# Threat Intelligence

A collection of MCP server implementations focused on security, providing enterprise-level security hardening, supporting integration with multiple security platforms including Splunk, CrowdStrike, and MISP, and equipped with comprehensive security protection measures.

The MCP Threat Intelligence Server provides the ability to access multiple threat intelligence sources in a unified manner, supports queries for IPs, domain names, hashes, and URLs, integrates platforms such as AlienVault OTX, AbuseIPDB, GreyNoise, and abuse.ch, and allows botnet tracking using Feodo Tracker without an API key.

Cyber Sentinel is a threat intelligence aggregation MCP server that provides a unified multi-source threat intelligence access interface, supporting security indicator analysis, code security detection, dependency scanning, and infrastructure security assessment.

abusech-mcp is an MCP server that retrieves threat intelligence data about malware, URLs, IPs, and domains from multiple abuse.ch platforms through a unified API.

The ExploitDB MCP server is a model context protocol service that provides vulnerability database query functions. It is developed by Cyreslab.ai to enhance the capabilities of AI assistants in network security research.

The VirusTotal MCP Server is a tool that provides VirusTotal API query services for MCP - compatible applications such as Claude Desktop, supporting comprehensive security analysis of URLs, files, IPs, and domains.

An AI-driven MCP server that automatically connects to the Malware Bazaar platform, providing real-time threat intelligence and malware sample metadata for authorized network security research.

An MCP server project for threat information collection, supporting the collection of threat intelligence within a specified time range through command - line tools and integration with the Neo4j knowledge graph.

The MITRE ATT&CK MCP Server is an AI - native threat intelligence tool that provides comprehensive access to the MITRE ATT&CK framework through the Model Context Protocol. It has the ability to query over 200 techniques, over 140 threat groups, and over 700 software entries, supports the generation of ATT&CK Navigator visualization layers, and is designed for security teams and AI agents.

The ORKL MCP Server is a Model Control Protocol server for accessing the ORKL Threat Intelligence Library. It provides standardized MCP tools and resources, supports efficient caching and rate limiting, and has built-in integration with Claude Desktop.

An MCP server integrated with the MISP platform, providing threat intelligence capabilities for large language models, including malware detection, threat intelligence search, IoC submission, and report generation.

The ADEO CTI MCP Server is a security analysis platform that integrates the APIs of Shodan and VirusTotal, providing comprehensive network security services such as network intelligence, vulnerability assessment, and threat detection.