Skip to main content
Glama
KasperskyLab

Kaspersky OpenTIP MCP Server

Official
by KasperskyLab
README.md
# Kaspersky OpenTIP Model Context Protocol Server

This server gives access to [Kaspersky OpenTIP API](https://opentip.kaspersky.com/Help/Doc_data/WorkingWithAPI.htm) to agentic applications that support [Model Context Protocol (MCP)](http://modelcontextprotocol.io/), such as Claude or Cline.

## Installation

First, install uv:

```
# windows
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

# linux
curl -LsSf https://astral.sh/uv/install.sh | sh
```

You can also install uv from [Github](https://github.com/astral-sh/uv/releases).

Second, clone this repo.

Finally, configure your client. For Claude:

```
{
    "mcpServers": {
        "Kaspersky OpenTIP": {
            "command": "uv",
            "args": [
                "--directory",
                "C:/path/to/repo/opentip-mcp",
                "run",
                "opentip.py"
            ],
            "env": {
              "OPENTIP_API_KEY": "YOUR_API_KEY"
            }
        }
    }
}
```

For Cline (on Windows):
```
{
  "mcpServers": {
    "KasperskyOpenTIP": {
      "command": "cmd",
      "args": [
        "/c",
        "uv",
        "--directory",
        "C:/path/to/repo/opentip-mcp",
        "run",
        "opentip.py"
      ],
      "env": {
        "OPENTIP_API_KEY": "YOUR_API_KEY"
      }
    }
  }
}
```

Note the env key in the JSON above: you need to set the value to your actual OpenTIP API key. Alternatively, you can remove this section and set `OPENTIP_API_KEY` environment variable directly.

## License

Copyright © 2025 AO Kaspersky Lab

Licensed under the Apache 2.0 License. See the LICENSE.txt file for details.

TDQS

A3.6/5.0

Scored across 6 tools

Disambiguation4/5

Most tools have distinct purposes (analyze_file vs search_*), but get_full_analysis_result is ambiguous because it only retrieves results for web portal submissions, not for files submitted via analyze_file. This creates potential confusion about the analysis workflow.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern in snake_case (e.g., analyze_file, search_domain). Even the longer get_full_analysis_result maintains the pattern.

Tool Count5/5

Six tools is well-scoped for a threat intelligence server, covering file analysis and searches for domains, hashes, IPs, and URLs. The count is neither too few nor too many.

Completeness3/5

The search tools cover key indicators, but the file analysis workflow is incomplete: no tool to retrieve results for files submitted via analyze_file, and no update or delete operations. This gap may cause agent failures when expecting a full analysis cycle.

Maintenance

ActivityInactive
ResponsivenessNo issues