Truss Threat Intelligence

com.truss-security由 truss-security.com 發布官方發布者v1.1.0更新於 Oct 25, 2026

Query Truss threat intelligence via hosted MCP (OAuth). Growth+ plans.

已驗證Streamable HTTP可網頁執行安全與監控資料與分析

概覽

AI 產生的概覽

託管的 Truss 威脅情報 MCP 伺服器，讓助理搜尋威脅資料、建立 FilterQL 查詢、匯出 STIX 並草擬 SIEM/EDR 偵測規則。

可以做什麼
透過託管 MCP 端點搜尋 Truss 威脅情報產品與威脅背景，助理會在查詢 API 前確認意圖（預設 7 天視窗）。草擬、驗證並執行 FilterQL 篩選條件以查詢 Truss API。將結果匯出為 JSON 或 STIX，並產生 Splunk、Falcon 或 Cortex 的狩獵查詢。可選擇執行本機 stdio 伺服器與具備即時 MCP 工具的終端 REPL。
適用情境
適合已擁有 Growth+ Truss 帳戶的安全分析師與偵測工程師，希望在 Cursor、Claude Desktop 等 MCP 用戶端中讓助理查詢 Truss 威脅情報、調整篩選條件，並把結果轉成 SIEM/EDR 偵測查詢。
執行需求
遠端端點 OAuth 授權；需要 Growth+ Truss 帳戶（Community 帳戶無法授權）。可選的本機 stdio 模式需要 Node.js 18+、truss-mcp 執行檔與 TRUSS_API_KEY；終端 REPL 另需 LLM_PROVIDER、LLM_MODEL 以及 ANTHROPIC_API_KEY 或 OPENAI_API_KEY。
安裝前請注意
OAuth 授權後助理可存取你的 Truss 帳戶資料；可選的 --save-token 會把存取權杖寫入磁碟（權限 0600），除錯後應刪除。查詢視窗越大可能消耗越多 API 配額。本機 stdio 模式需要 TRUSS_API_KEY，REPL 會透過 ANTHROPIC_API_KEY 或 OPENAI_API_KEY 將提示傳送給第三方 LLM 供應商。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Truss Threat Intelligence，將其新增到工作區。
  2. 連接 所需的 憑證。它們會被私密儲存，絕不會在公開頁面上展示。
  3. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/com.truss-security%2Ftruss-mcp/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。 客戶端會在首次連接時完成 OAuth 登入。

{
  "mcpServers": {
    "truss-threat-intelligence": {
      "type": "http",
      "url": "https://api.truss-security.com/mcp"
    }
  }
}

README

truss-agent-mcp

Truss threat intelligence via Model Context Protocol and a terminal assistant — one binary: truss-mcp.

[smithery badge]

Truss MCP on Smithery

Two surfaces

SurfaceUse forAuth
Remote (recommended)Cursor, Claude Desktop, MCP registriesOAuth → https://api.truss-security.com/mcp
Local stdio (legacy)Air-gap / BYO-key / FilterQL REPL toolsTRUSS_API_KEY → REST

Hosted MCP (OAuth, Growth+ gate, five tools) is served by the Truss API. This package ships configs, validate-remote / doctor --remote, CLI search, and optional local stdio. Community accounts cannot consent to hosted MCP.

Not on npm yet. Install from this repo (npm install -g .). After publish: npm install -g @truss-security/truss-agent-mcp.

Quick start

bash
cd truss-agent-mcpnpm install && npm run buildnpm install -g .truss-mcp doctor --remote --strict-oauth   # OAuth path hosts usetruss-mcp init                            # for CLI search / legacy stdiotruss-mcp search

Node.js 18+. Binary name truss-mcp avoids conflict with @truss-security/truss-sdk's truss command.

What you can run

CommandWhat it does
truss-mcp searchGuided REPL with live MCP tools (local stdio or remote OAuth token)
truss-mcp mcpLocal stdio MCP server (legacy / air-gap)
truss-mcp initInteractive .env setup
truss-mcp doctorValidate keys and API access; --remote runs hosted OAuth doctor
truss-mcp validate-remote <url>OAuth + MCP doctor (discovery, DCR, PKCE, tools)
truss-mcp helpUsage summary

Guided search workflow

One REPL with MCP tools always connected. The assistant classifies your intent and asks before querying Truss API:

  1. Knowledge — Truss platform, cyber security context, threat background
  2. Build filter — draft FilterQL, validate, confirm
  3. Query — run executes confirmed filter (default 7 days)
  4. Format — stix for STIX export; JSON summaries in-thread
  5. Detection rules — detect splunk, detect falcon, detect cortex from search results

The assistant offers next steps explicitly: build a filter, refine it, query Truss API, export JSON/STIX, or generate SIEM/EDR hunting queries.

