# mcp-threatintel [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/aplaceforallmystuff/mcp-threatintel  
**GitHub Stars:** 10  
**npm Downloads (last month):** 316  
**Views:** 12  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mcp-threatintel

## Description
Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker

## Tools
Capabilities this server exposes over MCP:

- **threatintel_status** — Check which threat intelligence sources are configured. Currently available: feodo
- **threatintel_lookup_ip** — Look up an IP address across all configured threat intelligence sources (OTX, AbuseIPDB, GreyNoise, Feodo Tracker)
- **threatintel_lookup_domain** — Look up a domain across threat intelligence sources (OTX, URLhaus)
- **threatintel_lookup_hash** — Look up a file hash (MD5, SHA1, SHA256) across threat intelligence sources (OTX, MalwareBazaar)
- **threatintel_lookup_url** — Look up a URL for malware/phishing indicators (OTX, URLhaus)
- **feodo_tracker** — Get active botnet C2 servers from Feodo Tracker (Emotet, Dridex, QakBot, etc.)

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mcp-threatintel": {
    "command": "npx",
    "args": ["-y","mcp-threatintel-server"],
    "env": {
      "OTX_API_KEY": "",
      "ABUSEIPDB_API_KEY": "",
      "GREYNOISE_API_KEY": "",
      "ABUSECH_AUTH_KEY": ""
    }
  }
}
```

**Requires environment variables:** `OTX_API_KEY`, `ABUSEIPDB_API_KEY`, `GREYNOISE_API_KEY`, `ABUSECH_AUTH_KEY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What mcp-threatintel does

mcp-threatintel presents several threat intelligence services through one MCP interface. It supports lookups for IP addresses, domains, file hashes, and URLs, combining results from the sources that are configured. The supported providers include AlienVault Open Threat Exchange (OTX), AbuseIPDB, GreyNoise, URLhaus, MalwareBazaar, ThreatFox, and Feodo Tracker.

The server also exposes source-specific operations. OTX tools retrieve or search threat intelligence pulses, AbuseIPDB checks IP reputation and abuse history, and GreyNoise helps classify internet scanning activity versus targeted threats. abuse.ch tools cover URLhaus, MalwareBazaar, ThreatFox, and Feodo Tracker data.

## How it works

At startup, the server reads API keys from environment variables and enables the corresponding integrations. `threatintel_status` reports which sources are configured. Unified lookup tools then query the available providers for an IP, domain, hash, or URL and return the responses together.

Feodo Tracker uses public JSON feeds and works without authentication. Other providers require their respective keys. If one configured source fails, unified lookups can still return results from sources that respond successfully. Provider rate limits and invalid credentials can affect individual results.

## Setup and configuration

The package requires Node.js 20 or newer. Run it directly with:

```bash
npx mcp-threatintel-server
```

You can also install it globally with `npm install -g mcp-threatintel-server`, or clone the repository, run `npm install`, build with `npm run build`, and start the generated program with `node dist/index.js`.

Configure the server as an MCP stdio process. Claude Desktop uses its `claude_desktop_config.json` file, while Claude Code uses `~/.claude.json`. The configuration supplies `npx` as the command, passes `-y` and `mcp-threatintel-server` as arguments, and places provider credentials in the `env` object.

Available environment variables are `OTX_API_KEY`, `ABUSEIPDB_API_KEY`, `GREYNOISE_API_KEY`, and `ABUSECH_AUTH_KEY`. All are optional individually. OTX, AbuseIPDB, GreyNoise, and abuse.ch offer free access tiers described by their respective services; Feodo Tracker needs no key.

## Tools and capabilities

- `threatintel_status`: show configured intelligence sources.
- `threatintel_lookup_ip`: search configured sources for an IP address.
- `threatintel_lookup_domain`: search OTX and URLhaus-capable sources for a domain.
- `threatintel_lookup_hash`: check MD5, SHA1, or SHA256 values through OTX and MalwareBazaar.
- `threatintel_lookup_url`: search for malware and phishing indicators.
- `feodo_tracker`: retrieve active botnet C2 servers, including families such as Emotet, Dridex, and QakBot.
- OTX pulse retrieval and keyword search.
- AbuseIPDB reputation checks and GreyNoise IP classification.
- URLhaus, MalwareBazaar, and ThreatFox searches and recent-data operations.

## Limitations and notes

Coverage depends on the API keys supplied and the availability of each provider. Missing credentials disable the related integrations, while Feodo Tracker remains usable without authentication. Invalid or expired keys can produce 401 errors, and provider rate limits can produce 429 errors. Unified queries may therefore return partial results rather than a complete response from every source.

_Full upstream README: https://allmcps.com/mcp/mcp-threatintel/readme_