The Mallory MCP Server provides AI assistants with access to a comprehensive cyber threat intelligence database, enabling real-time queries for vulnerabilities, threat actors, malware, exploits, and related security intelligence.
Core Capabilities:
Vulnerability Intelligence - Find specific CVEs with detailed information including CVSS scores, EPSS predictions, and CISA KEV status; search vulnerabilities with filtering by CVE, UUID, or keywords; retrieve detection signatures, exploitation records, and vulnerable configurations (CPE data) to identify affected products and versions.
Threat Actor Intelligence - Get detailed threat actor profiles by UUID or name, including TTPs, target sectors, and intelligence mentions; list and search threat actors with filtering and sorting; monitor recent threat actor mentions from intelligence sources to track emerging threats and active campaigns.
Exploitation Tracking - Get specific exploitation records by UUID with details on when/how vulnerabilities were exploited; list exploitation data with filtering to identify actively exploited vulnerabilities and detection methods.
Additional Capabilities - Access malware research, MITRE ATT&CK patterns, breach intelligence, organization security profiles, product security information, advisories, threat intelligence stories, mention monitoring across entities, and search across all entity types.
Key Use Cases - Risk assessment and vulnerability prioritization based on active exploitation; threat intelligence gathering for security briefings; building detection rules from published signatures; asset vulnerability mapping using CPE data; monitoring the threat landscape; incident response investigation and attribution.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Mallory MCP Serverget details on the latest critical vulnerability affecting Apache servers"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Mallory MCP Server
Mallory provides a robust source of cyber and threat intelligence. This MCP server exposes the Mallory API to AI agents via the malloryapi Python client, with tools for vulnerabilities, threat actors, malware, exploits, organizations, attack patterns, breaches, products, advisories, stories, mentions, search, and sources.
Once connected, your AI assistant (Cursor, Claude Desktop, or another MCP client) can look up CVEs, threat actors, malware, and more directly from Mallory — no copy-pasting from the dashboard.
Prerequisites
Python 3.11 or higher
A Mallory API key (mallory.ai)
Related MCP server: IR Toolshed MCP Server
Quick Start
1. Set your API key
Get an API key at mallory.ai and add it to your shell profile (~/.zshrc, ~/.bashrc, etc.):
Reload your shell (or run source ~/.zshrc) so the variable is available.
2. Add to your AI client
Add the server to your MCP client config. Pick one of the options below.
Cursor — add to ~/.cursor/mcp.json:
Claude Desktop — add to claude_desktop_config.json:
Claude Code — run this command:
This stores the config in ~/.claude.json (local scope, current project). To share it with your team, use project scope instead:
This writes to .mcp.json in the project root, which can be committed to git.
uvxdownloads and runs the package automatically — no install step needed. If you prefer to install it yourself, see Alternative: pip install below.
3. Restart your AI client and start using it
Ask your assistant to query Mallory:
"Look up CVE-2024-1234 and summarize the risk."
"List threat actors trending in the last 7 days."
"Find vulnerabilities that are known to be exploited."
"Search for intelligence on APT28."
"What malware is associated with technique T1566?"
The assistant calls the MCP tools automatically — you don't need to invoke tool names yourself.
Note:
mallorymcpis an MCP server that communicates via JSON-RPC over stdio. It's designed to be launched by your AI client, not run interactively from a terminal.
Alternative: pip install
If you prefer installing the package rather than using uvx:
Then reference the command directly in your config:
Configuration
Environment Variable | Required | Description | Default |
| Yes | Your Mallory API key | — |
| No | Override the API base URL |
|
Tools
The server exposes the following tools, backed by the Mallory API.
Vulnerabilities (7)
Tool | Description |
| Get a vulnerability by CVE ID or UUID |
| List/search vulnerabilities with filters and pagination |
| List vulnerabilities trending over 1d/7d/30d |
| List vulnerabilities known to be exploited in the wild |
| Detection signatures for a CVE |
| Exploitation records for a CVE |
| Affected configurations (CPE) for a CVE |
Threat Actors (5)
Tool | Description |
| Get a threat actor by UUID or name |
| List/search threat actors |
| List trending threat actors |
| Recent threat actor mentions from intel sources |
| MITRE ATT&CK patterns for an actor |
Malware (5)
Tool | Description |
| Get a malware entity by UUID or name |
| List/search malware |
| List trending malware |
| Vulnerabilities linked to a malware |
| MITRE ATT&CK patterns for a malware |
Exploits (2)
Tool | Description |
| Get an exploit by UUID or identifier |
| List/search exploits |
Organizations (4)
Tool | Description |
| Get an organization by UUID or name |
| List/search organizations |
| List trending organizations |
| Breaches associated with an organization |
Attack Patterns (4)
Tool | Description |
| Get an attack pattern (MITRE ATT&CK technique) by UUID or ID |
| List/search attack patterns |
| Threat actors associated with a technique |
| Malware associated with a technique |
Breaches (3)
Tool | Description |
| Get a breach by UUID or identifier |
| List breaches |
| Organizations associated with a breach |
Products (3)
Tool | Description |
| Get a technology product by UUID or name |
| List/search technology products |
| Security advisories for a product |
Advisories (3)
Tool | Description |
| Get a technology product advisory by UUID or identifier |
| List technology product advisories |
| Vulnerabilities associated with an advisory |
Stories (3)
Tool | Description |
| Get an intelligence story by UUID or identifier |
| List/search intelligence stories |
| List available story topics |
Mentions (3)
Tool | Description |
| List recent mentions across entity types |
| Recent threat actor mentions |
| Recent vulnerability mentions |
Search and Sources (2)
Tool | Description |
| Search across all entity types by query string |
| List intelligence sources in the platform |
Development
Install from source
Lint
Project Structure
Releasing
Tag a release:
git tag v0.4.0 && git push --tagsCreate a GitHub release from the tag
GitHub Actions builds and publishes to PyPI via trusted publisher
License
Apache 2.0.