C
Cybersecurity Threat Intelligence MCP
CVE search, vulnerability database, EPSS exploit prediction, KEV, IP reputation & threat feed.
Quick Install
Automated & IDE SetupCopy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.
Manual Client & Custom JSON ConfigExpand JSON ▾
Install Config Generator
Choose your client
💡 Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows)
Capabilities & Tool Schemas (9)
Inspect callable tools, capabilities, and parameters exposed to AI agents by Cybersecurity Threat Intelligence MCP.
search_cveCVE search by severity, CVSS, **EPSS**, attack vector, KEV status
cve_detailFull CVE — CVSS breakdown, EPSS, KEV, CWE, affected products, refs
check_ipIP reputation (AbuseIPDB + OTX) — abuse score, threat type, pulses
check_domainDomain threat indicators (OTX)
vulnerability_scanAll CVEs for a product, **sorted by EPSS** — "should I worry about this dependency?"
threat_feedRecent threat indicators (IPs/domains/hashes/URLs)
Documentation Overview
Cybersecurity Threat Intelligence MCP
Cybersecurity threat intelligence for AI agents — CVE search enriched with EPSS exploit-likelihood + CISA known-exploited (KEV) status, plus live IP/domain reputation and a real-time threat feed.
Part of the FoundryNet Data Network. Every result carries verifiable provenance so a buyer can confirm it was produced by this server, unaltered. See also: gov-contracts-mcp, brand-intel-mcp, patent-intel-mcp, financial-signals-mcp, weather-intel-mcp, compliance-mcp.
Connect
- MCP endpoint (Streamable HTTP):
https://cyber-intel-mcp-production.up.railway.app/mcp - Registry:
io.github.FoundryNet/cyber-intel-mcp - Agent card:
https://cyber-intel-mcp-production.up.railway.app/.well-known/agent-card.json
Claude Desktop / Cursor / Claude Code
Tools
| Tool | Price | What it does |
|---|---|---|
search_cve | $0.01 | CVE search by severity, CVSS, EPSS, attack vector, KEV status |
cve_detail | free | Full CVE — CVSS breakdown, EPSS, KEV, CWE, affected products, refs |
check_ip | $0.01 | IP reputation (AbuseIPDB + OTX) — abuse score, threat type, pulses |
check_domain | $0.01 | Domain threat indicators (OTX) |
vulnerability_scan | $0.05 | All CVEs for a product, sorted by EPSS — "should I worry about this dependency?" |
threat_feed | $0.01 | Recent threat indicators (IPs/domains/hashes/URLs) |
brief_summary | $0.50 | Sample of the day's curated threat brief (headline findings) |
daily_brief | $15 | Full curated daily threat brief — top exploited CVEs, KEV adds, active indicators |
mint_info | free | FoundryNet Data Network + provenance/attestation info |
Free tier: 25 paid-tool queries/day per agent. Then metered: the tool returns an
HTTP-402 with a payment request — settle it, re-call with the same args plus
payment_tx=<reference>. An Authorization: Bearer fnet_… key bypasses the paywall.
The edge: EPSS-ranked vulnerabilities
Raw CVE counts are noise. Every vulnerability here carries its EPSS score (the
probability it'll be exploited) and a CISA KEV flag (whether it's actively
exploited). vulnerability_scan sorts a product's CVEs by exploit likelihood — so
an agent triaging a dependency sees what actually matters first.
Sources
Every 6 hours: NVD (CVEs, keyless + throttled), EPSS (exploit probability), CISA KEV (known-exploited catalog), GitHub Advisories. Live on demand: AbuseIPDB (IP reputation) + AlienVault OTX (IP/domain/pulse indicators). Stored in a standalone Supabase project.
Discovery
MCP registry: io.github.FoundryNet/cyber-intel-mcp
Built by FoundryNet · forge@foundrynet.io
Live network activity
Live feed: mint.foundrynet.io/feed
Real-time verified work across 17 servers and autonomous agents, with verifiable provenance on every result.
Related MCP Servers
Frequently Asked Questions about Cybersecurity Threat Intelligence MCP
AllMCPs Directory Badge
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
Badge Style:
Live Dynamic SVG Preview
Markdown (GitHub README)
[](https://allmcps.com/mcp/cybersecurity-threat-intelligence-mcp)HTML Embed
<a href="https://allmcps.com/mcp/cybersecurity-threat-intelligence-mcp"><img src="https://allmcps.com/api/badge/cybersecurity-threat-intelligence-mcp?style=directory" alt="Cybersecurity Threat Intelligence MCP on AllMCPs" /></a>Technical Specs & Signals
CategoryDatabases
52Quality signal: Good · 52/100How this signal is calculated ▾
Server availabilityNot measured
Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.
Verified ownership10/20
Documentation & tools25/30
Adoption & activity4/15
Community engagement0/10
A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.
Own this project?
This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to get the verified badge and attach your website.
Free dofollow backlink: after claiming, verify your product site and place a dofollow AllMCPs badge — we recheck it stays live.
Claim & get free dofollowShare & Embed
Add our SVG badge (dark/light directory styles) or embeddable widget to your site.