Skip to main content
Glama
DarkAngel-agents

OpenCTI MCP Server

OpenCTI MCP 服务器

一个用于 OpenCTI模型上下文协议 (MCP) 服务器——这是由 Filigran 开发的开放式网络威胁情报平台。

将您的 AI 助手连接到您的 OpenCTI 实例,通过自然对话进行威胁情报搜索、指标查询、报告分析和连接器监控。

工具

工具

描述

search_entities

搜索任何 STIX 实体类型(报告、恶意软件、威胁行为者等)

get_report

通过 STIX ID 获取完整报告详情

search_indicators

按值、模式类型或关键字搜索 IOC

create_indicator

使用 STIX/YARA/Sigma 模式创建新指标

list_connectors

列出所有连接器的状态和队列深度

Related MCP server: Security Infrastructure MCP Server

快速入门

环境变量

变量

必需

默认值

描述

OPENCTI_URL

您的 OpenCTI 实例 URL

OPENCTI_TOKEN

OpenCTI API 令牌

OPENCTI_SSL_VERIFY

false

验证 SSL 证书

MCP_TRANSPORT

stdio

传输方式:stdiohttp

MCP_HOST

0.0.0.0

绑定主机(http 模式)

MCP_PORT

8000

绑定端口(http 模式)

Docker

git clone https://github.com/DarkAngel-agents/opencti-mcp.git
cd opencti-mcp

export OPENCTI_URL=https://your-opencti-instance.com
export OPENCTI_TOKEN=your-api-token

docker compose up -d

本地运行

pip install -r requirements.txt

export OPENCTI_URL=https://your-opencti-instance.com
export OPENCTI_TOKEN=your-api-token

# stdio mode
python server.py

# http mode
MCP_TRANSPORT=http python server.py

Claude Desktop

{
  "mcpServers": {
    "opencti": {
      "command": "python",
      "args": ["/path/to/opencti-mcp/server.py"],
      "env": {
        "OPENCTI_URL": "https://your-opencti-instance.com",
        "OPENCTI_TOKEN": "your-api-token"
      }
    }
  }
}

示例提示词

  • "在 OpenCTI 中搜索与 APT28 相关的威胁行为者"

  • "向我展示关于勒索软件的最新报告"

  • "查找匹配此 IP 的指标:192.168.1.100"

  • "为域名 evil.example.com 创建一个 STIX 指标"

  • "哪些连接器处于活动状态,它们的队列状态如何?"

相关项目

许可证

MIT

F
license - not found
Not graded
quality - not tested
D
maintenance

Maintenance

Maintainers
Response time
Release cycle
Releases (12mo)
Commit activity

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    A Model Context Protocol server that facilitates integration with OpenCTI, allowing users to query and retrieve cyber threat intelligence data via a standardized interface.
    16
    40
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    A comprehensive implementation of Model Context Protocol servers enabling natural language interactions with security platforms including Splunk SIEM, CrowdStrike EDR, and Microsoft MISP for threat intelligence querying and analysis.
    44
    22
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    A Model Context Protocol server that connects AI assistants to MISP threat intelligence platforms. It enables threat intelligence search, IOC lookup, and event analysis through natural conversation.

View all related MCP servers

Related MCP Connectors

  • A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…

  • MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.

  • A Model Context Protocol server for Wix AI tools

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/DarkAngel-agents/opencti-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server