup alone. Tool calls enforce the tier server-side and return a structured 403 if your subscription lapses.

v4.3 flagship tools (Purple tier)

The composite tools are the reason most people upgrade to Purple — each one replaces 5–7 single-purpose MCP calls.

get_threat_hunting_bundle ⭐

Input: threat_id (e.g. "TL-2026-0599")

Returns: complete hunt dossier in one shot — threat metadata, full IOC list, SPL/KQL/Sigma detection queries, similar threats, simulation commands, and cross-threat infrastructure pivots. The single most useful tool in the platform.

get_actor_intelligence

Input: actor name (e.g. "Lazarus Group", "APT29")

Returns: comprehensive adversary picture — actor profile, attributed threats, MITRE techniques, IOCs (200 cap), detection rules (100 cap), activity timeline, active C2 infrastructure correlated to the actor, and cross-actor shared entities.

get_ioc_intelligence

Input: ioc_value (IP, domain, hash, URL)

Returns: every threat that touches the IOC + actor attribution + DNS enrichment trail + cross-IOC infrastructure pivots + consensus confidence score across 7 external feeds (Pulsedive, GreyNoise, YARAify, MalwareBazaar, URLScan, VxVault, OpenPhish). The "I found this in a log — tell me everything" workflow.

get_cve_intelligence

Input: cve_id (e.g. "CVE-2024-3400")

Returns: CVE detail + linked threats + EPSS exploitation velocity + KEV status + detection coverage % + available attack simulations + first-weaponization timeline.

get_mitre_gap_analysis

Input: optional tactic filter, limit

Returns: prioritized list of MITRE techniques without detection coverage, sorted by debt score (threat exposure + KEV count + EPSS). Each entry includes example threats and recommended detection types. Answers "what should I write detections for next?"

predict_mitre_transitions

Input: technique_id (e.g. "T1566"), top_n, direction (forward | reverse)

Returns: ranked next-technique predictions with probability and observation count, plus example threats showing the chain. Built from 4,271 observed transitions across the corpus.

generate_c2_blocklist

Input: none.

Returns: firewall-ready blocklist of active C2 IPs with country, ASN, version, watermark, and last-seen metadata. Currently tracking Cobalt Strike beacons. For operator clustering call get_c2, and for unmasked C2 domains get_c2_dns_intel.

Specialized tools

  • search_actors — Find threat actors by name, alias, nation-state, or motivation.
  • get_actor — Full actor dossier in a single call.
  • get_similar_threats — Precomputed-similarity matches by shared TTPs, IOC overlap, and same-actor attribution.

Agent skill

A portable skill that teaches any MCP client how to route across these tools — which tool to call first, the hunt query grammar, the response budget, and the data caveats that keep answers honest. Generated from the live catalog, so its tool reference cannot drift.

Prompts — 25 analyst playbooks

Prompts are pre-built workflows that orchestrate the tools for you. Rather than working out which of 81 tools to chain, invoke a playbook and the agent gets an ordered, argument-correct plan. Between them they reach every tool on the server, so an agent that only reads prompts/list still finds the whole surface.

PlaybookWhat it does
orientStart here — catalog, corpus shape, categories, TLQL grammar
triage_cveCVE end-to-end: severity, exploitation, exposure, remediation
profile_actorActor dossier: TTPs, targeting, attribution confidence
hunt_iocIndicator → linked threats, blast radius, blocking action
hunt_corpusAggregate questions in TLQL over the hunt index
research_questionOpen-ended research via semantic corpus search
map_detections_to_mitreMap a threat's SPL/KQL/Sigma to ATT&CK, flag gaps
review_detection_gapsHighest-value detection debt, ranked by exposure
write_detectionDraft a deployable rule grounded in corpus logic
predict_next_moveForecast the next (or preceding) ATT&CK techniques
explain_linkWhy two threats are linked, with the evidence
map_campaignCampaign members, shared infra, pivotal entities
review_attributionAudit whether an attribution is evidence-backed
pivot_infrastructurePivot across DNS, hosting and adjacent infrastructure
malware_dossierProfile a malware family or offensive tool
build_c2_blocklistFirewall-ready C2 blocklist with operator clustering
osint_sweepFold community signal in; surface coverage lead time
sweep_vulnerabilitiesTriage by exploitability, not CVSS alone
plan_purple_teamSimulations paired with the detections they should trip
export_for_toolingSTIX 2.1, ATT&CK Navigator, SIEM-ready rules
bulk_enrichBatch a list of threat/CVE ids without N round-trips
assess_exposureCovered vs uncovered for a CVE, actor or technique
daily_briefToday's posture, top new threats, daily theme
period_reviewReview a day or span from the debrief archive
platform_statusCorpus health, engine state, enrichment completeness

Full tool catalog

For the complete list of 81 tools with parameters and example invocations, see the interactive MCP documentation page.

Architecture

  • Transport: stdio (local subprocess)

  • Auth: THREADLINQS_API_KEY environment variable (Bearer token to the worker API)

  • Runtime: Node ≥18

  • SDK: @modelcontextprotocol/sdk@^1.26.0

  • Backend: Cloudflare Workers + D1 (multi-region)

  • Purple gate: the server checks the API key's tier at startup and warns if it is missing, invalid, or below Purple/Gold (tier ≥ 3) — it starts regardless so the tool catalog stays introspectable; the gate itself is enforced server-side on every tool call (structured 403 on lapse or under-tier)

  • Introspection has three tiers (since 8.1.0): authenticated tools/list → the public /mcp/catalog.json → a catalog snapshot bundled in the package. The first two need network; the third does not, so tools/list returns the real catalog even in a fully network-isolated sandbox. Previously that case returned an empty array — not an error, an empty list, which is indistinguishable from a server with no tools, and is why registry scanners indexed this server with zero tools.

    Maintainers: regenerate the snapshot with npm run sync:catalog after deploying the worker, since the worker owns the tool and prompt registries. npm run test:catalog fails the build when the snapshot and the live catalog disagree, and it runs on prepublishOnly.

Links

License

MIT © Threadlinqs

Source: README.md at commit edaed16

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v7.1.3LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts