# intelthreadlinqs-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/threadlinqs-cmd/Threadlinqs-Security-Detection-MCP  
**GitHub Stars:** 1  
**npm Downloads (last month):** 276  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/intelthreadlinqs-mcp-2

## Description
Threadlinqs threat-intelligence MCP — 49 tools: threats, detections, IOCs, actors, C2, MITRE, CVEs

## Tools
Capabilities this server exposes over MCP:

- **search_threats** — Search threats by keyword, CVE ID, MITRE technique, threat actor name, or any text. Returns matching threats with severity, category, attribution, and CVE identifiers.
- **get_threat** — Get full details for a specific threat by ID. Returns complete threat intelligence: summary, description, severity, CVSS scores, attribution, CVEs/CWEs, MITRE mappings, timeline, IOCs, detections, tags, and references.
- **get_recent_threats** — Get the most recently published threats on the platform, ordered by creation date descending.
- **list_threat_categories** — List all threat categories with counts. Returns category names and how many threats belong to each.
- **get_detections** — Get detection rules. Optionally filter by threat ID or detection type (spl, kql, sigma). Returns detection name, query/rule content, severity, confidence, data sources, and MITRE mappings.
- **export_detection** — Export a specific detection rule in a chosen format — returns the raw SPL query, KQL query, Sigma YAML, or full JSON with all metadata.
- **search_iocs** — Search indicators of compromise — IPs, domains, hashes, URLs, behavioral indicators. Filter by IOC type category.
- **get_mitre_coverage** — Get MITRE ATT&CK framework coverage — all techniques and tactics mapped across the threat intelligence database with detection coverage statistics.
- **get_mitre_technique** — Get detailed information about a specific MITRE ATT&CK technique — associated threats, detections, and coverage.
- **list_simulations** — List all attack simulation scenarios available on the platform. Returns threats with simulation counts, platforms (windows/linux/python), severity, and threat actor attribution.
- **get_threat_simulations** — Get all simulation commands for a specific threat. Returns detailed simulation steps with platform-specific commands (PowerShell, Bash, Python), MITRE mappings, caution levels, and requirements.
- **list_debriefs** — List all daily intelligence debriefs. Returns dates, threat counts, and summary information for each briefing.
- **get_debrief** — Get a specific daily debrief by date. Returns full briefing with threat summaries, MITRE techniques covered, IOC breakdown, detection coverage, and threat actor activity.
- **list_c2_beacons** — List Wild C2 beacons — command-and-control infrastructure intelligence including framework identification, watermark analysis, and geolocation.
- **get_c2_stats** — Get C2 intelligence statistics — framework distribution, geographic spread, watermark clusters, and operator activity summary.
- **get_c2_operators** — Get C2 operator cluster analysis — behavioral fingerprints, shared infrastructure, and attributed operator groups.
- **get_c2_cross_correlations** — Get C2 cross-intelligence correlations — IP matches, tag matches, MITRE technique overlaps, domain fronting detection, behavioral fingerprints, and watermark clusters across beacons.
- **get_correlations_overview** — Get advanced correlations overview — aggregated intelligence from 7 correlation engines: MITRE heatmap, adversary infrastructure, IOC consensus, CVE velocity, attribution network, detection debt, and enrichment overview.
- **get_cve_details** — Look up details for a specific CVE identifier. Returns description, severity, CVSS score, affected products, references, and linked threats.
- **get_cwe_details** — Look up details for a specific CWE identifier. Returns weakness name, description, severity, related CVEs, and mitigation guidance.
- **get_c2_watermarks** — Get C2 watermark clusters — groupings of beacons sharing the same Cobalt Strike watermark, indicating shared operator or license.
- **get_c2_timeline** — Get C2 beacon timeline — monthly version distribution showing C2 framework evolution over time.
- **get_c2_configs** — Get full C2 beacon configurations — sleep times, jitter, user agents, spawnto paths, kill dates, crypto schemes, domain fronting details, and aggregate statistics.
- **get_correlation_engine** — Get detailed data from a specific correlation engine. Engines: mitre-heatmap (technique risk scores), adversary-infra (threat actor infrastructure), ioc-consensus (cross-source IOC validation), cve-velocity (exploit timeline analysis), attribution (cross-actor shared entities), detection-debt (uncovered technique gaps), enrichment (data source health).
