About Threatintel
Threatintel is an MCP server in the Search category: threat intelligence MCP server for Claude Code. IOC lookups, CVE checks, breach monitoring, dark web search, and OTX pulses.
Install
git clone https://github.com/pete-builds/mcp-threatintelThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (12)
check_breachCheck LeakCheck for breached credentials by email, domain, username, or hash
Parameters not published.
check_domain_breachesCheck all known breaches for a domain
Parameters not published.
check_email_breachesCheck if an email is in any known breach via HIBP
Parameters not published.
check_password_breachCheck if a password has been exposed (HIBP k-anonymity, free, password never leaves machine)
Parameters not published.
get_feed_statusShow sync status and record counts for all feeds
Parameters not published.
get_latest_breachGet the most recently added breach from HIBP
Parameters not published.
get_recent_threatsWhat's been added in the last N hours
Parameters not published.
lookup_cveCheck if a CVE is in the CISA Known Exploited Vulnerabilities catalog
Parameters not published.
lookup_iocCheck an IP, domain, hash, or URL against all threat feeds
Parameters not published.
search_darkwebSearch Ahmia.fi's index of Tor hidden services
Parameters not published.
search_pulsesSearch AlienVault OTX community threat pulses
Parameters not published.
search_threatsFull-text search across IOCs, OTX pulses, and CVEs
Parameters not published.
Ask AI
Ask AI about Threatintel
Powered by Claude · Grounded in docs
Security checks
6 checks have not been run yet.