Threat Intelligence MCP Server

How to use

You interact with the Threat Intelligence MCP Server through an MCP client to perform a variety of threat data tasks. Use it to list available threat feeds, fetch IOCs (indicators of compromise) from a specific feed, check the reputation of IPs and file hashes, and validate networks against known threats. You can bulk-check up to 100 IPs in a single request and tie in results with your network scans for proactive defense. The server exposes a dashboard API for visualization so you can monitor aggregated threat intelligence in real time.

How to install

cd ${AGENTIC_SYSTEM_PATH:-/opt/agentic}/mcp-servers/threat-intel-mcp
pip install -e .

# For dashboard support:
pip install -e ".[dashboard]"

# For development:
pip install -e ".[dev]"

Configuration and usage notes

{
  "mcpServers": {
    "threat-intel": {
      "command": "${AGENTIC_SYSTEM_PATH:-/opt/agentic}/.venv/bin/python3",
      "args": ["-m", "threat_intel_mcp.server"]
    }
  }
}

Optional API keys can be provided to enable enhanced data from feeds and services. Set environment variables for VirusTotal, AbuseIPDB, Shodan, and AlienVault OTX to enable richer data when performing lookups.

Additional features and notes

Key features include multi-source threat feeds (such as Feodo Tracker, URLhaus, CISA KEV, ThreatFox, Emerging Threats, Spamhaus DROP, Blocklist.de, and CINSscore), IP and hash reputation checks, bulk IP lookups, and a Flask-based dashboard for visualization. The server uses a thread-safe cache with TTL and size limits to keep responses fast and reduce redundant lookups.

Threat feeds and tools

The MCP provides a suite of commands to interact with threat data. You can list feeds, fetch IOCs by feed name, check IP and hash reputations, perform bulk IP checks, retrieve known exploited vulnerabilities, and access dashboard data.

Development and testing

# Install dev dependencies
pip install -e ".[dev]"

# Run tests
pytest tests/ -v

# With coverage
pytest tests/ --cov=threat_intel_mcp --cov-report=html

get_threat_feeds

List all available threat intelligence feeds with their status to understand what sources are connected and actively providing data.

fetch_threat_feed

Fetch indicators of compromise (IOCs) from a specific feed by its name to populate your monitoring dashboards.

check_ip_reputation

Check a single IP against multiple threat sources to determine its risk level (clean, low, medium, high, critical).

check_hash_reputation

Check a file hash (MD5/SHA1/SHA256) reputation against threat intelligence sources.

check_bulk_ips

Check up to 100 IPs in a single request to assess overall exposure across a network segment.

get_cisa_kev

Retrieve the CISA Known Exploited Vulnerabilities catalog for asset risk assessment.

get_dashboard_summary

Get aggregated threat data suitable for visual dashboards and monitoring tools.

get_recent_iocs

Fetch recent IOCs from ThreatFox, with optional filtering by type (ip, domain, url, etc.).

check_network_against_threats

Evaluate network scan results against threat intelligence feeds to identify compromised devices.

get_threat_stats

Retrieve cache statistics and API key status to monitor the health and configuration of the MCP.

clear_threat_cache

Clear the threat intelligence cache to ensure fresh data is retrieved on next lookups.