1. Conduid
  2. Security
  3. Mallorymcp
MCP server · Security

Mallorymcp

by · github.com/malloryai/mallorymcp

Mallory - Cyber Threat Intelligence MCP Server

Unclaimed Apache-2.0 cticybersecuritythreat-intelligencecybercyber-threat-intelligencesecurity
InstallView source
59Fair

Scored 2 days ago · breakdown

About Mallorymcp

Mallorymcp is an MCP server published by malloryai in the Security category: mallory - Cyber Threat Intelligence MCP Server.

The repository has 8 stars and 4 forks, with the last commit 3 months ago. Recent commit activity is the strongest signal that reported issues will get attention.

Install

From source
git clone https://github.com/malloryai/mallorymcp

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Mallorymcp

Powered by Claude · Grounded in docs

I know everything about Mallorymcp. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

Static checks derived from the repository 3 days ago. Heuristics on the source, not an audit.

  • ✓README presentThe repository ships documentation.
  • ✓License declaredUsable under a stated license.
  • ✓Tests presentA test suite exists in the repository.
  • !Dependencies pinnedNo lockfile. Installs can pull different code over time.
  • ✓No dynamic code executionSource scan found no eval, dynamic Function, or shell execution.
  • !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.

Releases

v0.4.0v0.4.0 — Deprecated in favor of Remote MCP · 26 Jun 2026⚠️ `mallorymcp` is now deprecated The local `mallorymcp` stdio MCP server has been replaced by Mallory's hosted Remote MCP service — fully managed, always up to date, and requires no local install. ➡️ Migrate now:…
v0.3.8v0.3.8 · 17 Feb 2026Fix lint errors: add missing trailing newlines and sort imports in test file.
v0.3.7v0.3.7 · 17 Feb 2026Bump mcp SDK dependency from >=1.6.0 to >=1.26.0 for latest protocol improvements and bug fixes.
v0.3.6v0.3.6 · 17 Feb 2026Fix health_check tool error by bumping malloryapi dependency to >=0.2.5. The `health()` and `whoami()` client methods were added in malloryapi v0.2.5, but the previous dependency floor of >=0.1.1 allowed resolution of an older version that…
v0.3.5v0.3.5 · 17 Feb 2026Add Claude Code setup instructions to README alongside Cursor and Claude Desktop.

README

Mallory MCP Server (deprecated)

PyPI

⚠️ This package is deprecated and no longer maintained.

The local mallorymcp stdio server has been replaced by Mallory's hosted Remote MCP service. The remote service is fully managed, always up to date, and requires no local install.

➡️ Migrate to the Remote MCP service: https://docs.mallory.ai/use/agent/mcp

What changed

mallorymcp was a local MCP server you ran via uvx/pip that proxied the Mallory API to your AI client over stdio. It is no longer published with new features and will receive no further updates.

All functionality now lives in the Mallory Remote MCP service, a hosted endpoint you connect your AI client to directly. It exposes the same threat intelligence capabilities (vulnerabilities, threat actors, malware, exploits, organizations, attack patterns, breaches, products, advisories, stories, mentions, search, and sources) without any local package to install or keep up to date.

How to migrate

Follow the setup guide for your AI client (Cursor, Claude Desktop, Claude Code, and others) here:

https://docs.mallory.ai/use/agent/mcp

Once you've connected the Remote MCP service, you can remove the local server from your MCP client config and uninstall this package:

pip uninstall mallorymcp

License

Apache 2.0.

README fetched from the repository 3 days ago. The original is authoritative.

Questions

About Mallorymcp

How do I install Mallorymcp?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Mallorymcp safe to use with an AI agent?

Its trust score is 59 out of 100 (fair). It passes 4 of the 6 static security checks run so far; the failures are listed above. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Mallorymcp still maintained?

Yes — the latest release is v0.4.0 (26 Jun 2026), and the last commit was 3 months ago. The repository has 8 stars and 4 open issues.