threat-intelligence MCP servers & tools

MCP server for querying the VirusTotal API. This server provides tools for scanning URLs, analyzing file hashes, and retrieving IP address reports.

Connects AI agents with CrowdStrike Falcon for security analysis and automation.

MCP server providing 50+ tools for MITRE ATT&CK techniques, groups, and mitigations

Community extension of CrowdStrike falcon-mcp with near-complete Falcon API coverage

A Model Context Protocol (MCP) server for querying the CVE-Search API. This server provides comprehensive access to CVE-Search, browse vendor and product、get CVE per CVE-ID、get the last updated CVEs.

8 bundled intelligence endpoints (security, company, threat, compliance, sales, sports, property, health) via x402 micropayments on Base.

MCP server for querying the ORKL API. This server provides tools for fetching threat reports, analyzing threat actors, and retrieving intelligence sources.

abuse.ch Feodo Tracker botnet C&C IP blocklist

SANS Internet Storm Center (ISC) MCP.

GreyNoise Community MCP — internet scanner classification (free tier with key)

URLhaus MCP — wraps abuse.ch URLhaus malware URL database (free, no auth)

CIRCL Vulnerability-Lookup — aggregated vulnerability records

OSINT MCP server — 23 tools: DNS, WHOIS, Shodan, breaches, GEOINT, crypto. Works with Claude Code.

Security intelligence API with 31 MCP tools for CVE/EPSS/KEV lookup, domain recon (DNS/WHOIS/SSL/subdomains/CT logs), IOC/threat intel, OSINT (email/phone/username), and code security scanning (secrets, injection). Free 100 req/hr.

MCP server for Cyberbro IOC extraction, enrichment and reputation analysis.

VirusTotal reports, file and URL submissions, domain/IP reanalysis, and analysis recovery.

A Rust-based MCP server to integrate Cortex, enabling observable analysis and automated security responses through AI.

VulnCheck exploit intelligence — CVE research, exploit data, advisories, and threat analysis.

OSINT sweep of a digital footprint: breaches, accounts, data brokers, domains and IPs

MCP server for automated URL scanning and forensic phishing triage. Captures full DOM snapshots, network requests, and visual screenshots to identify malicious redirects and infrastructure. Supports historical threat hunting using Custom Query Language (CQL) to map actor patterns across millions of recorded scans.

MCP server for Proofpoint TAP — threat intelligence, forensics, quarantine, and email security.

Rust infrastructure diagnostics MCP server for AI agents: DNS checks, TLS certificate chain inspection, email security, global DNS propagation, and DNS latency benchmarking.

Honeypot threat intelligence for AI agents: 90 days of probe data from a sensor network for IP reputation, scanner classification, CVE probing trends, and JA4/JA4H/HASSH fingerprints. Remote MCP, free tier.

MISP (Malware Information Sharing Platform) MCP server with built-in prompt injection defense via prompt-defense-audit. 8 read-only threat-intel tools (events, attributes, search, tags, feeds, galaxies). Scans every MISP response for adversarial seeding before returning to LLM. Tracks MISP/MISP10745. MIT.

AI-powered scam and threat verification MCP server. Check phone numbers, URLs, text messages, emails, documents, and QR codes against 8M+ threat intelligence records (FTC/FCC complaints, carrier analysis, URLhaus, ThreatFox). Returns risk scores, verdicts, and detailed signals. 10 tools, OAuth 2.1 + API key auth, Streamable HTTP transport.

Security & trust layer for AI agents. Scan an MCP server or skill before you install it (scanmcpplugin, scanskill) — flags exfiltration, prompt-injection sinks, dangerous capabilities, install hooks and obfuscation → PROCEED/CAUTION/BLOCK. Plus vetendpoint (endpoint safety verdict before an agent calls or pays it) and 25 more tools: vuln scans, threat intel, compliance (SOC 2/ISO 27001/HIPAA), code security (SAST/secret/dependency), identity — 28 total. Per-call billing via API key or x402 USDC on Base; free discovery tier.

MCP server for domain and URL security analysis powered by GridinSoft Inspector, enabling AI agents to verify website and link safety.

Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.

MCP server for Mimecast email security: message queue, held messages, domains, and threats.

CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions. All tools keyless.

Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.

Threadlinqs threat-intelligence MCP — 49 tools: threats, detections, IOCs, actors, C2, MITRE, CVEs

Query Truss threat intelligence via hosted MCP (OAuth). Growth+ plans.

Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats

Security Feeds MCP.

Search 365k+ CVEs/NotCVEs: CVSS, EPSS, CISA KEV, affected versions, advisories, exploits, patches.

STIX 2.1 threat indicator feed: IPs, domains, URLs, file hashes from ThreatFox, OTX, NVD.

Manage MagicSword endpoints, alerts, policies, and private intelligence through MCP.