- Conduid
- Marketplace
- #threat-hunting
MCP servers tagged threat-hunting
39 live MCP servers tagged "threat-hunting", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with threat-hunting.
Anthropic Cybersecurity Skills
Accelerate AI security workflows with 817 open-source skills across 29 domains for six leading agent frameworks.
Awesome Annual Security Reports
A curated list of annual cyber security reports
Opensquat
openSquat is an open-source tool that detects look-alike domains impersonating your brand, by scanning newly registered domains daily.
AI Runbooks
No description published.
ZettelForge
Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents
Mulder
Agentic DFIR
Huntkit
Investigation toolkit for Claude Code: case management, OSINT, structured analytic techniques, chain-of-custody evidence capture, and bundled threat-intel MCP servers.
Adk Runbooks
No description published.
AI Dfir Toolkit
A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider t…
Sectinel
Open-source security arsenal for AI coding agents: 784 cybersecurity skills, scanner integrations, and a security MCP for Claude Code, Cursor, opencode, Gemini CLI, Cline, and any…
Threat Hunting MCP Server
A minimal, modular MCP server that equips your AI with practical capabilities for real-world threat hunting workflows.
Wazuh Autopilot
Autonomous AI SOC for Wazuh SIEM — 11 security-expert agents triage, correlate, investigate and plan responses 24/7, every action gated by two-tier human approval. Runs on OpenCla…
Huntable CTI Studio
Huntable CTI Studio is an AI-assisted cyber threat intelligence workbench that turns open-source CTI into Sigma rules.
Gsh Framework
Open-source hunt playbooks and a policy-driven Sentinel reference framework for detecting runaway AI agents, unauthorized tool calls, behavioral drift, DNS exfiltration, and poiso…
FactGraph
Agent-native incident investigation graph: analysts and AI agents (MCP/REST) link evidence from EDR, Entra ID, cloud and GitHub logs into one shared, real-time attack graph and ti…
Huntdeck
Hunt IOCs with a tactical terminal - Next.js + FastAPI orchestrating MCP providers, Supabase auth, daily quota and BYOK.
Agentic Dart
Automate digital forensics and incident response tasks using an autonomous agent aligned with MITRE ATT&CK frameworks.
Whisper Skills
Agent Skills for the WhisperGraph MCP connector — indicator investigation, bulk triage, Cypher query authoring, and brand-protection sweeps. Claude Code plugin, portable to any SK…
Defender Xdr MCP
Self-hosted, strictly read-only MCP server for Microsoft Defender XDR. Bring your own AI to your Defender telemetry — delegated per-user auth, no write path, production guardrails.
Xdr MCP
MCP server for the F6 XDR platform — gives AI assistants access to alerts, incidents, mail, files and hosts
ThreatIntelMCP
A production-oriented Threat Intelligence platform that collects, enriches, and serves cybersecurity intelligence using Python, PostgreSQL, AI, and the Model Context Protocol (MCP…
Otx
MCP server for AlienVault OTX / LevelBlue Open Threat Exchange — complete DirectConnect API coverage (29 tools), stdio + streamable HTTP transports, read-only by default. Built on…
SOCLOOM
SOC operations woven with 800+ security skills, ML detection & MITRE ATT&CK — open-source AI-native SOC platform
nagameTW/mcp-server-malcolm
malcolm`
ProcWitness
Passive process forensics for Windows, Linux and macOS. Records process behavior locally and produces an AI-ready evidence bundle.
Living Off The Land Lolbins MCP Server
Living off the Land LOLBins MCP Server — 59 composite tools for LOL binary intelligence across 10 catalogs (GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, LOLESXi, LOTP, LOLC2, LO…
Agentic Dfir
Agentic-DFIR — autonomous digital forensics & incident response agent. Architecture-first, not prompt-first: typed read-only MCP tool surface, SHA-256 audit chain, senior-analyst…
SAVVYDFIR MCP
AI-driven DFIR framework: an MCP server that turns Claude Code into an autonomous digital-forensics analyst on SANS SIFT - correlates disk + memory evidence, enforces a determinis…
Cyber Incident Investigation And Triage MCP Server
AI-native MCP server for natural-language cyber incident investigation and triage across Windows, Linux, and macOS artifacts, plus Volatility3 memory forensics and Hashcat. Mount…
Narratives
Our reusable, modifiable prompts and simple agents that are included within the Arcanna platform and invokable via Arcanna's AI Assistant
Protocol SIFT Async Bridge
Type-safe async MCP server for LLM-assisted memory forensics via Volatility 3: closes the 60-second attacker breakout window without LLM timeouts or evidence spoliation.
Investigation Reports
MCP security investigation and hunting reports — reference material for detecting and investigating agent tool activity.
AI Email Assistant
Automate Gmail tasks with LLMs and keep full control through a human-in-the-loop safety layer.
Mde Kql
Execute some KQL with your favorite LLM agent.
TalonHound
Self-hosted threat intelligence and IOC management platform
Zerosoc MCP
MCP servers, and the typed tool clients they wrap, for security operations
Threat Dashboard
SOC desktop app in Zig + Vulkan: triage/hunt/detect/intel workspaces, YARA rules-as-code with CI quality gates, ATT&CK coverage mapping, dbt-style pipelines, and an embedded Claud…
Neo Finds Evil
Read-only Neo4j graph-correlation layer extending Protocol SIFT for AI-driven DFIR — cross-host, cross-time evidence correlation exposed to a Claude Code agent via architecturally…
OpenProcessGuard MCP
Read-only Windows process-forensics MCP server for Claude Desktop — 17 tools across 6 hunt stages, cosign-signed releases + SBOM, zero telemetry.