Opencti MCP

🚀 OpenCTI MCP Server

The OpenCTI MCP Server is a server based on the Model Context Protocol (MCP) that seamlessly integrates with OpenCTI (Open Cyber Threat Intelligence Platform), providing functions to query and retrieve threat intelligence data through standardized interfaces.

Traditional Chinese (繁體中文)

🚀 Quick Start

The OpenCTI MCP Server is a server built upon the Model Context Protocol (MCP). It can be seamlessly integrated with OpenCTI, an open - source cyber threat intelligence platform. It offers the ability to query and retrieve threat intelligence data via standardized interfaces.

✨ Features

• Threat Intelligence Data Retrieval and Search:
  • Fetch the latest reports and search by ID.
  • Search for malware information.
  • Query Indicators of Compromise (IoC).
  • Search for threat actors.
• User and Group Management:
  • List all users and groups.
  • Get detailed user information by ID.
• STIX Object Operations:
  • List attack patterns.
  • Get campaign information by name.
• System Management:
  • List connectors.
  • View status templates.
• File Operations:
  • List all files.
  • Get detailed file information by ID.
• Reference Data Access:
  • List marking definitions.
  • View available tags.
• Custom Query Limits
• Full Support for GraphQL Queries

📦 Installation

Prerequisites

• Node.js 16 or higher.
• Access to an OpenCTI instance.
• Ensure that the necessary dependencies are installed.

Steps

1. Clone the repository:

git clone [repository-url]
cd opencti-mcp-server

2. Install dependencies:

npm install

3. Start the server:

node index.js

📚 Documentation

Configuration

Create a config.json file and add the following content:

{
  "port": 3000,
  "database": {
    "host": "localhost",
    "user": "root",
    "password": "password"
  }
}

Usage

Get the latest reports

curl http://localhost:3000/reports/latest

Search for malware

curl http://localhost:3000/malware?query=malicioussoftware

Query Indicators of Compromise (IoC)

curl http://localhost:3000/ioc?q=machine@domain.com

💻 Contribution

Contributions are welcome! Please feel free to submit pull requests.

📄 License

MIT License