Provides unified access to abuse.ch projects including URLhaus for malware distribution URLs, MalwareBazaar for sample lookups by hash, ThreatFox for IOC sharing, and Feodo Tracker for identifying active botnet C2 infrastructure.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@MCP Threat Intel ServerCheck if the IP 185.220.101.1 is flagged in any threat intel databases"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP Threat Intel Server
MCP server providing unified access to multiple threat intelligence sources for security research and analysis.
Why Use This?
If you're doing security research, incident response, or threat analysis, this MCP server lets you:
Unified lookups - Query IPs, domains, hashes, and URLs across multiple sources simultaneously
Reduce context switching - No need to open multiple browser tabs for different intel sources
Correlate intelligence - See results from all configured sources in one response
Free tier friendly - Works with free API tiers, gracefully degrades when sources unavailable
Works without keys - Feodo Tracker (botnet C2s) works without any API keys
Features
Category | Capabilities |
Unified Lookups | Query IPs, domains, file hashes, URLs across all sources |
AlienVault OTX | Threat pulses, indicators of compromise, community intelligence |
AbuseIPDB | IP reputation, abuse reports, confidence scores |
GreyNoise | Internet noise vs targeted attacks, scanner identification |
abuse.ch | URLhaus, MalwareBazaar, ThreatFox, Feodo Tracker |
Prerequisites
Node.js 18+
API keys for your preferred threat intelligence sources (see below)
Installation
Using npm (Recommended)
Or install globally:
From Source
Configuration
For Claude Desktop
Add to your Claude Desktop config file:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
For Claude Code
Add to ~/.claude.json:
API Keys
Service | Required | Free Tier | Get Key |
AlienVault OTX | Optional | Yes (unlimited) | |
AbuseIPDB | Optional | Yes (1,000/day) | |
GreyNoise | Optional | Yes (limited) | |
abuse.ch | Optional | Yes | |
Feodo Tracker | No | Yes | Public JSON feeds |
Note: Tools are dynamically enabled based on which API keys you provide. Feodo Tracker works without authentication (public JSON feeds).
Usage Examples
Check Available Sources
"What threat intel sources are configured?"
"Show me threatintel status"
IP Investigation
"Check if 185.220.101.1 is malicious"
"Look up this IP across all threat intel sources"
Domain Analysis
"Is evil-domain.com known to be malicious?"
"Check domain reputation"
Malware Hash Lookup
"Look up this SHA256 hash in threat intel"
"Is this file hash known malware?"
URL Analysis
"Check if this URL is in any blocklists"
Botnet Tracking (No API Key Required)
"Show me active botnet C2 servers"
"Get Feodo tracker data for Emotet"
Threat Pulses
"Search OTX for recent ransomware pulses"
"Get latest threat intelligence pulses"
Available Tools
Status
Tool | Description |
| Check which threat intelligence sources are configured |
Unified Lookups
Tool | Description |
| Look up IP across all configured sources |
| Look up domain across all configured sources |
| Look up file hash (MD5/SHA1/SHA256) across sources |
| Look up URL across sources |
AbuseIPDB (requires API key)
Tool | Description |
| Check IP reputation and abuse history |
AlienVault OTX (requires API key)
Tool | Description |
| Get recent threat intelligence pulses |
| Search pulses by keyword |
GreyNoise (requires API key)
Tool | Description |
| Check if IP is internet noise or targeted threat |
URLhaus (requires abuse.ch auth key)
Tool | Description |
| Look up URL, domain, or IP in URLhaus |
| Get recent malware URLs |
MalwareBazaar (requires abuse.ch auth key)
Tool | Description |
| Look up malware sample by hash |
| Get recent malware samples |
| Search samples by tag |
ThreatFox (requires abuse.ch auth key)
Tool | Description |
| Get recent IOCs from ThreatFox |
| Search ThreatFox IOCs |
Feodo Tracker (no key required)
Tool | Description |
| Get active botnet C2 servers (QakBot, Emotet, Dridex, etc.) |
Development
Troubleshooting
"No threat intel sources configured"
You can use the server without any API keys - Feodo Tracker will still work. For other sources, add the appropriate API keys to your configuration.
"API error: 401 Unauthorized"
Your API key is invalid or expired. Generate a new one from the respective service.
"API error: 429 Too Many Requests"
You've exceeded the rate limit for a service. Wait a while or upgrade your API tier.
Partial results
If some sources return errors, the unified lookup tools will still return results from working sources. Check threatintel_status to see which sources are configured correctly.
Data Sources
AlienVault OTX
Open Threat Exchange - community-driven threat intelligence platform with pulses containing indicators of compromise.
AbuseIPDB
Crowdsourced IP reputation database with abuse reports from network administrators worldwide.
GreyNoise
Identifies IPs scanning the internet vs targeted attacks. Helps reduce false positives in threat detection.
abuse.ch Projects
URLhaus - Malware distribution URLs
MalwareBazaar - Malware sample repository
ThreatFox - IOC sharing platform
Feodo Tracker - Botnet C2 infrastructure tracking
Contributing
Contributions are welcome! Please see CONTRIBUTING.md for guidelines.
License
MIT - see LICENSE for details.
Links
Related Projects
For additional threat intelligence capabilities, consider:
@burtthecoder/mcp-shodan - Shodan internet scanning
@burtthecoder/mcp-virustotal - VirusTotal malware analysis