Skip to main content
Glama
deenesjakoruzh
DarkAngel-agents

OpenCTI MCP Server

by DarkAngel-agents
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

OpenCTI MCP 服务器

一个用于 OpenCTI 的 模型上下文协议 (MCP) 服务器——这是由 Filigran 开发的开放式网络威胁情报平台。

将您的 AI 助手连接到您的 OpenCTI 实例，通过自然对话进行威胁情报搜索、指标查询、报告分析和连接器监控。

工具

工具

描述

search_entities

搜索任何 STIX 实体类型（报告、恶意软件、威胁行为者等）

get_report

通过 STIX ID 获取完整报告详情

search_indicators

按值、模式类型或关键字搜索 IOC

create_indicator

使用 STIX/YARA/Sigma 模式创建新指标

list_connectors

列出所有连接器的状态和队列深度

Related MCP server: MISP-MCP-SERVER

快速入门

环境变量

变量

必需

默认值

描述

OPENCTI_URL

是

—

您的 OpenCTI 实例 URL

OPENCTI_TOKEN

是

—

OpenCTI API 令牌

OPENCTI_SSL_VERIFY

否

false

验证 SSL 证书

MCP_TRANSPORT

否

stdio

传输方式：stdio 或 http

MCP_HOST

否

0.0.0.0

绑定主机（http 模式）

MCP_PORT

否

8000

绑定端口（http 模式）

Docker

git clone https://github.com/DarkAngel-agents/opencti-mcp.git
cd opencti-mcp

export OPENCTI_URL=https://your-opencti-instance.com
export OPENCTI_TOKEN=your-api-token

docker compose up -d

本地运行

pip install -r requirements.txt

export OPENCTI_URL=https://your-opencti-instance.com
export OPENCTI_TOKEN=your-api-token

# stdio mode
python server.py

# http mode
MCP_TRANSPORT=http python server.py

Claude Desktop

{
  "mcpServers": {
    "opencti": {
      "command": "python",
      "args": ["/path/to/opencti-mcp/server.py"],
      "env": {
        "OPENCTI_URL": "https://your-opencti-instance.com",
        "OPENCTI_TOKEN": "your-api-token"
      }
    }
  }
}

示例提示词

  • "在 OpenCTI 中搜索与 APT28 相关的威胁行为者"

  • "向我展示关于勒索软件的最新报告"

  • "查找匹配此 IP 的指标：192.168.1.100"

  • "为域名 evil.example.com 创建一个 STIX 指标"

  • "哪些连接器处于活动状态，它们的队列状态如何？"

相关项目

许可证

MIT

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • OpenCTI MCP Server

    zxzinn
    A
    license
    A
    quality
    C
    maintenance
    A Model Context Protocol server that facilitates integration with OpenCTI, allowing users to query and retrieve cyber threat intelligence data via a standardized interface.
    16
    40
    MIT

  • MISP-MCP-SERVER

    bornpresident
    F
    license
    Not graded
    quality
    D
    maintenance
    A Model Context Protocol (MCP) server that integrates with the MISP (Malware Information Sharing Platform) to provide threat intelligence capabilities to Large Language Models.
    12
    -

  • MISP MCP Server

    DarkAngel-agents
    F
    license
    Not graded
    quality
    D
    maintenance
    A Model Context Protocol server that connects AI assistants to MISP threat intelligence platforms. It enables threat intelligence search, IOC lookup, and event analysis through natural conversation.
    -