MCP Security

What the fr0gger/MCP_Security MCP server does

The fr0gger/MCP_Security MCP server exposes ORKL threat intelligence data through the Model Context Protocol. It is designed for MCP-compatible applications that need to query threat reports, threat actors, and the sources associated with intelligence data.

Report tools can list recent reports with their titles and IDs, then retrieve full details for a selected report. Threat actor tools provide a list of known actors and a detail lookup by actor ID. Source tools list intelligence sources and retrieve metadata for a selected source by source ID.

The repository’s listed tool, fetch_latest_threat_reports, takes no parameters and returns recent report titles and IDs. The additional tools documented in the README accept the identifier needed for their respective detail queries.

How it works

An MCP client starts the local server and invokes one of its named tools. List operations do not require an identifier: fetch_latest_threat_reports, fetch_threat_actors, and fetch_sources are documented without parameters. Detail operations use an ID obtained from a corresponding list operation: report_id, actor_id, or source_id.

The server queries the ORKL API behind these MCP tools.

Setup and configuration

The fr0gger/MCP_Security MCP server is configured as a local stdio server in the provided Claude Desktop example. The configuration uses the uv command, passes a project directory with --directory, and runs the orkl entry point. The example path is specific to the author’s machine and must be replaced with the local path to the project before use.

The documented configuration places the server under the mcpServers object with the name orkl. This makes it available to Claude Desktop after the client reads the configuration file.

Tools and capabilities

The fr0gger/MCP_Security MCP server documents these operations:

• fetch_latest_threat_reports: Lists recent threat reports with titles and IDs.
• fetch_threat_report_details: Retrieves details for a report using report_id.
• fetch_threat_actors: Lists known threat actors with IDs and names.
• fetch_threat_actor_details: Retrieves actor information using actor_id.
• fetch_sources: Lists sources used in threat intelligence.
• fetch_source_details: Retrieves source metadata using source_id.

Together, these tools support a list-then-detail workflow. An agent can first obtain identifiers and then use the relevant detail tool to inspect a specific ORKL record.

Limitations and notes

It also does not document tools beyond the six operations listed in the README. The Claude Desktop setup example contains a machine-specific project path, so it is not a copy-and-run command until that path is changed to the local checkout location.

The fr0gger/MCP_Security MCP server should therefore be evaluated against the ORKL data and query behavior required by the client. Its documented scope is retrieval and inspection of ORKL reports, actors, and sources; no evidence is provided for alerting, automated analysis, report generation, or modifications to ORKL data.