# Alienvault Otx [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/pipeworx-io/mcp-alienvault-otx  
**GitHub Stars:** 0  
**npm Downloads (last month):** 475  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/alienvault-otx

## Description
AlienVault OTX MCP — Open Threat Exchange (free with key)

## Tools
Capabilities this server exposes over MCP:

- **search_pulses** — Search OTX threat-intel pulses by KEYWORD — campaign, malware family or actor name, e.g. "ransomware" or "APT29". Returns pulse ID, name, description preview, tags, targeted countries, malware families, attack IDs, and indicator count. This matches pulse titles and descriptions, so a bare indicator value (an IP, domain, hash or CVE id) will find nothing here — use lookup_indicator for those.
- **get_pulse** — Fetch a single OTX pulse: full description, references, indicators, attack IDs, targeted countries, malware families, industries, and creation/modification dates.
- **lookup_indicator** — Look up a threat indicator in OTX: an IPv4 or IPv6 address, a domain or hostname, a URL, an MD5/SHA1/SHA256 file hash, or a CVE id such as CVE-2021-4034. Returns the threat-intel pulses referencing that indicator plus observed-context fields, so it answers questions like which campaigns exploit a given CVE or whether an IP is known-malicious. type is auto-detected when omitted.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "alienvault-otx": {
    "command": "npx",
    "args": ["-y","@pipeworx/mcp-alienvault-otx"],
    "env": {
      "PLATFORM_OTX_KEY": "",
      "PIPEWORX_API_KEY": "",
      "PIPEWORX_META_TOOLS": "",
      "NODE_USE_ENV_PROXY": ""
    }
  }
}
```

**Requires environment variables:** `PLATFORM_OTX_KEY`, `PIPEWORX_API_KEY`, `PIPEWORX_META_TOOLS`, `NODE_USE_ENV_PROXY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What Alienvault Otx does

Alienvault Otx provides MCP access to AlienVault Open Threat Exchange (OTX), using the OTX API at `https://otx.alienvault.com/api/v1`. Its focus is community threat-intelligence data: finding pulses, reading a specific pulse, and looking up indicators.

The integration is independent and unofficial. It is maintained as part of Pipeworx, a gateway that connects AI agents to external data sources. The AlienVault OTX endpoint is useful when an agent needs to investigate an indicator or locate threat reports matching a query.

## How it works

MCP clients can connect to the hosted endpoint at:

`https://gateway.pipeworx.io/alienvault-otx/mcp`

The endpoint exposes the three AlienVault OTX tools along with shared Pipeworx meta-tools. These additional tools include `ask_pipeworx`, `discover_tools`, `search_within`, and `remember`/`recall`. The endpoint's `initialize` response reports the exact tool scope for the connection.

A full Pipeworx gateway endpoint is also available at `https://gateway.pipeworx.io/mcp`. Both endpoints use the same gateway and data sources; the pack endpoint lists AlienVault OTX tools directly, while the full gateway lists all available packs directly. `ask_pipeworx` can route questions across the wider catalog from either endpoint.

Calls can also be made over HTTP, such as a `POST` request to `/v1/tools/search_pulses`. The npm package provides a local stdio bridge that forwards MCP calls to the hosted gateway, so it requires network access and has no offline mode.

## Setup and configuration

For a hosted MCP connection, add the AlienVault OTX URL to an MCP client configuration. The documented clients include Claude Desktop, Cursor, and Windsurf. The local option runs with `npx -y @pipeworx/mcp-alienvault-otx`.

Authentication supports a gateway platform key through `PLATFORM_OTX_KEY`, or an OTX key supplied as `?_apiKey=<key>` after registering for free with AlienVault OTX. The local npm bridge can use `PIPEWORX_API_KEY` as a Bearer token. Anonymous local calls are allowed but limited to 50 calls per day; a free Pipeworx account raises the limit to 200 calls per day.

Set `PIPEWORX_META_TOOLS=1` for the local bridge if shared gateway tools should also appear in its tool list. Without that setting, the bridge lists only the AlienVault OTX pack tools. When using an HTTPS proxy, newer Node versions can honor the proxy environment setting when `NODE_USE_ENV_PROXY=1` is enabled.

## Tools and capabilities

- `search_pulses(query, limit?, page?)` searches OTX community pulses with optional result and page controls.
- `get_pulse(pulse_id)` retrieves a pulse by its identifier.
- `lookup_indicator(indicator, type?)` looks up an IPv4 address, IPv6 address, domain, hostname, URL, or file indicator.

The gateway also supports inspecting tools with `GET /v1/tools/<tool-name>` and invoking them with `POST /v1/tools/<tool-name>`.

## Limitations and notes

The integration depends on network access to the Pipeworx gateway and OTX services. The hosted pack endpoint includes shared gateway meta-tools in addition to the pack's own tools, so its reported tool count is larger than the three AlienVault OTX operations. Anonymous usage is rate-limited, while authenticated calls are metered through the gateway. The project is an unofficial integration and is not affiliated with or endorsed by AlienVault OTX.

_Full upstream README: https://allmcps.com/mcp/alienvault-otx/readme_