Connection check
local install
mcp-threatintel
Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker
Tools
17
GitHub stars
7
Installs / wk
149
Licence
MIT
Transport
stdio
Last checked
never
Tools & capabilities
17 toolsRead from the published package source — this server runs locally, so there is no endpoint to query. Names are taken from the code, not observed at runtime, and descriptions are often absent.
abuseipdb_check
from source
Check IP reputation on AbuseIPDB - returns abuse confidence score and recent reports Check IP reputation on AbuseIPDB - returns abuse confidence score and recent reports
feodo_tracker
from source
Get active botnet C2 servers from Feodo Tracker (Emotet, Dridex, QakBot, etc.) Get active botnet C2 servers from Feodo Tracker (Emotet, Dridex, QakBot, etc.)
greynoise_ip
from source
Check if an IP is internet background noise or a targeted threat (GreyNoise) Check if an IP is internet background noise or a targeted threat (GreyNoise)
malwarebazaar_hash
from source
Look up malware sample by hash on MalwareBazaar Look up malware sample by hash on MalwareBazaar
malwarebazaar_recent
from source
Get recent malware samples from MalwareBazaar Get recent malware samples from MalwareBazaar
malwarebazaar_tag
from source
Get malware samples by tag (e.g., Get malware samples by tag (e.g.,
otx_get_pulses
from source
Get recent threat intelligence pulses from AlienVault OTX Get recent threat intelligence pulses from AlienVault OTX
otx_search_pulses
from source
Search OTX pulses by keyword (malware name, campaign, threat actor) Search OTX pulses by keyword (malware name, campaign, threat actor)
threatfox_iocs
from source
Get recent IOCs from ThreatFox (C2 servers, malware infrastructure) Get recent IOCs from ThreatFox (C2 servers, malware infrastructure)
threatfox_search
from source
Search ThreatFox for IOCs by malware family or tag Search ThreatFox for IOCs by malware family or tag
threatintel_lookup_domain
from source
Look up a domain across threat intelligence sources (OTX, URLhaus) Look up a domain across threat intelligence sources (OTX, URLhaus)
threatintel_lookup_hash
from source
Look up a file hash (MD5, SHA1, SHA256) across threat intelligence sources (OTX, MalwareBazaar) Look up a file hash (MD5, SHA1, SHA256) across threat intelligence sources (OTX, MalwareBazaar)
threatintel_lookup_ip
from source
Look up an IP address across all configured threat intelligence sources (OTX, AbuseIPDB, GreyNoise, Feodo Tracker) Look up an IP address across all configured threat intelligence sources (OTX, AbuseIPDB, GreyNoise, Feodo Tracker)
threatintel_lookup_url
from source
Look up a URL for malware/phishing indicators (OTX, URLhaus) Look up a URL for malware/phishing indicators (OTX, URLhaus)
threatintel_status
from source
Check which threat intelligence sources are configured. Currently available: ${configuredServices.join( Check which threat intelligence sources are configured. Currently available: ${configuredServices.join(
urlhaus_lookup
from source
Check if a URL or domain is distributing malware (URLhaus) Check if a URL or domain is distributing malware (URLhaus)
urlhaus_recent
from source