Otx

io.github.w0h1vPublished by GitHub account w0h1vv1.2.0Updated Oct 24, 2026

MCP server for AlienVault OTX threat intelligence: indicators, pulses, search, and users.

VerifiedSTDIODesktop onlyWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

MCP server that gives an AI assistant access to AlienVault OTX threat intelligence: indicators, pulses, users, subscriptions and URL submissions.

What you can do
Search pulses and users, and read pulse details, indicators, related pulses, activity and events, including subscribed pulses and resource templates for pulses and indicators. Enrich and validate indicators such as IP addresses, domains, file hashes, URLs and CVEs, list indicator types and export indicators. Look up users and the current account, and list user or own pulses. With read-write enabled, create pulses, subscribe or unsubscribe to pulses and users, follow or unfollow users, and submit URLs or files.
When to use it
Useful when investigating an IP, domain, hash, URL or CVE, or researching a malware family or adversary, and you want the OTX community's pulses, reputation, passive DNS, whois and sandbox data pulled into the assistant's context.
Requirements
Runs locally as a Python package (Python 3.10 or newer, uv or pip). Requires an AlienVault OTX API key supplied in the OTX_API_KEY environment variable; a free account is enough. Network access to the OTX API. Optional streamable HTTP mode needs a bearer token for network-facing binds.
Before you install
The server acts as your OTX account, so the OTX_API_KEY grants access to that account. Write tools (create pulse, subscribe, follow, submit URL) only appear when read-write is enabled; keep it read-only unless needed. Pulse and indicator text is community-written and untrusted. Never expose HTTP without a bearer token and TLS. Some endpoints can take up to 60 seconds.

Installation

In SourceWeft

  1. Open Otx in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[MCP OTX: threat intelligence for AI agents. Pulses, indicators, passive DNS and malware analysis from AlienVault OTX over the Model Context Protocol.]

[PyPI version] [CI] [License: MIT] [Python 3.10 or newer] [MCP Registry]

Quickstart · Tools · HTTP · Security · Troubleshooting · Docs

mcp-otx is an MCP server that gives AI agents access to AlienVault OTX (Open Threat Exchange, now LevelBlue). Hand your agent an IP, domain, file hash, URL or CVE, or a malware family or adversary to research, and get back what the OTX community knows: pulses, reputation, passive DNS, whois, sandbox analysis and related indicators.

[!NOTE] Independent project, not affiliated with AlienVault or LevelBlue. You need your own OTX API key; a free account is enough.

Highlights

  • Full API coverage. 29 tools across pulses, indicators, users, subscriptions and URL submissions, plus resource templates for pulses and indicators.
  • One-call indicator enrichment. Every OTX indicator type (IPv4, IPv6, domain, hostname, file hash, URL, CVE) and detail section: reputation, geo, passive DNS, malware, whois, URL lists, HTTP scans, sandbox analysis.
  • Read-only by default. The 9 tools that change your OTX account only appear with --read-write.
  • Context-sized output. Large OTX objects are summarized and capped, with the API's total counts kept, so one lookup doesn't fill the model's context.
  • Safe HTTP. stdio for desktop clients, plus streamable HTTP with bearer-token auth. The server refuses to listen on a network-facing address without a token.
  • Tested. Unit tests against a mocked OTX API run in CI on Python 3.10 to 3.13.

How it works

mermaid
flowchart LR    A["AI agent<br/>(Claude, Codex, Gemini, VS Code)"] -->|"MCP over stdio or HTTP"| S["mcp-otx"]    S -->|"HTTPS + X-OTX-API-KEY"| O["OTX DirectConnect API"]    O -->|"JSON"| S    S -->|"summarized, capped JSON"| A

Quickstart

Requirements: Python 3.10 or newer, uv (or pip), and an OTX API key.

sh
# Claude Codeclaude mcp add --transport stdio --env OTX_API_KEY=your-key otx -- uvx otx-mcp
# Codex CLIcodex mcp add otx --env OTX_API_KEY=your-key -- uvx otx-mcp
# Gemini CLIgemini mcp add -e OTX_API_KEY=your-key otx uvx otx-mcp

With pip: pip install otx-mcp, then use the command otx-mcp. For Claude Desktop, VS Code, Cline, Docker and running from source, see Connect a client.

