mcp-threatintel

[](https://www.npmjs.com/package/mcp-threatintel-server) [](https://github.com/aplaceforallmystuff/mcp-threatintel/actions/workflows/ci.yml) [](https://opensource.org/licenses/MIT) [](https://modelcontextprotocol.io)

MCP server providing unified access to multiple threat intelligence sources for security research and analysis.

If you're doing security research, incident response, or threat analysis, this MCP server lets you:

• Unified lookups - Query IPs, domains, hashes, and URLs across multiple sources simultaneously
• Reduce context switching - No need to open multiple browser tabs for different intel sources
• Correlate intelligence - See results from all configured sources in one response
• Free tier friendly - Works with free API tiers, gracefully degrades when sources unavailable
• Works without keys - Feodo Tracker (botnet C2s) works without any API keys

| Category | Capabilities | |----------|-------------| | Unified Lookups | Query IPs, domains, file hashes, URLs across all sources | | AlienVault OTX | Threat pulses, indicators of compromise, community intelligence | | AbuseIPDB | IP reputation, abuse reports, confidence scores | | GreyNoise | Internet noise vs targeted attacks, scanner identification | | abuse.ch | URLhaus, MalwareBazaar, ThreatFox, Feodo Tracker |

• Node.js 18+
• API keys for your preferred threat intelligence sources (see below)

npx mcp-threatintel-server

Or install globally:

npm install -g mcp-threatintel-server

git clone https://gith