Provides tools to export threat intelligence Indicators of Compromise (IOCs) from a MISP instance in Snort format, facilitating integration with network intrusion detection and prevention systems.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@misp-mcpCheck if the domain malicious-site.com has any correlations or sightings"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
misp-mcp
An MCP (Model Context Protocol) server for MISP (Malware Information Sharing Platform & Threat Intelligence Sharing). Enables LLMs to perform IOC lookups, manage events, discover correlations, and export threat intelligence directly from your MISP instance.
Features
18 MCP Tools - Full MISP API coverage: events, attributes, correlations, tags, exports, sightings, warninglists
3 MCP Resources - Browse attribute types, instance statistics, and available taxonomies
3 MCP Prompts - Guided workflows for IOC investigation, incident event creation, and threat reporting
SSL Flexibility - Handles self-signed certificates common in MISP deployments
Export Formats - CSV, STIX, Suricata, Snort, text, RPZ, and hash lists
Bulk Operations - Add multiple IOCs to events in a single call
Correlation Engine - Discover cross-event relationships through shared indicators
Prerequisites
Node.js 20 or later
A running MISP instance with API access
MISP API key (generated from MISP UI: Administration > List Auth Keys)
Installation
Configuration
Set the following environment variables:
Variable | Required | Default | Description |
| Yes | - | MISP instance base URL |
| Yes | - | API authentication key |
| No |
| Set |
Usage
Claude Desktop
Add to your Claude Desktop MCP config (claude_desktop_config.json):
Standalone
Development
Tools Reference
Event Tools
Tool | Description |
| Search events by IOC value, type, tags, date range, organization |
| Get full event details including attributes, objects, galaxies, related events |
| Create a new event with threat level, distribution, and analysis status |
| Update event metadata (info, threat level, analysis, publish state) |
| Publish an event to trigger alerts to sharing partners |
| Add or remove tags (TLP, MITRE ATT&CK, custom) from an event |
Attribute Tools
Tool | Description |
| Search IOCs across all events with type, category, and correlation filters |
| Add a single IOC to an event |
| Add multiple IOCs to an event in one operation |
| Soft or hard delete an attribute |
Correlation & Intelligence Tools
Tool | Description |
| Find all events and attributes matching a value, with cross-event correlations |
| Discover events related through shared IOCs |
| Get all available attribute types and category mappings |
Tag & Taxonomy Tools
Tool | Description |
| List available tags with usage statistics |
| Find events or attributes by tag |
Export Tools
Tool | Description |
| Export IOCs in CSV, STIX, Suricata, Snort, text, or RPZ format |
| Export file hashes (MD5, SHA1, SHA256) for HIDS integration |
Sighting & Warninglist Tools
Tool | Description |
| Report a sighting, false positive, or expiration for an IOC |
| Check if a value appears on known benign/false positive lists |
Resources
Resource URI | Description |
| All supported attribute types, categories, and their mappings |
| MISP instance statistics |
| Available taxonomies (TLP, MITRE ATT&CK, etc.) |
Prompts
Prompt | Description |
| Deep IOC investigation: search, correlate, check warninglists, summarize threat context |
| Guided event creation from an incident description with IOC ingestion |
| Generate a threat intelligence report from MISP data |
Usage Examples
Search for an IOC
"Search MISP for the IP address 203.0.113.50"
Uses misp_search_events and misp_search_attributes to find all events and attributes referencing this IP.
Investigate a suspicious domain
"Investigate evil-domain.com in MISP"
Triggers the investigate-ioc prompt workflow: searches for the domain, checks correlations, queries warninglists, and provides a structured threat assessment.
Create an incident event
"Create a MISP event for a phishing campaign targeting our finance team. The phishing emails came from attacker@evil.com and linked to https://evil-login.com/harvest"
Uses misp_create_event followed by misp_add_attributes_bulk to create a fully populated event.
Export Suricata rules
"Export all IOCs from the last 7 days as Suricata rules"
Uses misp_export_iocs with format "suricata" and last "7d".
Check for false positives
"Is 8.8.8.8 on any MISP warninglists?"
Uses misp_check_warninglists to verify if the value is a known benign indicator.
Supported Attribute Types
Type | Category | Example |
| Network activity | Source IP address |
| Network activity | Destination IP address |
| Network activity | Domain name |
| Network activity | Hostname |
| Network activity | Full URL |
| Payload delivery | Sender email address |
| Payload delivery | MD5 file hash |
| Payload delivery | SHA1 file hash |
| Payload delivery | SHA256 file hash |
| Payload delivery | File name |
Use misp_describe_types for the complete list of supported types and categories.
Testing
Project Structure
License
MIT