- Conduid
- Marketplace
- #threat-intelligence
MCP servers tagged threat-intelligence
133 live MCP servers tagged "threat-intelligence", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with threat-intelligence.
Wireshark MCP
Network analysis via tshark -- MCP server with 20 tools for capture, analysis, device identification, security auditing, and traffic profiling
Panopticon
Interactive CVE intelligence map for desktop: force-directed Vendor↔CVE graph plus a local AI agent (MCP + OpenRouter) that drafts mitigation plans and keeps versioned, resumable…
Whisper Skills
Agent Skills for the WhisperGraph MCP connector — indicator investigation, bulk triage, Cypher query authoring, and brand-protection sweeps. Claude Code plugin, portable to any SK…
ThreatIntelMCP
A production-oriented Threat Intelligence platform that collects, enriches, and serves cybersecurity intelligence using Python, PostgreSQL, AI, and the Model Context Protocol (MCP…
Threat Intelligence Pipeline
Correlates every NVD CVE with CWE, CAPEC, ATT&CK, D3FEND, OWASP, CISA KEV, Vulnrichment SSVC, and EPSS, with APT links only where MITRE ATT&CK cites the CVE. Search-first web app,…
Otx
MCP server for AlienVault OTX / LevelBlue Open Threat Exchange — complete DirectConnect API coverage (29 tools), stdio + streamable HTTP transports, read-only by default. Built on…
Knostic
Knostic — independent third-party profile of a public API surface, by API Evangelist. Knostic secures the AI agent supply chain inside the enterprise. Its platform discovers shado…
Nord Security
Nord Security — independent third-party profile of a public API surface, by API Evangelist. Nord Security is a Lithuania-founded digital security and privacy company whose consume…
Server
CYBERDUDEBIVASH Autonomous Zero-Trust AI Cybersecurity Command Center (MCP Server)
Vulnerability Intelligence MCP Server
Built for security professionals, developers, and DevSecOps teams who need reliable vulnerability intelligence integrated directly into their development workflow.
ppcvote/misp-mcp-server
intel tools (events, attributes, search, tags, feeds, galaxies). Scans every MISP response for adversarial seeding before returning to LLM. Tracks [MISP/MISP#10745](https://github…
DomScan
DomScan — independent third-party profile of a public API surface, by API Evangelist. Domain intelligence API for domain availability, DNS, WHOIS/RDAP, valuation, security checks,…
Dns Security MCP
104-tool DNS Security Intelligence MCP Server — DNSSEC, hijacking, tunneling, typosquatting, email security, CT monitoring, blocklist, infrastructure audit. 100% local, zero API k…
Nikolife2016/pulsefeed-x402
mcp`
Vo Soc Harness
Harness de operaciones de ciberseguridad sobre Trend Micro Vision One: agentes de IA que hacen triage, investigan IOCs, ejecutan la contención y documentan la alerta. Incluye el s…
Urlhaus MCP Server
MCP server for accessing URLhaus malicious URL database from abuse.ch - provides threat intelligence for cybersecurity research
AgentNull
AgentNull: AI System Security Threat Catalog + Proof-of-Concepts. Collection of PoCs for using Agents, MCP, and RAG in bad ways.
Falconfeeds MCP
Official MCP (Model Context Protocol) server for FalconFeeds.io
Cryptotrace
Free-tier blockchain investigator — ETH/BTC clustering + sanctions xref
OmniSec
O OmniSec é um SOC autônomo orquestrado por IA (Swarm). Integra agentes especializados, detecção, sandbox, inteligência de ameaças, playbooks de resposta a incidentes, ferramentas…
Personagraph
Identity resolution dossier — username/email/phone cross-platform
Synthient MCP
Production-oriented Synthient MCP server in Go for IP and domain intelligence, security feeds, stdio, HTTP, and OAuth.
