Orkl MCP Server

🚀 ORKL Model Control Protocol (MCP) Server

A Model Control Protocol (MCP) server for accessing the ORKL Threat Intelligence Library.

📑 Table of Contents

• ✨ Features
• 🚀 Quick Start
  • 📋 Prerequisites
  • 📦 Installation
  • ⚙️ Configuration
• 🛠️ MCP Tools
• 📚 MCP Resources
• 💡 Example Prompts
• 📄 License

✨ Features

• Access data from the ORKL Threat Intelligence Library via the ORKL API.
• Efficient caching to minimize API calls.
• Rate limiting to comply with the ORKL API usage limits.
• Standardized MCP tools and resources for interacting with Large Language Models (LLMs).
• Built - in support for Claude Desktop integration.

Screenshot

🚀 Quick Start

📋 Prerequisites

• Python 3.10 or higher.
• uv package manager (recommended).

📦 Installation

1. Clone the repository:

   git clone https://github.com/heiths/orkl_mcp_server.git
   cd orkl_mcp_server
   

2. Install dependencies using uv (recommended):

   uv venv
   uv pip install -r requirements.txt
   

3. Configure the server (see the ⚙️ Configuration section below).

📝 Register to Claude Desktop

Add the following configuration to your claude_desktop_config.json file:

{
  "ORKL Threat Intelligence": {
    "command": "uv",
    "args": [
      "--directory",
      "/path/to/orkl_mcp_server",  <-- Replace with the actual path where you cloned the repository
      "run",
      "python",
      "run_server.py"
    ],
    "env": {
      "ORKL_API_BASE_URL": "https://orkl.eu/api/v1",
      "ORKL_REQUEST_TIMEOUT": "30",
      "ORKL_CACHE_TTL": "300",
      "ORKL_USE_CACHE": "1",
      "ORKL_RATE_LIMIT_REQUESTS": "90",
      "ORKL_RATE_LIMIT_PERIOD": "30"
    }
  }
}

🛠️ MCP Tools

The server provides the following MCP tools:

• fetch_latest_threat_reports: Fetch the latest threat intelligence reports.
• fetch_threat_report: Fetch a specific threat intelligence report.
• search_threat_intel: Search for threat intelligence information.
• get_indicator_details: Get indicator details.
• retrieve_raw_data: Retrieve raw data.
• lookup_domain: Look up a domain name.
• check_ip: Check an IP address.
• analyze_behavior: Analyze behavior.
• generate_report: Generate a report.

📚 MCP Resources

The server provides the following MCP resources:

• /api/v1/reports: An endpoint for getting and managing threat intelligence reports.
• /api/v1/search: An endpoint for searching threat intelligence data.
• /api/v1/indicators: An endpoint for getting and managing indicator information.

💡 Example Prompts

📌 Example 1: Get the latest threat intelligence reports

curl -X GET http://localhost:8000/api/v1/reports/latest

📌 Example 2: Search for specific threat intelligence

curl -X POST http://localhost:8000/api/v1/search \
     -H "Content-Type: application/json" \
     -d '{"query": "Malware"}'

⚙️ Configuration

All configurations can be specified in the following ways:

1. Environment variables.
2. Configuration file (config.json).
3. Command - line arguments.

🌐 Environment Variables

📄 Command - line Arguments

python run_server.py --help

📄 License

This project is licensed under the MIT License. See the LICENSE file for details.