Kaspersky OpenTIP MCP Server
Official# Kaspersky OpenTIP Model Context Protocol Server
This server gives access to [Kaspersky OpenTIP API](https://opentip.kaspersky.com/Help/Doc_data/WorkingWithAPI.htm) to agentic applications that support [Model Context Protocol (MCP)](http://modelcontextprotocol.io/), such as Claude or Cline.
## Installation
First, install uv:
```
# windows
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
# linux
curl -LsSf https://astral.sh/uv/install.sh | sh
```
You can also install uv from [Github](https://github.com/astral-sh/uv/releases).
Second, clone this repo.
Finally, configure your client. For Claude:
```
{
"mcpServers": {
"Kaspersky OpenTIP": {
"command": "uv",
"args": [
"--directory",
"C:/path/to/repo/opentip-mcp",
"run",
"opentip.py"
],
"env": {
"OPENTIP_API_KEY": "YOUR_API_KEY"
}
}
}
}
```
For Cline (on Windows):
```
{
"mcpServers": {
"KasperskyOpenTIP": {
"command": "cmd",
"args": [
"/c",
"uv",
"--directory",
"C:/path/to/repo/opentip-mcp",
"run",
"opentip.py"
],
"env": {
"OPENTIP_API_KEY": "YOUR_API_KEY"
}
}
}
}
```
Note the env key in the JSON above: you need to set the value to your actual OpenTIP API key. Alternatively, you can remove this section and set `OPENTIP_API_KEY` environment variable directly.
## License
Copyright © 2025 AO Kaspersky Lab
Licensed under the Apache 2.0 License. See the LICENSE.txt file for details.
TDQS
Scored across 6 tools
Most tools have distinct purposes (analyze_file vs search_*), but get_full_analysis_result is ambiguous because it only retrieves results for web portal submissions, not for files submitted via analyze_file. This creates potential confusion about the analysis workflow.
All tools follow a consistent verb_noun pattern in snake_case (e.g., analyze_file, search_domain). Even the longer get_full_analysis_result maintains the pattern.
Six tools is well-scoped for a threat intelligence server, covering file analysis and searches for domains, hashes, IPs, and URLs. The count is neither too few nor too many.
The search tools cover key indicators, but the file analysis workflow is incomplete: no tool to retrieve results for files submitted via analyze_file, and no update or delete operations. This gap may cause agent failures when expecting a full analysis cycle.