OpenCTI MCP Server
OpenCTI MCP 服务器
一个用于 OpenCTI 的 模型上下文协议 (MCP) 服务器——这是由 Filigran 开发的开放式网络威胁情报平台。
将您的 AI 助手连接到您的 OpenCTI 实例,通过自然对话进行威胁情报搜索、指标查询、报告分析和连接器监控。
工具
工具 | 描述 |
| 搜索任何 STIX 实体类型(报告、恶意软件、威胁行为者等) |
| 通过 STIX ID 获取完整报告详情 |
| 按值、模式类型或关键字搜索 IOC |
| 使用 STIX/YARA/Sigma 模式创建新指标 |
| 列出所有连接器的状态和队列深度 |
Related MCP server: Security Infrastructure MCP Server
快速入门
环境变量
变量 | 必需 | 默认值 | 描述 |
| 是 | — | 您的 OpenCTI 实例 URL |
| 是 | — | OpenCTI API 令牌 |
| 否 |
| 验证 SSL 证书 |
| 否 |
| 传输方式: |
| 否 |
| 绑定主机(http 模式) |
| 否 |
| 绑定端口(http 模式) |
Docker
git clone https://github.com/DarkAngel-agents/opencti-mcp.git
cd opencti-mcp
export OPENCTI_URL=https://your-opencti-instance.com
export OPENCTI_TOKEN=your-api-token
docker compose up -d本地运行
pip install -r requirements.txt
export OPENCTI_URL=https://your-opencti-instance.com
export OPENCTI_TOKEN=your-api-token
# stdio mode
python server.py
# http mode
MCP_TRANSPORT=http python server.pyClaude Desktop
{
"mcpServers": {
"opencti": {
"command": "python",
"args": ["/path/to/opencti-mcp/server.py"],
"env": {
"OPENCTI_URL": "https://your-opencti-instance.com",
"OPENCTI_TOKEN": "your-api-token"
}
}
}
}示例提示词
"在 OpenCTI 中搜索与 APT28 相关的威胁行为者"
"向我展示关于勒索软件的最新报告"
"查找匹配此 IP 的指标:192.168.1.100"
"为域名 evil.example.com 创建一个 STIX 指标"
"哪些连接器处于活动状态,它们的队列状态如何?"
相关项目
misp-mcp — 用于 MISP 的 MCP 服务器
nixos-anssi-bp028 — NixOS ANSSI 加固模块
许可证
MIT
This server cannot be installed
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Servers
- AlicenseAqualityCmaintenanceA Model Context Protocol server that facilitates integration with OpenCTI, allowing users to query and retrieve cyber threat intelligence data via a standardized interface.1640MIT
- AlicenseNot gradedqualityDmaintenanceA comprehensive implementation of Model Context Protocol servers enabling natural language interactions with security platforms including Splunk SIEM, CrowdStrike EDR, and Microsoft MISP for threat intelligence querying and analysis.4422MIT
- AlicenseNot gradedqualityDmaintenanceA Model Context Protocol server that integrates TAK Server with AI systems, providing geospatial-aware tools for querying, analyzing, and interacting with tactical data.10MIT
- FlicenseNot gradedqualityDmaintenanceA Model Context Protocol server that connects AI assistants to MISP threat intelligence platforms. It enables threat intelligence search, IOC lookup, and event analysis through natural conversation.
Related MCP Connectors
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
A Model Context Protocol server for Wix AI tools
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/DarkAngel-agents/opencti-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server