Skip to main content
Glama
Sign In
Kaspersky OpenTIP MCP Server

Kaspersky OpenTIP MCP Server

Official
by KasperskyLab
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

Kaspersky OpenTIP Model Context Protocol Server

This server gives access to Kaspersky OpenTIP API to agentic applications that support Model Context Protocol (MCP), such as Claude or Cline.

Installation

First, install uv:

# windows
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

# linux
curl -LsSf https://astral.sh/uv/install.sh | sh

You can also install uv from Github.

Second, clone this repo.

Finally, configure your client. For Claude:

{
    "mcpServers": {
        "Kaspersky OpenTIP": {
            "command": "uv",
            "args": [
                "--directory",
                "C:/path/to/repo/opentip-mcp",
                "run",
                "opentip.py"
            ],
            "env": {
              "OPENTIP_API_KEY": "YOUR_API_KEY"
            }
        }
    }
}

For Cline (on Windows):

{
  "mcpServers": {
    "KasperskyOpenTIP": {
      "command": "cmd",
      "args": [
        "/c",
        "uv",
        "--directory",
        "C:/path/to/repo/opentip-mcp",
        "run",
        "opentip.py"
      ],
      "env": {
        "OPENTIP_API_KEY": "YOUR_API_KEY"
      }
    }
  }
}

Note the env key in the JSON above: you need to set the value to your actual OpenTIP API key. Alternatively, you can remove this section and set OPENTIP_API_KEY environment variable directly.

Related MCP server: OpsLevel MCP

License

Copyright © 2025 AO Kaspersky Lab

Licensed under the Apache 2.0 License. See the LICENSE.txt file for details.

Available Tools

6 tools
analyze_fileC

Submit a file for basic analysis using the OpenTIP API.

Inputs: filename (required), full_file_path (required). Returns: result

get_full_analysis_resultB
Read-only

Get full analysis results for a file that was submitted via the web portal.

Inputs: file_hash (required). Returns: result

search_domainB
Read-only

Get threat intelligence data about a web domain

Inputs: domain (required). Returns: result

search_hashA
Read-only

Get threat intelligence information about a file by hash (md5, sha1, sha256)

Inputs: file_hash (required). Returns: result

search_ipB
Read-only

Get threat intelligence data about an IP address

Inputs: ip (required). Returns: result

search_urlA
Read-only

Get threat intelligence data about a URL

Inputs: url (required). Returns: result

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.6/5.0

    Scored across 6 tools

    Disambiguation4/5

    Most tools have distinct purposes (analyze_file vs search_*), but get_full_analysis_result is ambiguous because it only retrieves results for web portal submissions, not for files submitted via analyze_file. This creates potential confusion about the analysis workflow.

    Naming Consistency5/5

    All tools follow a consistent verb_noun pattern in snake_case (e.g., analyze_file, search_domain). Even the longer get_full_analysis_result maintains the pattern.

    Tool Count5/5

    Six tools is well-scoped for a threat intelligence server, covering file analysis and searches for domains, hashes, IPs, and URLs. The count is neither too few nor too many.

    Completeness3/5

    The search tools cover key indicators, but the file analysis workflow is incomplete: no tool to retrieve results for files submitted via analyze_file, and no update or delete operations. This gap may cause agent failures when expecting a full analysis cycle.

    Maintenance

    ActivityInactive
    ResponsivenessLimited data

    Resources

    Related MCP Connectors

    Related MCP Servers