MCP Threat Intel Server

MCP server providing unified access to multiple threat intelligence sources for security research and analysis.

Why Use This?

If you're doing security research, incident response, or threat analysis, this MCP server lets you:

• Unified lookups - Query IPs, domains, hashes, and URLs across multiple sources simultaneously
• Reduce context switching - No need to open multiple browser tabs for different intel sources
• Correlate intelligence - See results from all configured sources in one response
• Free tier friendly - Works with free API tiers, gracefully degrades when sources unavailable
• Works without keys - Feodo Tracker (botnet C2s) works without any API keys

Features

Category	Capabilities
Unified Lookups	Query IPs, domains, file hashes, URLs across all sources
AlienVault OTX	Threat pulses, indicators of compromise, community intelligence
AbuseIPDB	IP reputation, abuse reports, confidence scores
GreyNoise	Internet noise vs targeted attacks, scanner identification
abuse.ch	URLhaus, MalwareBazaar, ThreatFox, Feodo Tracker

Prerequisites

• Node.js 18+
• API keys for your preferred threat intelligence sources (see below)

Installation

Using npm (Recommended)

npx mcp-threatintel-server

Or install globally:

npm install -g mcp-threatintel-server

From Source

git clone https://github.com/aplaceforallmystuff/mcp-threatintel.git
cd mcp-threatintel
npm install
npm run build

Configuration

For Claude Desktop

Add to your Claude Desktop config file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "threatintel": {
      "command": "npx",
      "args": ["-y", "mcp-threatintel-server"],
      "env": {
        "OTX_API_KEY": "your-otx-api-key",
        "ABUSEIPDB_API_KEY": "your-abuseipdb-api-key",
        "GREYNOISE_API_KEY": "your-greynoise-api-key",
        "ABUSECH_AUTH_KEY": "your-abusech-auth-key"
      }
    }
  }
}

For Claude Code

Add to ~/.claude.json:

{
  "mcpServers": {
    "threatintel": {
      "command": "npx",
      "args": ["-y", "mcp-threatintel-server"],
      "env": {
        "OTX_API_KEY": "your-otx-api-key",
        "ABUSEIPDB_API_KEY": "your-abuseipdb-api-key",
        "GREYNOISE_API_KEY": "your-greynoise-api-key",
        "ABUSECH_AUTH_KEY": "your-abusech-auth-key"
      }
    }
  }
}

API Keys

Service	Required	Free Tier	Get Key
AlienVault OTX	Optional	Yes (unlimited)	otx.alienvault.com
AbuseIPDB	Optional	Yes (1,000/day)	abuseipdb.com
GreyNoise	Optional	Yes (limited)	greynoise.io
abuse.ch	Optional	Yes	auth.abuse.ch
Feodo Tracker	No	Yes	Public JSON feeds

Note: Tools are dynamically enabled based on which API keys you provide. Feodo Tracker works without authentication (public JSON feeds).

Usage Examples

Check Available Sources

"What threat intel sources are configured?"

"Show me threatintel status"

IP Investigation

"Check if 185.220.101.1 is malicious"

"Look up this IP across all threat intel sources"

Domain Analysis

"Is evil-domain.com known to be malicious?"

"Check domain reputation"

Malware Hash Lookup

"Look up this SHA256 hash in threat intel"

"Is this file hash known malware?"

URL Analysis

"Check if this URL is in any blocklists"

Botnet Tracking (No API Key Required)

"Show me active botnet C2 servers"

"Get Feodo tracker data for Emotet"

Threat Pulses

"Search OTX for recent ransomware pulses"

"Get latest threat intelligence pulses"

Available Tools

Status

Tool	Description
threatintel_status	Check which threat intelligence sources are configured

Unified Lookups

Tool	Description
threatintel_lookup_ip	Look up IP across all configured sources
threatintel_lookup_domain	Look up domain across all configured sources
threatintel_lookup_hash	Look up file hash (MD5/SHA1/SHA256) across sources
threatintel_lookup_url	Look up URL across sources

AbuseIPDB (requires API key)

Tool	Description
abuseipdb_check	Check IP reputation and abuse history

AlienVault OTX (requires API key)

Tool	Description
otx_get_pulses	Get recent threat intelligence pulses
otx_search_pulses	Search pulses by keyword

GreyNoise (requires API key)

Tool	Description
greynoise_ip	Check if IP is internet noise or targeted threat

URLhaus (requires abuse.ch auth key)

Tool	Description
urlhaus_lookup	Look up URL, domain, or IP in URLhaus
urlhaus_recent	Get recent malware URLs

MalwareBazaar (requires abuse.ch auth key)

Tool	Description
malwarebazaar_hash	Look up malware sample by hash
malwarebazaar_recent	Get recent malware samples
malwarebazaar_tag	Search samples by tag

ThreatFox (requires abuse.ch auth key)

Tool	Description
threatfox_iocs	Get recent IOCs from ThreatFox
threatfox_search	Search ThreatFox IOCs

Feodo Tracker (no key required)

Tool	Description
feodo_tracker	Get active botnet C2 servers (QakBot, Emotet, Dridex, etc.)

Development

# Watch mode for development
npm run watch

# Build TypeScript
npm run build

# Run locally
node dist/index.js

Troubleshooting

"No threat intel sources configured"

You can use the server without any API keys - Feodo Tracker will still work. For other sources, add the appropriate API keys to your configuration.

"API error: 401 Unauthorized"

Your API key is invalid or expired. Generate a new one from the respective service.

"API error: 429 Too Many Requests"

You've exceeded the rate limit for a service. Wait a while or upgrade your API tier.

Partial results

If some sources return errors, the unified lookup tools will still return results from working sources. Check threatintel_status to see which sources are configured correctly.

Data Sources

AlienVault OTX

Open Threat Exchange - community-driven threat intelligence platform with pulses containing indicators of compromise.

AbuseIPDB

Crowdsourced IP reputation database with abuse reports from network administrators worldwide.

GreyNoise

Identifies IPs scanning the internet vs targeted attacks. Helps reduce false positives in threat detection.

abuse.ch Projects

• URLhaus - Malware distribution URLs
• MalwareBazaar - Malware sample repository
• ThreatFox - IOC sharing platform
• Feodo Tracker - Botnet C2 infrastructure tracking

Contributing

Contributions are welcome! Please see CONTRIBUTING.md for guidelines.

License

MIT - see LICENSE for details.

Links

• Model Context Protocol
• MCP Specification
• GitHub Repository

Related Projects

For additional threat intelligence capabilities, consider:

• @burtthecoder/mcp-shodan - Shodan internet scanning
• @burtthecoder/mcp-virustotal - VirusTotal malware analysis