- **get_ioc_dns** — Get passive DNS enrichment data for a specific IOC (IP or domain). Returns all discovered domains, reverse DNS records, and any cross-threat infrastructure links.
- **get_enrichment_overview** — Get DNS enrichment overview — total enriched IOCs, discovered domains, cross-threat links, coverage percentage, and per-threat breakdown.
- **get_enrichment_graph** — Get the DNS enrichment infrastructure graph — nodes (IOCs, domains, threats) and edges (relationships) for visualization. Optionally filter by threat ID.
- **enrich_iocs** — Trigger DNS enrichment for IOCs. Enriches a single IOC, all IOCs for a threat, or all unenriched IOCs. Returns enrichment results with domain counts and cross-threat links.
- **get_threat_transcripts** — Get agent analysis transcripts for a threat — multi-agent intelligence reports with phases, signals, participant roles, and summary assessments.
- **get_roadmap** — Get the platform roadmap — planned features, ideas in progress, and completed items with priorities and status.
- **get_platform_stats** — Get current platform statistics — total threats, detections, IOCs, MITRE coverage, category breakdown, and operational status.
- **get_changelog** — Get the platform changelog — recent updates, new features, bug fixes, and improvements.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "intelthreadlinqs-mcp": {
    "command": "npx",
    "args": ["-y","intelthreadlinqs-mcp@3.1.1"]
  }
}
```

## Documentation

## What intelthreadlinqs-mcp MCP server does

intelthreadlinqs-mcp MCP server exposes Threadlinqs Intel capabilities through the Model Context Protocol. The README places it alongside a separate detection server in a broader Security Detections MCP platform. Its role is to supply threat-intelligence operations that can be called by MCP-compatible clients, workflows, or the platform's web workbench.

The server covers threat feeds, command-and-control tracking, indicator-of-compromise searches, MITRE mapping, CVE and CWE lookups, DNS enrichment, and simulations. These capabilities are intended for investigations and detection work such as examining current threats, enriching indicators, assessing vulnerabilities, and relating intelligence to ATT&CK techniques.

## How it works

The workbench connects to the Threadlinqs Intel MCP server through an MCP bridge using stdio transport. Its tool explorer can list the available tools, display their schemas and parameters, and run them from the browser. Workflows can call tools on the intelligence server and combine their results with detection searches, transformations, conditional steps, loops, parallel branches, or LLM analysis.

An ad-hoc terminal can accept natural-language questions about threats, detections, and coverage. The configured LLM selects MCP tools, invokes them, and synthesizes the returned results. This interface is part of the surrounding workbench rather than a requirement of the MCP protocol itself.

## Setup and configuration

The documented environment requires Node.js 18 or newer, npm 8 or newer, and Git. The workbench is then installed from its directory and started in development mode, after which it is available at localhost:3000.

Configure the Threadlinqs Intel API key from the workbench's Settings page. The key is obtained from the Threadlinqs Intel service. An LLM provider key for Anthropic or OpenAI is also needed for ad-hoc questions and workflow steps that use an LLM prompt, but it is separate from the intelligence API key.

## Tools and capabilities

The documented Threadlinqs Intel tool groups include:

- Threat-feed access for retrieving intelligence
- C2 tracking
- IOC searching
- MITRE technique and threat mapping
- CVE and CWE lookups
- DNS enrichment
- Security simulations

The same platform includes 74 detection-focused tools for searching and engineering rules across Sigma, Splunk ESCU, Elastic, and KQL. Those tools are provided by the separate security-detections MCP server, not by intelthreadlinqs-mcp MCP server itself. The combined workbench reports 106 tools across both servers and includes workflows for threat hunting, coverage analysis, CVE assessment, and intelligence operations.

## Limitations and notes

It also does not document client-specific configuration for editors or desktop applications.

A Threadlinqs key is required for the intelligence operations. Without that key, threat-intelligence workflow steps are skipped, while the detection tools remain usable. LLM-backed ad-hoc analysis and `llm_prompt` workflow steps have their own provider-key requirement. The README identifies the project license as MIT and lists version 3.0.0 for the overall platform, while the architecture diagram labels the Threadlinqs Intel component as version 3.1.1.

_Full upstream README: https://allmcps.com/mcp/intelthreadlinqs-mcp-2/readme_