Log inSubmit server
MCP Threatintel logo

MCP Threatintel

Queries IPs, domains, hashes, and URLs across OTX, AbuseIPDB, GreyNoise, abuse.ch, and Feodo Tracker.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install MCP Threatintel

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "mcp-threatintel": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-threatintel-server"
      ],
      "env": {
        "OTX_API_KEY": "YOUR_VALUE_HERE",
        "ABUSEIPDB_API_KEY": "YOUR_VALUE_HERE",
        "GREYNOISE_API_KEY": "YOUR_VALUE_HERE",
        "ABUSECH_AUTH_KEY": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Install not yet sandbox-tested— the server itself is confirmed live (we called its tools/list endpoint). The stdio install command is a separate, ongoing check.

Overview

mcp-threatintel combines threat intelligence lookups from AlienVault OTX, AbuseIPDB, GreyNoise, and abuse.ch projects through MCP tools. It checks IPs, domains, file hashes, and URLs, while Feodo Tracker provides botnet command-and-control data without an API key. API-key-backed sources are enabled dynamically, so results depend on the configured services. Use it for security research, incident response, malware triage, and threat analysis.

Use cases

  • Investigate suspicious IP addresses across multiple reputation sources
  • Check domains and URLs for malware or phishing indicators
  • Triage file hashes against OTX and MalwareBazaar
  • Review active botnet command-and-control infrastructure
  • Correlate threat intelligence during incident response

Key features

  • Unified IP, domain, hash, and URL lookups
  • Dynamic source enablement based on API keys
  • OTX pulse retrieval and keyword search
  • AbuseIPDB and GreyNoise IP analysis
  • URLhaus, MalwareBazaar, and ThreatFox access
  • Unauthenticated Feodo Tracker botnet data

Tools6

What MCP Threatintel lets your agent do. Expand a tool for its parameters.

Verified live~293 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

24/28 checks healthy over the last 90d

What it can do

From the 6 tools this server returned when we ran it.

Makes network requests · 1Read-only tools · 6
Network at startup3 connections
Files written at startupNone
Install scriptsNone
npm provenanceNot published
Package age320 days
Maintainers1

Observed 2026-10-15 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 5d ago via OSV.dev · mcp-threatintel-server (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars10Stargazers on the source repository.
npm downloads316Package downloads in the last 30 days.
Last commit4d agoMost recent push to the default branch.
Tools exposed6Callable tools this server registers over MCP.
Directory activity12 viewsConfig copies, upvotes, and views on AllMCPs.

How MCP Threatintel works

What mcp-threatintel does

mcp-threatintel presents several threat intelligence services through one MCP interface. It supports lookups for IP addresses, domains, file hashes, and URLs, combining results from the sources that are configured. The supported providers include AlienVault Open Threat Exchange (OTX), AbuseIPDB, GreyNoise, URLhaus, MalwareBazaar, ThreatFox, and Feodo Tracker.

The server also exposes source-specific operations. OTX tools retrieve or search threat intelligence pulses, AbuseIPDB checks IP reputation and abuse history, and GreyNoise helps classify internet scanning activity versus targeted threats. abuse.ch tools cover URLhaus, MalwareBazaar, ThreatFox, and Feodo Tracker data.

How it works

At startup, the server reads API keys from environment variables and enables the corresponding integrations. threatintel_status reports which sources are configured. Unified lookup tools then query the available providers for an IP, domain, hash, or URL and return the responses together.

Feodo Tracker uses public JSON feeds and works without authentication. Other providers require their respective keys. If one configured source fails, unified lookups can still return results from sources that respond successfully. Provider rate limits and invalid credentials can affect individual results.

Setup and configuration

The package requires Node.js 20 or newer. Run it directly with:

Terminal
npx mcp-threatintel-server

You can also install it globally with npm install -g mcp-threatintel-server, or clone the repository, run npm install, build with npm run build, and start the generated program with node dist/index.js.

Configure the server as an MCP stdio process. Claude Desktop uses its claude_desktop_config.json file, while Claude Code uses ~/.claude.json. The configuration supplies npx as the command, passes -y and mcp-threatintel-server as arguments, and places provider credentials in the env object.

Available environment variables are OTX_API_KEY, ABUSEIPDB_API_KEY, GREYNOISE_API_KEY, and ABUSECH_AUTH_KEY. All are optional individually. OTX, AbuseIPDB, GreyNoise, and abuse.ch offer free access tiers described by their respective services; Feodo Tracker needs no key.

Tools and capabilities

  • threatintel_status: show configured intelligence sources.
  • threatintel_lookup_ip: search configured sources for an IP address.
  • threatintel_lookup_domain: search OTX and URLhaus-capable sources for a domain.
  • threatintel_lookup_hash: check MD5, SHA1, or SHA256 values through OTX and MalwareBazaar.
  • threatintel_lookup_url: search for malware and phishing indicators.
  • feodo_tracker: retrieve active botnet C2 servers, including families such as Emotet, Dridex, and QakBot.
  • OTX pulse retrieval and keyword search.
  • AbuseIPDB reputation checks and GreyNoise IP classification.
  • URLhaus, MalwareBazaar, and ThreatFox searches and recent-data operations.

Limitations and notes

Coverage depends on the API keys supplied and the availability of each provider. Missing credentials disable the related integrations, while Feodo Tracker remains usable without authentication. Invalid or expired keys can produce 401 errors, and provider rate limits can produce 429 errors. Unified queries may therefore return partial results rather than a complete response from every source.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about MCP Threatintel

mcp-threatintel is an MCP server that connects AI clients to AlienVault OTX, AbuseIPDB, GreyNoise, abuse.ch projects, and Feodo Tracker. Its main tools check IPs, domains, hashes, and URLs, report configured sources, and retrieve active botnet command-and-control servers from Feodo Tracker without requiring an API key.

Install it with `npx mcp-threatintel-server` or `npm install -g mcp-threatintel-server`. You can also clone the repository, run `npm install`, build it with `npm run build`, and start it with `node dist/index.js`.

No API key is mandatory because Feodo Tracker works from public JSON feeds. Add `OTX_API_KEY`, `ABUSEIPDB_API_KEY`, `GREYNOISE_API_KEY`, or `ABUSECH_AUTH_KEY` to enable the corresponding optional sources.

Yes, mcp-threatintel supports both Claude Desktop and Claude Code through MCP stdio configuration. Add the package command and optional provider keys to Claude Desktop's configuration file or to `~/.claude.json` for Claude Code.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewMCP Threatintel AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/mcp-threatintel?style=directory)](https://allmcps.com/mcp/mcp-threatintel)
HTML Embed
<a href="https://allmcps.com/mcp/mcp-threatintel"><img src="https://allmcps.com/api/badge/mcp-threatintel?style=directory" alt="MCP Threatintel on AllMCPs" /></a>