Log inSubmit server
ZettelForge logo

ZettelForge

Stores and retrieves cyber threat intelligence as STIX knowledge graphs with alias resolution, blended search, and optional local synthesis.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install ZettelForge

Pick your client, then add it in one click or paste the config.

STDIOPython
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "zettelforge": {
      "command": "uvx",
      "args": [
        "zettelforge"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

uvx zettelforge

Process exited before answering initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 15d ago.

Overview

The ZettelForge MCP server gives Claude Code access to agentic memory for cyber threat intelligence, including extracted CVEs, actors, IOCs, and ATT&CK techniques. It builds a STIX 2.1 knowledge graph, resolves actor aliases, and combines vector retrieval with graph traversal. Storage and processing run in-process using SQLite and LanceDB, with optional local LLM support through Ollama or other configured providers. Reach for it when analysts need searchable investigation context that can run without cloud services or API keys.

Use cases

  • Store analyst notes with extracted CTI entities
  • Recall prior investigations by actor, IOC, CVE, or technique
  • Resolve threat-actor aliases across reports
  • Synthesize findings from accumulated intelligence
  • Track additions, updates, deletions, and superseded intelligence

Key features

  • STIX 2.1 entity and relationship modeling
  • Threat-actor alias resolution
  • Vector and graph-based blended retrieval
  • Optional local LLM synthesis and enrichment
  • Memory evolution with ADD, UPDATE, DELETE, and NOOP decisions
  • OCSF audit event logging

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

16/16 checks healthy over the last 61d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 9d ago via OSV.dev · zettelforge (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars66Stargazers on the source repository.
Last commit9d agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.

How ZettelForge works

What ZettelForge MCP server does

The ZettelForge MCP server connects an AI coding or analysis agent to a local memory system designed for cyber threat intelligence. It accepts analyst notes and threat reports, extracts security entities, and stores them as structured memories. Supported entity types include CVEs, threat actors, IP addresses, domains, hashes, URLs, email addresses, MITRE ATT&CK techniques, campaigns, intrusion sets, tools, people, locations, and organizations.

The system represents extracted information with STIX 2.1 types and builds a knowledge graph from entity relationships. It can recognize that names such as APT28, Fancy Bear, Sofacy, and STRONTIUM refer to the same actor. It also records temporal relationships and supersession so newer intelligence can replace or qualify older information.

How it works

Memory ingestion begins with regex-based extraction and can be enriched with local LLM-based named-entity recognition. Recall combines 768-dimensional fastembed vector search with breadth-first traversal of graph edges. An intent classifier weights those retrieval paths for factual, temporal, relational, exploratory, or causal questions.

When memory evolution is enabled, new intelligence is compared with existing records. An LLM can classify the change as ADD, UPDATE, DELETE, or NOOP, allowing duplicates, stale information, and contradictions to be handled as new material arrives. Synthesis can then produce an answer across stored memories using the direct_answer format.

Setup and configuration

Install the Python package with:

Terminal
pip install zettelforge

A basic MemoryManager() uses a local data directory at ~/.amem/. Set ZETTELFORGE_DATA_DIR or use configuration to change that location. The initial embedding model download may require network access; once models are available locally, the system can operate offline, including on air-gapped hosts.

No external API key is required. Embeddings use fastembed and ONNX by default. For synthesis and richer extraction, run Ollama locally and preload a model, or configure another supported provider such as local llama-cpp, litellm, or mock for tests.

Tools and capabilities

ZettelForge MCP server exposes the memory workflow to Claude Code through MCP. Its documented memory operations include:

  • Remembering CTI notes and extracting security entities.
  • Recalling relevant memories through blended vector and graph search.
  • Synthesizing answers across stored investigations.
  • Resolving threat-actor aliases during storage and retrieval.
  • Evolving stored knowledge as new intelligence arrives.
  • Emitting audit events in the Open Cybersecurity Schema Framework format.

The audit stream can be sent to a SIEM, written to a WORM store, or left unused according to the surrounding deployment.

Limitations and notes

Without an LLM, remember and recall remain useful in the pip-only setup, but synthesis returns a structured response with a fallback placeholder rather than a generated answer. Local LLM inference and richer extraction therefore require an available provider. The first use may download an approximately 80 MB embedding model, so a fully offline deployment needs its models preloaded.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about ZettelForge

ZettelForge is an MCP server that connects Claude Code to local cyber threat intelligence memory. Its main operations store notes, recall related investigations, and synthesize answers. It extracts CVEs, actors, IOCs, and ATT&CK techniques, resolves aliases, and searches a STIX 2.1 knowledge graph using vector and graph retrieval.

Install it with `pip install zettelforge`. The package runs in-process and stores data under `~/.amem/` by default. You can change the data location with `ZETTELFORGE_DATA_DIR` or configuration; no external API key is required.

Yes, storage and recall work without an LLM after installing the package. Regex extraction handles the basic quick-start workflow, while synthesis returns a fallback placeholder and richer entity extraction require a configured LLM provider.

Yes, after the required embedding and LLM models are downloaded or otherwise preloaded. The default architecture uses local components and does not require cloud APIs, but the first model download can use outbound network access.

It resolves aliases during storage and recall, allowing names such as APT28, Fancy Bear, Sofacy, and STRONTIUM to map to one actor node. This lets searches use one alias while retrieving intelligence stored under another.

Related MCP servers

All in Knowledge & Memory All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewZettelForge AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/zettelforge?style=directory)](https://allmcps.com/mcp/zettelforge)
HTML Embed
<a href="https://allmcps.com/mcp/zettelforge"><img src="https://allmcps.com/api/badge/zettelforge?style=directory" alt="ZettelForge on AllMCPs" /></a>