  • Wider windows (run 30, days 30) may use more API quota
  • Context-only follow-ups (IOC dedupe, reformat) use thread history without re-querying

Full REPL reference: guides/truss-cli.md

Terminal display (REPL)

truss-mcp search uses color-coded, ASCII-bordered output:

  • You — your message
  • MCP — live tool trace (→ search_threats on remote, or → search_products on stdio)
  • Results — structured product table before the assistant summary
  • Truss — assistant reply (cyan), guided offers (yellow), FilterQL blocks (magenta)

Controls: color / color on / color off / color auto · env TRUSS_MCP_COLOR · standard NO_COLOR=1

MCP host (Cursor / Claude) — remote OAuth (recommended)

No API key in host config. Growth+ Truss account; browser OAuth consent.

json
{  "mcpServers": {    "truss-mcp": {      "url": "https://api.truss-security.com/mcp"    }  }}

Samples: config/cursor.mcp.json · config/claude_desktop_config.json · guides/client-setup-cursor.md.

Legacy stdio (air-gap)

json
{  "mcpServers": {    "truss-mcp": {      "command": "truss-mcp",      "args": ["mcp"],      "env": { "TRUSS_API_KEY": "YOUR_KEY" }    }  }}

See config/cursor.mcp.stdio.json and guides/getting-started.md.

Remote MCP OAuth validation (registry gate)

Use as the OAuth + MCP doctor before registry publish or release. After OAuth it requires search_threats to return at least one Truss product (id + title). The access token stays in memory for that process only unless you pass --save-token.

bash
truss-mcp doctor --remote --strict-oauth# or:truss-mcp validate-remote https://api.truss-security.com/mcp --strict-oauth

After token exchange it prints an OAuth compatibility checklist (resource URI, redirects, PKCE S256, issuer match, audience vs MCP resource, truss_role), then proves MCP access with real Truss data.

Options:

bash
truss-mcp validate-remote https://api.truss-security.com/mcp --verbosetruss-mcp validate-remote https://api.truss-security.com/mcp --strict-oauthtruss-mcp validate-remote https://api.truss-security.com/mcp --save-token /tmp/truss-mcp-tokentruss-mcp validate-remote https://api.truss-security.com/mcp --token-file /tmp/truss-mcp-tokentruss-mcp validate-remote https://api.truss-security.com/mcp --port 9877truss-mcp validate-remote https://api.truss-security.com/mcp --no-open
  • --verbose — HTTP statuses, key headers, truncated bodies (tokens redacted)
  • --strict-oauth — exit 2 if the OAuth checklist has WARN/FAIL (even when Truss MCP calls succeed)
  • --save-token PATH — write the access token for local replay (mode 0600; delete after debugging)
  • --token-file PATH — skip browser OAuth; reuse a saved token to re-check MCP access + Truss data

Optional automated OAuth data tests (saved token + TRUSS_RUN_MCP_OAUTH=1) are documented in guides/publishing.md.

Official listing: server.json (com.truss-security/truss-mcp) · Tracker: guides/registry-submission.md · Internal metadata: config/mcp-registry.json · Architecture: docs/05-hosted-mcp-oauth-architecture.md

Configuration

Env load order (shell vars win): ~/.config/truss/env → ~/.truss/.env → ./.env

VariableRequired forNotes
TRUSS_API_KEYlocal mcp / stdio searchFrom Truss dashboard (legacy air-gap only)
TRUSS_MCP_URLremote search / doctorDefault https://api.truss-security.com/mcp
TRUSS_MCP_OAUTH_TOKEN_FILEremote searchBearer token from validate-remote --save-token
LLM_PROVIDERsearchanthropic or openai — set via init
LLM_MODELsearchSet via init
ANTHROPIC_API_KEY / OPENAI_API_KEYsearchPer provider

Full list: env.example

Documentation

Guides — install, REPL, MCP clients, FilterQL examples

Reference — API contract, tools, architecture (docs/README.md — docs 01–06)

Development

bash
npm install && npm run buildnpm testnpm run truss:search    # from source without global install

Contributors / AI agents: see AGENTS.md for repo operations and conventions.

Publish: guides/publishing.md · Changes: CHANGELOG.md

Related

MIT

來源：README.md，提交 e900a45

工具

0
該伺服器需要登入，因此 SourceWeft 無法在沒有帳號的情況下讀取其工具，也未收錄。已連接帳號所能看到的內容可能因帳號及其權限而異。

版本歷史

1
  1. v1.1.0最新Sep 16, 2026

評分

已滿足適用檢查項的 85%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分