- Conduid
- Marketplace
- #threat-intelligence
MCP servers tagged threat-intelligence
133 live MCP servers tagged "threat-intelligence", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with threat-intelligence.
Viper
🛡️ VIPER: Stay ahead of threats with AI-driven vulnerability intelligence. Prioritize CVEs effectively using NVD, EPSS, CISA KEV, and Google Gemini insights, all on an interactive…
Xtm MCP
eXtended Threat Management MCP Servers
Honeymcp
A Deception Security Layer for MCP Servers. It injects "ghost tools" (fake security-sensitive tools) that act as honeypots.
Anthropic Cybersecurity Skills
Accelerate AI security workflows with 817 open-source skills across 29 domains for six leading agent frameworks.
Awesome Annual Security Reports
A curated list of annual cyber security reports
AiSOC
Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable.
Attackgen
AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tail…
User Scanner
🕵️♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 465+ actively maintained scan vectors…
Gti MCP Standalone
MCP server: Gti MCP Standalone
Mallorymcp
Mallory - Cyber Threat Intelligence MCP Server
Cyberbro
Using MCP is fun with Cyberbro!
Lyrie AI
Lyrie.ai — The world's first autonomous AI cybersecurity agent. Built by OTT Cybersecurity LLC.
Opensquat
openSquat is an open-source tool that detects look-alike domains impersonating your brand, by scanning newly registered domains daily.
Cti Expert
CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 repo…
OSINT BIBLE
Comprehensive 2026 OSINT guide — 450+ tools, AI intelligence, methodologies & ethics across 35 sections for investigation & threat intel.
Cybermcp
CyberMCP is a Model Context Protocol (MCP) server designed for testing backend APIs for security vulnerabilities. It provides a set of specialized tools and resources that can be…
API
Official Python SDK for the Vulners vulnerability-intelligence API — search CVEs, exploits and advisories (CVSS/EPSS/KEV), audit software, Linux/Windows hosts and SBOMs, and strea…
OnionClaw
OnionClaw™ — OpenClaw skill for full Tor dark web access: search .onion sites, fetch hidden services, rotate identity, run OSINT pipeline, craw.
ARL Next
🚀 自动化资产侦察与漏洞监控平台 (ARL-Next)。重构自经典 ARL，全面升级 Puppeteer + Nuclei 引擎，打通「天眼查/ICP ➔ 资产发现 ➔ 漏洞扫描 ➔ 威胁情报追踪」安全闭环。支持 Docker 极简部署，AI 二开友好。
Mitre MCP
A Model Context Protocol (MCP) server that provides tools for working with the MITRE ATT&CK framework using the mitreattack-python library and the official MCP Python SDK.
AI Runbooks
No description published.
Panguard MCP Proxy
MCP Proxy — runtime interception for AI agent tool calls using ATR rules
Viper
🛡️ VIPER: Stay ahead of threats with AI-driven vulnerability intelligence. Prioritize CVEs effectively using NVD, EPSS, CISA KEV, and Google Gemini insights, all on an interactive…
OnionClaw
OnionClaw™ — OpenClaw skill for full Tor dark web access: search .onion sites, fetch hidden services, rotate identity, run OSINT pipeline, craw.
Zettelforge
Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents
ZettelForge
Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents
Huntkit
Investigation toolkit for Claude Code: case management, OSINT, structured analytic techniques, chain-of-custody evidence capture, and bundled threat-intel MCP servers.
Falconeye
Free self-hosted OSINT investigator's toolkit with an MCP server for Claude Code and Claude Desktop. Eighteen tools in one interface: crypto tracing, phishing fingerprinting, doma…
Misp MCP
Turn your MISP into an MCP service
Orca AI Incident Archive
An open database of real-world AI agent incidents.
Sicry
Enable AI agents to access Tor and .onion sites with a simple Python layer supporting built-in search engines and OSINT tools.
World Intel MCP
100+ tool MCP server for real-time global intelligence — markets, FX, bonds, earnings, SEC filings, conflict, military, cyber, climate, news, company enrichment, and 30+ domains.…
Ms Sentinel MCP Server
MCP server for Microsoft Sentinel. Enables access to Sentinel logs, incidents, analytics, and Entra ID data via a modular, queryable interface. Strictly non-production. Designed f…
Wazuh Autopilot
Autonomous AI SOC for Wazuh SIEM — 11 security-expert agents triage, correlate, investigate and plan responses 24/7, every action gated by two-tier human approval. Runs on OpenCla…
Huntable CTI Studio
Huntable CTI Studio is an AI-assisted cyber threat intelligence workbench that turns open-source CTI into Sigma rules.
Maltego MCP
OSINT graphs are point-and-click busywork. maltego-mcp lets an LLM author the .mtgx and run the whois, DNS, ASN, and crt.sh lookups. Works on the Basic plan.
Malware Sandbox MCP
Detonate files & URLs in cloud malware sandboxes (Hybrid Analysis, tria.ge, ANY.RUN) and enrich IOCs across MalwareBazaar, ThreatFox, URLhaus, Feodo, URLScan & VirusTotal — straig…
Claudii Exploratores
OSINT suite for Claude — 898 curated OSINT tools as an Agent Skill + MCP server (classifier, URL builder, IBAN check, PII redactor). ALPHA.
Vigia Intent Analysis
DFIR intentionality engine for SIFT. Verdicts sealed before any LLM sees the evidence. Detects fabricated artifacts and false flags — not just what happened, but who benefits f…
GeoLens
Image geolocation toolkit — EXIF, sun-shadow, OCR, reverse-search
Malvex
AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server
Naso
Self-hosted breach and dark-web exposure monitoring: ingest leaks, correlate identities, triage with a local LLM. Your infrastructure, your data.
Honeymcp
Open-source honeypot for MCP (Model Context Protocol) servers. Collects threat intel on attacks against the AI agent ecosystem.
Huntdeck
Hunt IOCs with a tactical terminal - Next.js + FastAPI orchestrating MCP providers, Supabase auth, daily quota and BYOK.
Dfir Threat Intel Platform
A 135+ tool DFIR toolkit, a live self-updating threat-intel platform, and a 332-tool MCP server — on one Cloudflare Workers deploy. MIT licensed. Portfolio: pranithjain.qzz.io
Solsentry MCP
Zero-install MCP server for SolSentry — Solana operator threat intelligence for AI agents. NPM: @solsentry/mcp
Abuseipdb
A Model Context Protocol (MCP) server for integrating with the AbuseIPDB API.
Skills
Claude Code plugin — DNS, IP, Bitcoin, Lightning, and threat intelligence tools powered by Robtex
Sicry
Enable AI agents to access Tor and .onion sites with a simple Python layer supporting built-in search engines and OSINT tools.
Geolens
Image geolocation toolkit — EXIF, sun-shadow, OCR, reverse-search