playbooks

home / mcp / opencti mcp server

OpenCTI MCP Server

Provides an MCP interface to query and retrieve OpenCTI threat intelligence data via Node.js with environment-based credentials.

Installation
Add the following to your MCP client configuration file.

Configuration

View docs
{
  "mcpServers": {
    "spathodea-network-opencti-mcp": {
      "command": "node",
      "args": [
        "path/to/opencti-server/build/index.js"
      ],
      "env": {
        "OPENCTI_URL": "${OPENCTI_URL}",
        "OPENCTI_TOKEN": "${OPENCTI_TOKEN}"
      }
    }
  }
}

OpenCTI MCP Server provides a standardized interface to query and retrieve threat intelligence data from an OpenCTI instance. It enables you to fetch reports, search for malware, indicators, actors, and STIX objects, manage users and groups, access reference data, and perform common system operations through a consistent MCP API.

How to use

Connect your MCP client to the OpenCTI MCP Server to perform queries and actions across threat intelligence data. You can fetch the latest reports, search for malware information, indicators of compromise, and threat actors. You can also access STIX objects like attack patterns and campaigns, list system connectors and status templates, and manage files and references. Use the provided functions to retrieve specific items by ID, or run broad searches to discover new or relevant threat intelligence. All operations are exposed through clear endpoints and return structured results that you can integrate into your workflows, dashboards, or automation.

How to install

Prerequisites you need before installing the server:

- Node.js 16 or higher

- Access to an OpenCTI instance

- An OpenCTI API token

How to install

# 1) Installing via Smithery
npx -y @smithery/cli install opencti-server --client claude

# 2) Manual Installation

# Clone the repository
git clone https://github.com/yourusername/opencti-mcp-server.git

# Install dependencies
cd opencti-mcp-server
npm install

# Build the project
npm run build

Configuration

Environment and MCP configuration for running the server involves providing your OpenCTI instance details and tokens. Copy the example environment setup and adjust with your credentials to enable secure communication with OpenCTI.

cp .env.example .env
```

Required environment variables:
- OPENCTI_URL: Your OpenCTI instance URL
- OPENCTI_TOKEN: Your OpenCTI API token

MCP settings and startup

Create a configuration file for MCP settings. The configuration wires the OpenCTI MCP Server into your MCP runtime and loads credentials from your environment.

{
  "mcpServers": {
    "opencti": {
      "command": "node",
      "args": ["path/to/opencti-server/build/index.js"],
      "env": {
        "OPENCTI_URL": "${OPENCTI_URL}",
        "OPENCTI_TOKEN": "${OPENCTI_TOKEN}"
      }
    }
  }
}

Security notes

Do not commit the .env file or API tokens to version control. Keep your OpenCTI credentials secure and ensure the MCP configuration is protected. Your MCP setup should include appropriate access controls and environment isolation.

Tools and capabilities

The server exposes a set of functions you can call to interact with threat intelligence data. These include retrieving the latest reports, getting reports by ID, searching for malware, indicators, and threat actors, and listing or querying various STIX objects and system data.

Notes

If you need to refresh or update credentials, regenerate your OpenCTI API token and update the environment variables accordingly. Regularly review access to the MCP server and rotate keys as part of your security hygiene.

Available tools

get_latest_reports

Retrieves the most recent threat intelligence reports.

get_report_by_id

Retrieves a specific report by its ID.

search_malware

Searches for malware information in the OpenCTI database.

search_indicators

Searches for indicators of compromise.

search_threat_actors

Searches for threat actor information.

get_user_by_id

Retrieves user information by ID.

list_users

Lists all users in the system.

list_groups

Lists all groups with their members.

list_attack_patterns

Lists all attack patterns in the system.

get_campaign_by_name

Retrieves campaign information by name.

list_connectors

Lists all system connectors.

list_status_templates

Lists all status templates.

get_file_by_id

Retrieves file information by ID.

list_files

Lists all files in the system.

list_marking_definitions

Lists all marking definitions.

list_labels

Lists all available labels.