WireMCP is an MCP server that provides real-time network traffic analysis capabilities for large language models (LLMs). It realizes data capture, threat detection, and network diagnosis by integrating the Wireshark tool.

The ADEO CTI MCP Server is a security analysis platform that integrates the APIs of Shodan and VirusTotal, providing comprehensive network security services such as network intelligence, vulnerability assessment, and threat detection.

An MCP server project for threat information collection, supporting the collection of threat intelligence within a specified time range through command - line tools and integration with the Neo4j knowledge graph.

An AI-driven MCP server that automatically connects to the Malware Bazaar platform, providing real-time threat intelligence and malware sample metadata for authorized network security research.

MCP Fortress is a comprehensive security tool designed for Model Context Protocol (MCP) servers, offering automated vulnerability scanning, runtime protection, risk scoring, and threat detection functions, and supporting integration with AI assistants such as Claude Code through the MCP server mode for security analysis.

A professional SonicWall log analysis and threat detection MCP server that supports natural language queries of firewall logs, provides real-time threat monitoring and intelligent security analysis, and is compatible with SonicOS versions 7.x and 8.x.

The Devici MCP Server is a model context protocol server used to interact with the Devici API, providing LLM tools to manage users, collections, threat models, components, threats, mitigation measures, teams, and dashboard data.

AWS Security MCP is a service based on the model context protocol that allows AI assistants to independently check and analyze security issues in AWS infrastructure through natural language queries. It supports multiple AWS security services, including IAM, EC2, S3, etc., and provides security recommendations and threat modeling reports.

The ORKL MCP Server is a Model Context Protocol server for querying the ORKL API, providing tools for obtaining and analyzing threat intelligence reports, threat actors, and sources.

The OpenCTI MCP Server is a threat intelligence query server that provides standardized interfaces and supports various threat intelligence operations and system management functions.

The Mallory MCP Server is a server that provides real-time network threat intelligence and supports proxy access to network security-related information such as vulnerabilities, threat actors, and malware.

The OpenCTI MCP Server is a Model Context Protocol server integrated with the OpenCTI platform, providing a standardized threat intelligence query interface that supports various functions such as report retrieval, malware search, and user management.

ADEO CTI MCP Server is a network security analysis platform integrating Shodan and VirusTotal APIs, providing comprehensive threat intelligence and asset analysis functions.

This project uses the MCP protocol and AI technology to build automated network security tools, covering multiple fields such as red - team attack simulation, SOC analysis, malware development, and threat hunting, to achieve the intelligence and automation of security tasks.

The Threat.Zone MCP server is a malware analysis service interface built on FastMCP, providing LLMs with a standardized threat analysis toolset that supports file/URL detection, sandbox analysis, network behavior monitoring, and other functions.

EventWhisper is a Windows event log MCP server that provides fast and scriptable access to .evtx log files, designed for event response, digital forensics, and threat hunting, supporting functions such as time window, event ID, and keyword filtering.

The YaraFlux MCP Server is a threat analysis server based on YARA rules, which provides file scanning and rule management functions for AI assistants through the Model Context Protocol (MCP).

sec-mcp is a Python security detection toolkit that provides security check functions for domains, URLs, IPs, etc. It supports integration with Python applications, use in the terminal CLI, or running as an MCP server to provide real-time threat insights for LLMs.

The urlDNA MCP Server is a service that provides native tool usage for security-oriented LLM agents (such as OpenAI GPT-4.1 and Claude 3 Desktop), interacting directly with the urlDNA threat intelligence platform through the API. It supports various tools, including URL scanning, searching, and quick checking, and can be accessed via the SSE protocol.

Cyber Sentinel is a threat intelligence aggregation MCP server that provides a unified multi-source threat intelligence access interface, supporting security indicator analysis, code security detection, dependency scanning, and infrastructure security assessment.

An MCP server integrated with the MISP platform, providing threat intelligence capabilities for large language models, including malware detection, threat intelligence search, IoC submission, and report generation.

The MCP Threat Intelligence Server provides the ability to access multiple threat intelligence sources in a unified manner, supports queries for IPs, domain names, hashes, and URLs, integrates platforms such as AlienVault OTX, AbuseIPDB, GreyNoise, and abuse.ch, and allows botnet tracking using Feodo Tracker without an API key.

The Chaitin IP Intelligent Query Service relies on the global honeypot network and millions of nodes to provide accurate IP portraits and threat warnings, and supports subscription to the malicious IP database.

Enterprise-level authentication management MCP server, providing multi-protocol authentication, real-time threat detection, and encrypted credential management functions

The ORKL MCP Server is a Model Control Protocol server for accessing the ORKL Threat Intelligence Library. It provides standardized MCP tools and resources, supports efficient caching and rate limiting, and has built-in integration with Claude Desktop.

abusech-mcp is an MCP server that retrieves threat intelligence data about malware, URLs, IPs, and domains from multiple abuse.ch platforms through a unified API.

An enterprise-level authentication management MCP server that provides multi-protocol authentication, real-time threat detection, and encrypted credential management functions

The Joe Sandbox MCP Server is a Model Context Protocol (MCP) server for interacting with Joe Sandbox cloud services, providing rich malware analysis, IOC extraction, and threat intelligence functions, and can be integrated into MCP - compatible applications.

The MITRE ATT&CK MCP Server is an AI - native threat intelligence tool that provides comprehensive access to the MITRE ATT&CK framework through the Model Context Protocol. It has the ability to query over 200 techniques, over 140 threat groups, and over 700 software entries, supports the generation of ATT&CK Navigator visualization layers, and is designed for security teams and AI agents.