Skip to main content
Glama
4R9UN

FastMCP ThreatIntel

by 4R9UN
OverviewSchemaRelated ServersScoreDiscussions
Python
Remote

🛡️ FastMCP ThreatIntel - AI-Powered Threat Intelligence

CI/CD Pipeline codecov PyPI version Python 3.10+ License: Apache-2.0 Docker Pulls

🚀 MCP AI Powered Threat Intelligence - Revolutionizing Cybersecurity Built by

A comprehensive Model Context Protocol (MCP) server that provides enterprise-grade threat intelligence capabilities through natural language AI prompts. Analyze IPs, domains, URLs, and file hashes across multiple threat intelligence platforms with advanced APT attribution and interactive reporting.

Demo

✨ Why FastMCP ThreatIntel?

🎯 Purpose-Built for Modern Security Teams

  • 🤖 AI-First Design: Natural language queries with intelligent IOC detection

  • 🔗 MCP Integration: Seamless integration with Claude Desktop, VSCode (Roo-Cline), and other AI assistants

  • ⚡ Lightning Fast: UV-powered development with optimized async processing

  • 🏢 Enterprise Ready: Production-grade Docker containers and Kubernetes support

🔍 Multi-Source Intelligence

  • VirusTotal: File and URL reputation analysis with 70+ antivirus engines

  • AlienVault OTX: Community-driven threat intelligence and IOC feeds

  • AbuseIPDB: IP reputation and geolocation with abuse confidence scoring

  • IPinfo: Enhanced geolocation, ASN, and infrastructure data

🤖 AI-Powered Analysis

  • Natural Language Interface: Query threats using plain English

  • Advanced APT Attribution: Confidence-scored attribution with MITRE ATT&CK mapping

  • Intelligent IOC Detection: Auto-detects IP addresses, domains, URLs, and file hashes

  • Context-Aware Reporting: Generates comprehensive threat intelligence reports

📊 Rich Reporting & Visualization

  • Interactive HTML Reports: Modern, responsive design with dark/light modes

  • D3.js Network Graphs: Visual IOC relationship mapping

  • Multiple Output Formats: Markdown, JSON, HTML, and STIX-compliant outputs

  • Export Capabilities: PDF, CSV, and JSON export for integration

🚀 Flexible Deployment Options

  • 🔌 MCP Server: Direct integration with AI assistants

  • 💻 Standalone CLI: Interactive and batch processing modes

  • 🐳 Docker Container: Production-ready containerization

  • 📦 Python Package: Embed in your applications and workflows

🏗️ Architecture

graph TB A[AI Assistant] --> B[MCP Protocol] C[CLI Interface] --> D[Core Engine] B --> D D --> E[IOC Processor] D --> F[Attribution Engine] D --> G[Report Generator] E --> H[VirusTotal API] E --> I[OTX API] E --> J[AbuseIPDB API] E --> K[IPinfo API] F --> L[APT Patterns] F --> M[MITRE ATT&CK] G --> N[HTML Reports] G --> O[JSON Export] G --> P[STIX Output]

🚀 Quick Start

Choose your preferred installation method and get started in minutes:

🐍 pip (Fastest)

# Install from PyPI pip install fastmcp-threatintel # Interactive setup wizard threatintel setup # Analyze your first IOC threatintel analyze 8.8.8.8 --output-format table --verbose

🐳 Docker (Production Ready)

# Pull and run with your API keys docker pull arjuntrivedi/fastmcp-threatintel:latest docker run -e VIRUSTOTAL_API_KEY=your_key \ -e OTX_API_KEY=your_key \ arjuntrivedi/fastmcp-threatintel:latest \ analyze 192.168.1.1

🔥 UV (Developer Recommended)

# Clone and install with UV git clone https://github.com/4R9UN/fastmcp-threatintel.git cd fastmcp-threatintel uv sync # Run interactive setup uv run threatintel setup # Start analyzing uv run threatintel interactive

📦 Poetry (Traditional)

# Clone and install with Poetry git clone https://github.com/4R9UN/fastmcp-threatintel.git cd fastmcp-threatintel poetry install # Activate and run poetry shell threatintel analyze example.com --output-format html --open-browser

