# OpenCTI MCP Server

A [Model Context Protocol](https://modelcontextprotocol.io/) (MCP) server for [OpenCTI](https://www.opencti.io/) — the Open Cyber Threat Intelligence Platform developed by [Filigran](https://www.filigran.io/).

Connect your AI assistant to your OpenCTI instance for threat intelligence search, indicator lookup, report analysis, and connector monitoring through natural conversation.

## Tools

| Tool | Description |
|------|-------------|
| `search_entities` | Search any STIX entity type (reports, malware, threat actors, etc) |
| `get_report` | Get full report details by STIX ID |
| `search_indicators` | Search IOCs by value, pattern type, or keyword |
| `create_indicator` | Create new indicator with STIX/YARA/Sigma pattern |
| `list_connectors` | List all connectors with status and queue depth |

## Quick Start

### Environment Variables

| Variable | Required | Default | Description |
|----------|----------|---------|-------------|
| `OPENCTI_URL` | Yes | — | URL of your OpenCTI instance |
| `OPENCTI_TOKEN` | Yes | — | OpenCTI API token |
| `OPENCTI_SSL_VERIFY` | No | `false` | Verify SSL certificates |
| `MCP_TRANSPORT` | No | `stdio` | Transport: `stdio` or `http` |
| `MCP_HOST` | No | `0.0.0.0` | Host to bind (http mode) |
| `MCP_PORT` | No | `8000` | Port to bind (http mode) |

### Docker

```bash
git clone https://github.com/DarkAngel-agents/opencti-mcp.git
cd opencti-mcp

export OPENCTI_URL=https://your-opencti-instance.com
export OPENCTI_TOKEN=your-api-token

docker compose up -d
```

### Local

```bash
pip install -r requirements.txt

export OPENCTI_URL=https://your-opencti-instance.com
export OPENCTI_TOKEN=your-api-token

# stdio mode
python server.py

# http mode
MCP_TRANSPORT=http python server.py
```

### Claude Desktop

```json
{
  "mcpServers": {
    "opencti": {
      "command": "python",
      "args": ["/path/to/opencti-mcp/server.py"],
      "env": {
        "OPENCTI_URL": "https://your-opencti-instance.com",
        "OPENCTI_TOKEN": "your-api-token"
      }
    }
  }
}
```

## Example Prompts

- "Search OpenCTI for threat actors related to APT28"
- "Show me the latest reports about ransomware"
- "Look up indicators matching this IP: 192.168.1.100"
- "Create a STIX indicator for domain evil.example.com"
- "What connectors are active and what's their queue status?"

## Related Projects

- [misp-mcp](https://github.com/DarkAngel-agents/misp-mcp) — MCP server for MISP
- [nixos-anssi-bp028](https://github.com/DarkAngel-agents/nixos-anssi-bp028) — NixOS ANSSI hardening module

## License

MIT