Skip to main content
Glama
ChristianPresley

threatintel-mcp

by ChristianPresley
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Hybrid

Related Servers

Alternatives to threatintel-mcp

No user-submitted related servers found.

    Related Servers

    • urlscan-mcp

      blackhole8080-darkmatter
      A
      license
      A
      quality
      B
      maintenance
      MCP server for urlscan.io that scans URLs, searches historical scan data, and assesses indicators with compact, context-efficient summaries instead of raw API responses.
      14
      MIT

    • virustotal-mcp-server

      barvhaim
      F
      license
      A
      quality
      D
      maintenance
      MCP server for security analysis using VirusTotal API, enabling AI assistants to analyze URLs, files, IP addresses, and domains with automatic relationship fetching.
      8
      1
      -

    • urlscan-mcp

      Moussa93x
      A
      license
      A
      quality
      C
      maintenance
      MCP server that exposes urlscan.io as tools for security investigations, with compact results optimized for context windows. Enables pivoting on indicators, searching scans, retrieving screenshots, DOM, and scan results, and submitting URLs.
      6
      MIT

    • GTI MCP Server

      yayefa
      F
      license
      Not graded
      quality
      C
      maintenance
      A production-ready MCP server providing comprehensive integration with Google Threat Intelligence and VirusTotal API v3, enabling AI agents to access threat intelligence data including IoCs, malware analysis, and network telemetry.
      -

    • wrg-mcp-server

      WRG-11
      A
      license
      Not graded
      quality
      A
      maintenance
      An MCP server that exposes a 60+ tool security and threat-intel stack to AI agents, enabling secret scanning, Sigma rule generation, ransomware lookup, OSINT, and deep research.
      1
      MIT
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A4.3/5.0

    Scored across 6 tools

    Disambiguation5/5

    Each tool has a clearly distinct purpose: scan_url submits a new scan, get_url_result fetches a specific scan's findings, search_urlscan queries historical scans passively, and lookup_hash/lookup_domain/lookup_ip are separated cleanly by indicator type. The scan/fetch pairing is explicitly documented, so an agent can sequence them without confusion.

    Naming Consistency4/5

    All tools follow a verb_noun snake_case pattern (scan_url, get_url_result, search_urlscan, lookup_hash/domain/ip). Minor deviation: the urlscan.io tools encode the source in the noun (urlscan/url_result) while VirusTotal tools use generic verbs, and scan_url vs get_url_result are slightly asymmetric.

    Tool Count5/5

    Six tools is well-scoped for a threat-intel server, covering the two core workflows (urlscan.io scanning and VirusTotal lookups) without redundancy. Every tool earns its place with no filler.

    Completeness4/5

    The surface covers the main IOC pivots (URL submit/fetch, historical scan search, hash/domain/IP reputation), which is solid lifecycle coverage for investigation work. Minor gaps exist: no direct ASN/certificate/WHOIS tool, and no ability to submit samples to VirusTotal, but agents can work around these via the existing tools.

    Maintenance

    ActivityMaintained
    ResponsivenessNo issues

    Resources