⚙️ Configuration

🔑 API Keys Setup

Get your free API keys and unlock the full potential:

Service

Status

Free Tier Limit

Get Your Key

VirusTotal

Required

1,000 requests/day

Sign Up →

OTX

Required

Unlimited

Sign Up →

AbuseIPDB

Optional

1,000 requests/day

Sign Up →

IPinfo

Optional

50,000 requests/month

Sign Up →

🛠️ Environment Configuration

Create a .env file in your project directory:

# Required API Keys VIRUSTOTAL_API_KEY=your_virustotal_api_key OTX_API_KEY=your_alienvault_otx_api_key # Optional API Keys (for enhanced functionality) ABUSEIPDB_API_KEY=your_abuseipdb_api_key IPINFO_API_KEY=your_ipinfo_api_key # Performance Tuning CACHE_TTL=3600 # Cache duration (seconds) MAX_RETRIES=3 # API retry attempts REQUEST_TIMEOUT=30 # Request timeout (seconds)

💻 Usage Examples

CLI Analysis

# Quick single IOC analysis threatintel analyze 192.168.1.1 --verbose # Batch analysis from file threatintel batch iocs.txt --output-file report.html --output-format html # Interactive threat hunting session threatintel interactive # Start MCP server for AI integration threatintel server --host 0.0.0.0 --port 8000

🔌 MCP Integration

Integrate with AI assistants for natural language threat intelligence:

VSCode with Roo-Cline

{ "mcpServers": { "threatintel": { "command": "threatintel", "args": ["server", "--port", "8001"], "env": { "VIRUSTOTAL_API_KEY": "your_key", "OTX_API_KEY": "your_key" } } } }

Claude Desktop

{ "mcpServers": { "threatintel": { "command": "threatintel", "args": ["server"], "env": { "VIRUSTOTAL_API_KEY": "your_key", "OTX_API_KEY": "your_key" } } } }

🔗

🎯 AI Prompt Examples

"Analyze IP 8.8.8.8 for security threats and provide geolocation data" "Check if domain example.com has any malicious associations" "Perform comprehensive threat analysis on 185.220.101.1 with APT attribution" "Generate a security incident report for these IOCs: [list]"

📚 Documentation

📖 User Guides

🛠️ Developer Resources

🌟 What Makes It Special

**🔥 MCP Functionality **

  • MCP AI Powered: Cutting-edge threat intelligence automation

  • Revolutionizing Cybersecurity: Enterprise-grade AI-powered platform

  • Community-Focused: Open source with professional quality

🚀 Production-Ready Features

  • Multi-Architecture Docker: ARM64 and AMD64 support

  • Kubernetes Ready: Helm charts and deployment manifests

  • Comprehensive Testing: 80%+ code coverage with CI/CD pipeline

  • Security First: Secure by design with best practices

⚡ Performance Optimized

  • Async Everything: Non-blocking I/O for maximum throughput

  • Intelligent Caching: Redis-compatible caching layer

  • Rate Limiting: Built-in API rate limit management

  • Batch Processing: Efficient bulk IOC analysis

🤝 Contributing

We welcome contributions from the cybersecurity community!

Quick Start

# Fork and clone git clone https://github.com/YOUR_USERNAME/fastmcp-threatintel.git cd fastmcp-threatintel # Setup development environment uv sync --dev uv run pre-commit install # Make your changes and test uv run pytest uv run ruff format . && uv run ruff check . # Submit your PR git push origin feature/your-feature

📖 Complete Contributing Guide →

📜 License

This project is licensed under the Apache License 2.0 - see the LICENSE file for details.

🙏 Acknowledgments

Special thanks to the cybersecurity community and these amazing projects:

🔗 Links & Resources

🌟 Star this repo if you find it useful! 🌟

GitHub stars GitHub forks

📚

📦

Built with ❤️ by

This server cannot be installed

-
security - not tested
F
license - not found
-
quality - not tested

How are these scores calculated?

Resources

New MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/4R9UN/fastmcp-threatintel'

If you have feedback or need assistance with the MCP directory API, please join our Discord server