About Dfir MCP Server
Dfir MCP Server is an MCP server in the Cloud category: mCP server exposing 98 DFIR & threat intelligence tools for AI agents — IOC checking, CVE lookup, threat actor enrichment, phishing analysis, and more. Built on Cloudflare Workers.
Install
git clone https://github.com/Pranith-Jain/dfir-mcp-serverThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (6)
breach_vip_searchPlatform worker calls breach.vip directly; REST exposes only email/domain subsets
Parameters not published.
si_kql_to_ah_urlPure local computation (KQL → Defender AH deep link), no route
Parameters not published.
si_render_pngHosted rasteriser returns raw PNG bytes; proxy helpers are JSON-only
Parameters not published.
si_statsReports worker-local LRU cache stats; no `/si/stats` route
Parameters not published.
stix_translatePure local library call, no route
Parameters not published.
ti_export_stixHosted STIX export lacks the per-family `slug`/`tlp` params
Parameters not published.
Ask AI
Ask AI about Dfir MCP Server
Powered by Claude · Grounded in docs
Security checks
6 checks have not been run yet.