#threat-intel

Threat intelligence MCP server for SOC analysts, DFIR and security researchers. Scan and enrich IOCs directly from Claude, Cursor or any MCP client: IP addresses (IPv4/IPv6), domains, file hashes and blockchain addresses. Search CVEs by keyword, vendor or product, retrieve full CVE records, and explore a threat actor database (APTs, groups, TTPs) with reverse CVE-to-actor lookup. Includes scan history, bookmarks and quota management. Free tier available — no credit card required. Built by mlab.sh, the IOC & file intelligence platform.

LiveDataLink is a hosted MCP server giving AI agents 182 real-time data tools across 36 domains through a single Streamable HTTP endpoint. Coverage includes sanctions screening (OFAC + UN + EU + BIS DPL first-party indexed), SEC EDGAR, federal courts plus Caselaw Access Project, IRS nonprofits, NPPES healthcare providers, USAspending federal awards, Federal Register + eCFR regulations, CVE + threat intel (RDAP, IP reputation, FBI Wanted, CISA KEV), FRED + BLS + US Treasury + World Bank macro, EIA + NREL energy, Zillow real estate, Texas parcels, ClinicalTrials.gov, FDA, EPA, FEC, FMCSA trucking, USPTO patents, Census, federal recreation (RIDB), Project Gutenberg books, OpenAlex scholarly, NPM + PyPI + cargo + GitHub supply-chain intel, and more. One bearer token, one endpoint, one bill. Built for compliance + due diligence + agentic research workflows. Free tier (100 queries/month, no credit card) available at https://livedatalink.ai/signup/free. Paid plans from $10/month. Open MCP protocol, portable keys, no lock-in. Operated by Blackbox Foundry LLC out of Texas.

28 WhoisXML API tools for AI agents — WHOIS lookups & history, reverse WHOIS, DNS lookup & history, reverse DNS/MX/NS, IP geolocation, IP netblocks, SSL certificates, subdomain discovery, threat intelligence, domain categorization, email verification, typosquatting detection, and bulk variants for batched lookups. Stdio and Streamable-HTTP transports, OAuth 2.1 with PKCE for hosted mode, npm and Docker distributions.

A live MCP server exposing DugganUSA's threat-intelligence corpus to MCP-speaking agents. Read-only, secure-by-default. JSON-RPC 2.0 over HTTP at `https://analytics.dugganusa.com/api/v1/mcp`.

AI security intelligence on Base. Three paid MCP tools: CVE vulnerability lookup ($0.01), IP/domain reputation check ($0.01), and secret/credential scan ($0.05). Pay-per-call via x402 USDC on Base. No API keys required for callers. Hosted on Cloudflare Workers with per-tool x402 payment challenges.

WhoisJSON MCP Server exposes four domain intelligence tools directly inside Claude, Cursor, and Windsurf — no code required. whois_lookup: Full WHOIS registration record for any domain — registrar, creation and expiry dates, nameservers, registrant contacts, and DNSSEC status. dns_lookup: All DNS records in a single call — A, AAAA, MX, TXT, CNAME, NS, SOA, CAA, DMARC, and more. Useful for mail server audits, SPF/DKIM verification, and infrastructure mapping. ssl_check: TLS certificate details including issuer, expiry date, Subject Alternative Names, and full chain validity. Detect expired or misconfigured certificates instantly. domain_availability: Instant registration availability check for any TLD. Returns a clear registered/available status. Your WhoisJSON API key works identically for the REST API and the MCP server. 1,000 free requests/month, no credit card required. Get your API key at whoisjson.com.

MCP server with 53 security intelligence tools — CVE/KEV, MITRE ATLAS+D3FEND, Sigma detection rules, email security posture (SPF/DMARC), domain & web intel, threat intel.

Real-time phishing detection, IP reputation, and CVE risk analysis API for AI agents. Powered by live threat feeds (OpenPhish, Feodo Tracker, URLhaus). Pay per request via x402 micropayments (USDC on Base). First 1,000 requests free, no signup required.

x402-paid threat intelligence and market data for AI agents on Solana. Real-time threat feeds from URLhaus, ThreatFox, and MalwareBazaar. Live market data from CoinGecko, DeFi Llama, and Coinbase. Network health monitoring. All endpoints pay-per-call via x402 USDC micropayments. Part of the RelayZero agent economy network.

Live threat intelligence for Claude — check IPs, CVEs, KEV predictions, malware hashes, and pre-attack staging detection. Free, no API key required. Data updates every 15 minutes.

DNS, IP, AS, domain reputation, and Lightning Network intelligence. 44 tools for DNS lookups, reverse DNS, passive DNS, IP reputation, threat intelligence, AS/BGP routing, domain rankings, MAC address lookups, and Bitcoin Lightning Network data. No authentication required.

Connect real-time cybersecurity threat intelligence to your AI workflows through standardized tools and resources. Access comprehensive IOCs, CVEs, TTPs, and threat actor data from FalconFeeds.io with seamless integration across Claude Desktop, VS Code, and other MCP-enabled applications.

Kaspersky OpenTIP Model Context Protocol Server This server gives access to Kaspersky OpenTIP API to agentic applications.

Kaspersky OpenTIP Model Context Protocol Server This server gives access to Kaspersky OpenTIP API to agentic applications.

AlienVault/USM Anywhere MCP Server - Threat intelligence and security monitoring

AgentNull: AI System Security Threat Catalog + Proof-of-Concepts. Collection of PoCs for using Agents, MCP, and RAG in bad ways.

MCP server for Microsoft Sentinel. Enables access to Sentinel logs, incidents, analytics, and Entra ID data via a modular, queryable interface. Strictly non-production. Designed for use with Claude and other LLMs.

A Model Context Protocol (MCP) server that integrates with the MISP (Malware Information Sharing Platform) to provide threat intelligence capabilities to Large Language Models.

MCP server for ORKL Threat Intelligence Library

MCP server for Threat info collection in cyber security

MCP Server for mallory.ai intelligence

This is a threat intel MCP server connected to the ORKL API to retrieve threat report and ask for IOCs, Threat Actors and breaches.