Then ask your agent: "What does OTX know about 8.8.8.8, and are there recent pulses about Emotet?" More prompts are in example workflows.

Tools

20 read tools, plus 9 write tools with --read-write. Full parameters and real sample output are in the tool reference.

AreaRead toolsWrite tools (--read-write)
Searchsearch_pulses, search_users
Pulsesget_pulse_details, get_pulse_indicators, get_related_pulses, search_related_pulses, list_pulse_activity, list_subscribed_pulses, get_subscribed_pulse_ids, get_pulse_eventscreate_pulse, subscribe_pulse, unsubscribe_pulse
Indicatorsget_indicator_details, validate_indicator, list_indicator_types, export_indicators
Usersget_user, get_current_user, list_user_pulses, list_my_pulsessubscribe_user, unsubscribe_user, follow_user, unfollow_user
Submissionslist_submitted_urls, list_submitted_filessubmit_url, submit_urls

Resource templates: otx://pulse/{pulse_id} and otx://indicator/{type}/{value}.

HTTP transport

stdio is the default. For remote or web clients, run streamable HTTP:

sh
OTX_API_KEY=your-key uvx otx-mcp --transport streamable-http# → http://127.0.0.1:8000/mcp

To listen on a network-facing address, set a bearer token. Clients must then send Authorization: Bearer <token>:

sh
OTX_API_KEY=your-key OTX_MCP_BEARER_TOKEN=a-long-random-secret \  uvx otx-mcp --transport streamable-http --host 0.0.0.0
sh
docker build -t mcp-otx .docker run --rm -p 127.0.0.1:8000:8000 -e OTX_API_KEY=your-key \  -e OTX_MCP_BEARER_TOKEN=a-long-random-secret \  -e OTX_MCP_TRANSPORT=streamable-http -e OTX_MCP_HOST=0.0.0.0 mcp-otx

OTX is slow on some endpoints (passive DNS and subscriptions can take 20 to 60 s), so give remote clients a long read timeout (120 s works).

Configuration

VariableCLI flagDefaultDescription
OTX_API_KEY(required)Your OTX API key. Also read from .env
OTX_API_BASEhttps://otx.alienvault.com/api/v1API root (for testing)
OTX_MCP_TRANSPORT--transportstdiostdio, streamable-http or sse
OTX_MCP_HOST--host127.0.0.1HTTP bind address
OTX_MCP_PORT--port8000HTTP port
OTX_MCP_READ_WRITE--read-writeoff1 exposes the account-changing tools
OTX_MCP_BEARER_TOKENoffRequire Authorization: Bearer <token> on HTTP
--allow-remoteoffAllow a network-facing bind without a token (not recommended)
--json-responseoffPlain JSON instead of SSE streams (streamable HTTP)
--stateless-httpoffA new session per request (streamable HTTP)

Security

[!WARNING] The server acts as your OTX account. Keep it read-only unless you need the write tools, and never expose HTTP without a bearer token and TLS.

  • Read-only by default. Pulse creation, subscriptions, follows and URL submissions need --read-write. Editing or deleting pulses isn't exposed as a tool at all.
  • Untrusted content. Pulse and indicator descriptions are written by the OTX community. The server tells the model to treat them as data, not instructions.
  • The API key is sent only to the OTX API, in a header.

Details are in the security model. Report vulnerabilities privately; see SECURITY.md.

Troubleshooting

  • 403 "Authentication required": the API key is wrong. get_current_user shows which account a key belongs to.
  • A write tool is missing: start the server with --read-write.
  • Timeouts: passive DNS and subscription calls can take up to 60 s. Raise your client's tool timeout.

More in the troubleshooting guide.

Development

sh
git clone https://github.com/w0h1v/mcp-otx && cd mcp-otxuv venv && uv pip install -e ".[dev]".venv/bin/python -m pytest    # mocked OTX API, no key or network

See CONTRIBUTING.md and the changelog.

License

MIT. See LICENSE.

Source: README.md at commit d77d277

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.2.0LatestOct 13, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts