Truss Threat Intelligence

com.truss-security由 truss-security.com 发布官方发布者v1.1.0更新于 Oct 25, 2026

Query Truss threat intelligence via hosted MCP (OAuth). Growth+ plans.

已验证Streamable HTTP可网页运行安全与监控数据与分析

概览

AI 生成的概览

托管的 Truss 威胁情报 MCP 服务器，让助手搜索威胁数据、构建 FilterQL 查询、导出 STIX 并起草 SIEM/EDR 检测规则。

可以做什么
通过托管 MCP 端点搜索 Truss 威胁情报产品和威胁背景，助手会在查询 API 前确认意图（默认 7 天窗口）。起草、校验并运行 FilterQL 过滤器以查询 Truss API。将结果导出为 JSON 或 STIX，并生成 Splunk、Falcon 或 Cortex 的狩猎查询。可选运行本地 stdio 服务器和带实时 MCP 工具的终端 REPL。
适用场景
适合已拥有 Growth+ Truss 账户的安全分析师和检测工程师，希望在 Cursor、Claude Desktop 等 MCP 客户端中让助手查询 Truss 威胁情报、细化过滤器并把结果转化为 SIEM/EDR 检测查询。
运行要求
远程端点 OAuth 授权；需要 Growth+ Truss 账户（Community 账户无法授权）。可选的本地 stdio 模式需要 Node.js 18+、truss-mcp 可执行文件和 TRUSS_API_KEY；终端 REPL 还需要 LLM_PROVIDER、LLM_MODEL 以及 ANTHROPIC_API_KEY 或 OPENAI_API_KEY。
安装前请注意
OAuth 授权后助手可访问你的 Truss 账户数据；可选的 --save-token 会把访问令牌写入磁盘（权限 0600），调试后应删除。查询窗口越大可能消耗越多 API 配额。本地 stdio 模式需要 TRUSS_API_KEY，REPL 会通过 ANTHROPIC_API_KEY 或 OPENAI_API_KEY 将提示发送给第三方 LLM 提供商。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Truss Threat Intelligence，将其添加到工作区。
  2. 连接 所需的 凭据。它们会被私密存储，绝不会在公开页面上展示。
  3. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/com.truss-security%2Ftruss-mcp/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。 客户端会在首次连接时完成 OAuth 登录。

{
  "mcpServers": {
    "truss-threat-intelligence": {
      "type": "http",
      "url": "https://api.truss-security.com/mcp"
    }
  }
}

README

truss-agent-mcp

Truss threat intelligence via Model Context Protocol and a terminal assistant — one binary: truss-mcp.

[smithery badge]

Truss MCP on Smithery

Two surfaces

SurfaceUse forAuth
Remote (recommended)Cursor, Claude Desktop, MCP registriesOAuth → https://api.truss-security.com/mcp
Local stdio (legacy)Air-gap / BYO-key / FilterQL REPL toolsTRUSS_API_KEY → REST

Hosted MCP (OAuth, Growth+ gate, five tools) is served by the Truss API. This package ships configs, validate-remote / doctor --remote, CLI search, and optional local stdio. Community accounts cannot consent to hosted MCP.

Not on npm yet. Install from this repo (npm install -g .). After publish: npm install -g @truss-security/truss-agent-mcp.

Quick start

bash
cd truss-agent-mcpnpm install && npm run buildnpm install -g .truss-mcp doctor --remote --strict-oauth   # OAuth path hosts usetruss-mcp init                            # for CLI search / legacy stdiotruss-mcp search

Node.js 18+. Binary name truss-mcp avoids conflict with @truss-security/truss-sdk's truss command.

What you can run

CommandWhat it does
truss-mcp searchGuided REPL with live MCP tools (local stdio or remote OAuth token)
truss-mcp mcpLocal stdio MCP server (legacy / air-gap)
truss-mcp initInteractive .env setup
truss-mcp doctorValidate keys and API access; --remote runs hosted OAuth doctor
truss-mcp validate-remote <url>OAuth + MCP doctor (discovery, DCR, PKCE, tools)
truss-mcp helpUsage summary

Guided search workflow

One REPL with MCP tools always connected. The assistant classifies your intent and asks before querying Truss API:

  1. Knowledge — Truss platform, cyber security context, threat background
  2. Build filter — draft FilterQL, validate, confirm
  3. Query — run executes confirmed filter (default 7 days)
  4. Format — stix for STIX export; JSON summaries in-thread
  5. Detection rules — detect splunk, detect falcon, detect cortex from search results

The assistant offers next steps explicitly: build a filter, refine it, query Truss API, export JSON/STIX, or generate SIEM/EDR hunting queries.

  • Wider windows (run 30, days 30) may use more API quota
  • Context-only follow-ups (IOC dedupe, reformat) use thread history without re-querying

Full REPL reference: guides/truss-cli.md

Terminal display (REPL)

truss-mcp search uses color-coded, ASCII-bordered output:

  • You — your message
  • MCP — live tool trace (→ search_threats on remote, or → search_products on stdio)
  • Results — structured product table before the assistant summary
  • Truss — assistant reply (cyan), guided offers (yellow), FilterQL blocks (magenta)

Controls: color / color on / color off / color auto · env TRUSS_MCP_COLOR · standard NO_COLOR=1

MCP host (Cursor / Claude) — remote OAuth (recommended)

No API key in host config. Growth+ Truss account; browser OAuth consent.

json
{  "mcpServers": {    "truss-mcp": {      "url": "https://api.truss-security.com/mcp"    }  }}

Samples: config/cursor.mcp.json · config/claude_desktop_config.json · guides/client-setup-cursor.md.

Legacy stdio (air-gap)

json
{  "mcpServers": {    "truss-mcp": {      "command": "truss-mcp",      "args": ["mcp"],      "env": { "TRUSS_API_KEY": "YOUR_KEY" }    }  }}

See config/cursor.mcp.stdio.json and guides/getting-started.md.

Remote MCP OAuth validation (registry gate)

Use as the OAuth + MCP doctor before registry publish or release. After OAuth it requires search_threats to return at least one Truss product (id + title). The access token stays in memory for that process only unless you pass --save-token.

bash
truss-mcp doctor --remote --strict-oauth# or:truss-mcp validate-remote https://api.truss-security.com/mcp --strict-oauth

After token exchange it prints an OAuth compatibility checklist (resource URI, redirects, PKCE S256, issuer match, audience vs MCP resource, truss_role), then proves MCP access with real Truss data.

Options:

bash
truss-mcp validate-remote https://api.truss-security.com/mcp --verbosetruss-mcp validate-remote https://api.truss-security.com/mcp --strict-oauthtruss-mcp validate-remote https://api.truss-security.com/mcp --save-token /tmp/truss-mcp-tokentruss-mcp validate-remote https://api.truss-security.com/mcp --token-file /tmp/truss-mcp-tokentruss-mcp validate-remote https://api.truss-security.com/mcp --port 9877truss-mcp validate-remote https://api.truss-security.com/mcp --no-open
  • --verbose — HTTP statuses, key headers, truncated bodies (tokens redacted)
  • --strict-oauth — exit 2 if the OAuth checklist has WARN/FAIL (even when Truss MCP calls succeed)
  • --save-token PATH — write the access token for local replay (mode 0600; delete after debugging)
  • --token-file PATH — skip browser OAuth; reuse a saved token to re-check MCP access + Truss data

Optional automated OAuth data tests (saved token + TRUSS_RUN_MCP_OAUTH=1) are documented in guides/publishing.md.

Official listing: server.json (com.truss-security/truss-mcp) · Tracker: guides/registry-submission.md · Internal metadata: config/mcp-registry.json · Architecture: docs/05-hosted-mcp-oauth-architecture.md

Configuration

Env load order (shell vars win): ~/.config/truss/env → ~/.truss/.env → ./.env

VariableRequired forNotes
TRUSS_API_KEYlocal mcp / stdio searchFrom Truss dashboard (legacy air-gap only)
TRUSS_MCP_URLremote search / doctorDefault https://api.truss-security.com/mcp
TRUSS_MCP_OAUTH_TOKEN_FILEremote searchBearer token from validate-remote --save-token
LLM_PROVIDERsearchanthropic or openai — set via init
LLM_MODELsearchSet via init
ANTHROPIC_API_KEY / OPENAI_API_KEYsearchPer provider

Full list: env.example

Documentation

Guides — install, REPL, MCP clients, FilterQL examples

Reference — API contract, tools, architecture (docs/README.md — docs 01–06)

Development

bash
npm install && npm run buildnpm testnpm run truss:search    # from source without global install

Contributors / AI agents: see AGENTS.md for repo operations and conventions.

Publish: guides/publishing.md · Changes: CHANGELOG.md

Related

MIT

来源：README.md，提交 e900a45

工具

0
该服务器需要登录，因此 SourceWeft 无法在没有账号的情况下读取其工具，也未收录。已连接账号所能看到的内容可能因账号及其权限而异。

版本历史

1
  1. v1.1.0最新Sep 16, 2026

评分

已满足适用检查项的 85%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分