Log inSubmit server
Alienvault Otx logo

Alienvault Otx

Query AlienVault OTX threat-intelligence pulses and look up indicators through MCP tools.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Alienvault Otx

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "alienvault-otx": {
      "command": "npx",
      "args": [
        "-y",
        "@pipeworx/mcp-alienvault-otx"
      ],
      "env": {
        "PLATFORM_OTX_KEY": "YOUR_VALUE_HERE",
        "PIPEWORX_API_KEY": "YOUR_VALUE_HERE",
        "PIPEWORX_META_TOOLS": "YOUR_VALUE_HERE",
        "NODE_USE_ENV_PROXY": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Automated check passed— started and listed 3 tools correctly (5d ago).

Overview

Alienvault Otx MCP server connects MCP clients to AlienVault Open Threat Exchange for community threat-intelligence pulse searches and indicator lookups. It exposes tools for searching pulses, retrieving a pulse by ID, and checking IPv4, IPv6, domain, hostname, URL, or file indicators. Use the hosted HTTPS endpoint, the local npm stdio bridge, or direct HTTP calls through the Pipeworx gateway. Authentication can use a Pipeworx key, an OTX API key, or anonymous access subject to gateway limits.

Use cases

  • Search OTX pulses for ransomware or other threat topics
  • Retrieve a pulse by its OTX identifier
  • Look up domains, URLs, hosts, IP addresses, or file indicators
  • Ask Pipeworx to route broader threat-intelligence questions

Key features

  • Searches community OTX pulses
  • Retrieves individual pulses
  • Looks up IPv4, IPv6, domain, hostname, URL, and file indicators
  • Supports hosted MCP, local stdio, and HTTP access
  • Offers optional Pipeworx gateway meta-tools

Tools3

What Alienvault Otx lets your agent do. Expand a tool for its parameters.

Verified live~556 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

12/12 checks healthy over the last 62d

What it can do

From the 3 tools this server returned when we ran it; 3 declare their own safety hints.

Makes network requests · 3Read-only tools · 3
Network at startup5 connections
Files written at startupNone
Install scriptsNone
npm provenanceSigned build
Package age175 days
Maintainers1

Observed 2026-11-03 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 15d ago via OSV.dev · @pipeworx/mcp-alienvault-otx (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads475Package downloads in the last 30 days.
Last commit9d agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed3Callable tools this server registers over MCP.

How Alienvault Otx works

What Alienvault Otx does

Alienvault Otx provides MCP access to AlienVault Open Threat Exchange (OTX), using the OTX API at https://otx.alienvault.com/api/v1. Its focus is community threat-intelligence data: finding pulses, reading a specific pulse, and looking up indicators.

The integration is independent and unofficial. It is maintained as part of Pipeworx, a gateway that connects AI agents to external data sources. The AlienVault OTX endpoint is useful when an agent needs to investigate an indicator or locate threat reports matching a query.

How it works

MCP clients can connect to the hosted endpoint at:

https://gateway.pipeworx.io/alienvault-otx/mcp

The endpoint exposes the three AlienVault OTX tools along with shared Pipeworx meta-tools. These additional tools include ask_pipeworx, discover_tools, search_within, and remember/recall. The endpoint's initialize response reports the exact tool scope for the connection.

A full Pipeworx gateway endpoint is also available at https://gateway.pipeworx.io/mcp. Both endpoints use the same gateway and data sources; the pack endpoint lists AlienVault OTX tools directly, while the full gateway lists all available packs directly. ask_pipeworx can route questions across the wider catalog from either endpoint.

Calls can also be made over HTTP, such as a POST request to /v1/tools/search_pulses. The npm package provides a local stdio bridge that forwards MCP calls to the hosted gateway, so it requires network access and has no offline mode.

Setup and configuration

For a hosted MCP connection, add the AlienVault OTX URL to an MCP client configuration. The documented clients include Claude Desktop, Cursor, and Windsurf. The local option runs with npx -y @pipeworx/mcp-alienvault-otx.

Authentication supports a gateway platform key through PLATFORM_OTX_KEY, or an OTX key supplied as ?_apiKey=<key> after registering for free with AlienVault OTX. The local npm bridge can use PIPEWORX_API_KEY as a Bearer token. Anonymous local calls are allowed but limited to 50 calls per day; a free Pipeworx account raises the limit to 200 calls per day.

Set PIPEWORX_META_TOOLS=1 for the local bridge if shared gateway tools should also appear in its tool list. Without that setting, the bridge lists only the AlienVault OTX pack tools. When using an HTTPS proxy, newer Node versions can honor the proxy environment setting when NODE_USE_ENV_PROXY=1 is enabled.

Tools and capabilities

  • search_pulses(query, limit?, page?) searches OTX community pulses with optional result and page controls.
  • get_pulse(pulse_id) retrieves a pulse by its identifier.
  • lookup_indicator(indicator, type?) looks up an IPv4 address, IPv6 address, domain, hostname, URL, or file indicator.

The gateway also supports inspecting tools with GET /v1/tools/<tool-name> and invoking them with POST /v1/tools/<tool-name>.

Limitations and notes

The integration depends on network access to the Pipeworx gateway and OTX services. The hosted pack endpoint includes shared gateway meta-tools in addition to the pack's own tools, so its reported tool count is larger than the three AlienVault OTX operations. Anonymous usage is rate-limited, while authenticated calls are metered through the gateway. The project is an unofficial integration and is not affiliated with or endorsed by AlienVault OTX.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Alienvault Otx

Alienvault Otx is an MCP server that connects AI clients to AlienVault Open Threat Exchange through the Pipeworx gateway. Its main tools search community threat-intelligence pulses, retrieve a pulse by ID, and look up IPv4, IPv6, domain, hostname, URL, or file indicators.

Run it locally with `npx -y @pipeworx/mcp-alienvault-otx`, or configure an MCP client with the hosted URL `https://gateway.pipeworx.io/alienvault-otx/mcp`. The local bridge forwards calls to the gateway and requires network access.

Authenticate with a Pipeworx API key, or supply an AlienVault OTX key using the documented `?_apiKey=<key>` form. The gateway also names `PLATFORM_OTX_KEY` for platform authentication. Anonymous calls are available with daily limits.

Yes, Alienvault Otx works with Cursor through the hosted MCP endpoint. Add `https://gateway.pipeworx.io/alienvault-otx/mcp` to Cursor's MCP configuration, or run the npm stdio bridge from the client.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewAlienvault Otx AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/alienvault-otx?style=directory)](https://allmcps.com/mcp/alienvault-otx)
HTML Embed
<a href="https://allmcps.com/mcp/alienvault-otx"><img src="https://allmcps.com/api/badge/alienvault-otx?style=directory" alt="Alienvault Otx on AllMCPs" /></a>