Cve Intel
Multi-source CVE Intelligence MCP Server — combines NVD, CISA KEV, and EPSS for AI-powered vulnerability analysis
Security Hunter MCP
🛡️ Production-grade Model Context Protocol (MCP) Server for Autonomous AI Security Bug Hunting, Persistent Pentest Memory, Dynamic Checklists, Secret Redaction, and Exploit PoC Ge…
Osint MCP Gateway
Modular OSINT MCP server platform with BM25 gateway aggregating VirusTotal, Shodan, DNS, WHOIS, RIPEStat, and OTX for AI-powered threat intelligence investigations.
Dfir MCP Server
MCP server exposing 98 DFIR & threat intelligence tools for AI agents — IOC checking, CVE lookup, threat actor enrichment, phishing analysis, and more. Built on Cloudflare Workers.
Attackmap
Map findings to MITRE ATT&CK techniques + coverage heatmap
Portfan
Summarize and diff nmap XML into prioritized, attackable findings
Marq
Universal cyber assistant: ~80 audited Kali tools + an expert skills library, driven by any model over MCP or direct run
PatrowlIntelMCP
A thin, read-only MCP server that brings PatrowlIntel CVE, EPSS, CISA KEV, exploit, and trending-attack data into Claude and any MCP client.
Tdp MCP
Model Context Protocol (MCP) server in Go for ThreatBook TDP (微步在线威胁检测平台): 105 OpenAPI endpoints + 4 diagnostics as typed MCP tools - alert triage, incident forensics, log hunting…
Opticparse Public
Stealth Multimodal Web Scraper & 0-Day Phishing Shield for AI Agents. Alternative to Firecrawl & Crawl4AI with zero-CSS vision extraction, 200 free trial credits, and native LangC…
Secops Agent Triage
Tool-calling SOC triage agent with multi-format alert ingestion, threat-intelligence enrichment, and structured NIST/MITRE assessments.
Opencode Anthropic Oauth
Restore Claude access in OpenCode with OAuth for Pro/Max logins, token refresh, and Anthropic model support
Threatintel
Threat intelligence MCP server for Claude Code. IOC lookups, CVE checks, breach monitoring, dark web search, and OTX pulses.
Skill Advisories
Open advisory database for AI agent skills, plugins, and MCP servers — machine-readable threat data for the agent ecosystem.
Urlscan CLI
Command-line interface for urlscan.io: URL scanning, result polling, and domain, IP, URL, and hash search via API.
Intel Nexus MCP
Top Rated Threat Intelligence MCP Servers for AI Agents 2026
Threat Intel MCP Servers
MCP server exposing threat intelligence lookups (VirusTotal, AbuseIPDB, urlscan.io, GreyNoise, Shodan) as agent tools
Blackwall
Blackwall is an autonomous Agentic Firewall designed to secure AI agents by actively intercepting execution flows before they reach external systems or the host OS. It leverages s…
Threat Intelligence MCP
MCP server for the ThreatCluster threat intelligence API: incident clusters, IOCs, CVEs, ransomware leak-site victims and entity profiles as tools for Claude, Cursor, VS Code and…
Agentic Misp MCP
Workflow-first MCP server for MISP threat intelligence, with agentic IOC investigation, pivoting, reporting, and policy-gated write workflows.
NeuralReaper
AI-powered penetration testing framework with 55+ MCP tools, CVE intelligence, Active Directory, and autonomous security workflows.
Threat Intel Toolkit
Multi-source IP threat intelligence CLI and Claude MCP server (AbuseIPDB, VirusTotal, Shodan).
Filescan MCP
Filescan.io MCP server - Rust implementation for file/URL scanning, report search, reputation checks, and threat intelligence via Model Context Protocol
Cookieaudit
Audit Set-Cookie flags (Secure/HttpOnly/SameSite) from a response dump
Headerscan
Grade HTTP security headers (CSP/HSTS/XFO) A-F from a response dump
Webhookvty
Verifies and replays signed payment webhooks (Stripe/Adyen/PayPal/Plaid) locally, catching signature, idempotency, and replay-attack bugs.
Memtriage
Triage memory-dump artifacts: strings, IOCs, suspicious processes from a dump export
Axur MCP
A Model Context Protocol (MCP) server for the Axur cybersecurity platform