Log inSubmit server
Intelthreadlinqs MCP logo

Intelthreadlinqs MCP

Provides 32 MCP tools for Threadlinqs threat feeds, C2 tracking, IOC search, MITRE mapping, CVE lookup, and simulations.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Intelthreadlinqs MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "intelthreadlinqs-mcp-2": {
      "command": "npx",
      "args": [
        "-y",
        "intelthreadlinqs-mcp@3.1.1"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Automated check passed— started and listed 32 tools correctly (8d ago).

Overview

intelthreadlinqs-mcp MCP server connects MCP clients to Threadlinqs Intel for threat feeds, C2 tracking, IOC searches, MITRE mapping, CVE/CWE lookups, and simulations. It is presented as the threat-intelligence component of a larger detection engineering platform and exposes 32 tools through MCP. A Threadlinqs Intel API key enables live intelligence operations; without one, the platform's detection tools continue to work but intelligence steps are skipped. Use it when an agent needs threat context alongside detection engineering, coverage analysis, or security investigations.

Use cases

  • Retrieve current threat intelligence for an investigation
  • Search and enrich indicators of compromise
  • Track command-and-control infrastructure
  • Map threats and vulnerabilities to MITRE techniques
  • Compare intelligence findings with detection coverage

Key features

  • Threadlinqs threat-feed access
  • C2 infrastructure tracking
  • IOC search and DNS enrichment
  • MITRE mapping
  • CVE and CWE lookup
  • Security simulations

Tools32

What Intelthreadlinqs MCP lets your agent do. Expand a tool for its parameters.

Verified live~2.4k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

11/11 checks healthy over the last 61d

What it can do

From the 32 tools this server returned when we ran it.

Runs commands · 1Can delete or modify data · 1Read-only tools · 30
Network at startup3 connections
Files written at startupNone
Install scriptsNone
npm provenanceNot published
Package age241 days
Maintainers1

Observed 2026-10-31 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 7d ago via OSV.dev · intelthreadlinqs-mcp@3.1.1 (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1Stargazers on the source repository.
npm downloads276Package downloads in the last 30 days.
Last commit7mo agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed32Callable tools this server registers over MCP.

How Intelthreadlinqs MCP works

What intelthreadlinqs-mcp MCP server does

intelthreadlinqs-mcp MCP server exposes Threadlinqs Intel capabilities through the Model Context Protocol. The README places it alongside a separate detection server in a broader Security Detections MCP platform. Its role is to supply threat-intelligence operations that can be called by MCP-compatible clients, workflows, or the platform's web workbench.

The server covers threat feeds, command-and-control tracking, indicator-of-compromise searches, MITRE mapping, CVE and CWE lookups, DNS enrichment, and simulations. These capabilities are intended for investigations and detection work such as examining current threats, enriching indicators, assessing vulnerabilities, and relating intelligence to ATT&CK techniques.

How it works

The workbench connects to the Threadlinqs Intel MCP server through an MCP bridge using stdio transport. Its tool explorer can list the available tools, display their schemas and parameters, and run them from the browser. Workflows can call tools on the intelligence server and combine their results with detection searches, transformations, conditional steps, loops, parallel branches, or LLM analysis.

An ad-hoc terminal can accept natural-language questions about threats, detections, and coverage. The configured LLM selects MCP tools, invokes them, and synthesizes the returned results. This interface is part of the surrounding workbench rather than a requirement of the MCP protocol itself.

Setup and configuration

The documented environment requires Node.js 18 or newer, npm 8 or newer, and Git. The workbench is then installed from its directory and started in development mode, after which it is available at localhost:3000.

Configure the Threadlinqs Intel API key from the workbench's Settings page. The key is obtained from the Threadlinqs Intel service. An LLM provider key for Anthropic or OpenAI is also needed for ad-hoc questions and workflow steps that use an LLM prompt, but it is separate from the intelligence API key.

Tools and capabilities

The documented Threadlinqs Intel tool groups include:

  • Threat-feed access for retrieving intelligence
  • C2 tracking
  • IOC searching
  • MITRE technique and threat mapping
  • CVE and CWE lookups
  • DNS enrichment
  • Security simulations

The same platform includes 74 detection-focused tools for searching and engineering rules across Sigma, Splunk ESCU, Elastic, and KQL. Those tools are provided by the separate security-detections MCP server, not by intelthreadlinqs-mcp MCP server itself. The combined workbench reports 106 tools across both servers and includes workflows for threat hunting, coverage analysis, CVE assessment, and intelligence operations.

Limitations and notes

It also does not document client-specific configuration for editors or desktop applications.

A Threadlinqs key is required for the intelligence operations. Without that key, threat-intelligence workflow steps are skipped, while the detection tools remain usable. LLM-backed ad-hoc analysis and llm_prompt workflow steps have their own provider-key requirement. The README identifies the project license as MIT and lists version 3.0.0 for the overall platform, while the architecture diagram labels the Threadlinqs Intel component as version 3.1.1.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Intelthreadlinqs MCP

intelthreadlinqs-mcp is an MCP server that connects AI clients and workflows to Threadlinqs Intel. Its 32 documented tools provide threat feeds, C2 tracking, IOC searches, MITRE mapping, CVE/CWE lookups, DNS enrichment, and simulations for security investigations and detection engineering.

Install it using the documented Security Detections MCP setup: use Node.js 18+, npm 8+, and Git, clone the source, install dependencies, and run the build. The README then installs and starts the web workbench; it does not provide a separate standalone install command for this component.

It needs a Threadlinqs Intel API key for threat-intelligence operations. Configure that key in the workbench Settings page. Without it, intelligence workflow steps are skipped, while the separate detection tools continue to work.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewIntelthreadlinqs MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/intelthreadlinqs-mcp-2?style=directory)](https://allmcps.com/mcp/intelthreadlinqs-mcp-2)
HTML Embed
<a href="https://allmcps.com/mcp/intelthreadlinqs-mcp-2"><img src="https://allmcps.com/api/badge/intelthreadlinqs-mcp-2?style=directory" alt="Intelthreadlinqs MCP on AllMCPs" /></a>