This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
An MCP server that provides read-only access to MISP threat intelligence data.
Event search - Find threat intelligence events by IOC values, tags, dates, organisations
Attribute search - Search individual indicators of compromise across all events
Object search - Find grouped attributes (file objects, network connections, etc.)
Event index - Lightweight event metadata browsing
Tags & Taxonomies - Search tags and browse taxonomy vocabularies (TLP, kill chain, etc.)
Galaxies - Search threat actors, malware, ATT&CK techniques, and other knowledge bases
Feeds - Browse configured threat intelligence feeds
All access is read-only - no data modification is possible through this server.
Related MCP server: MISP-mcp
pip install misp-mcpOr install from source:
cd misp-mcp
pip install -e .Set the following environment variables:
Variable | Required | Description |
| Yes | URL of your MISP instance (e.g. |
| Yes | Your MISP API authentication key |
| No | Verify TLS certificates (default: |
Add to your MCP configuration:
{
"mcpServers": {
"misp": {
"command": "misp-mcp",
"env": {
"MISP_URL": "https://misp.example.com",
"MISP_API_KEY": "your-api-key-here"
}
}
}
}export MISP_URL="https://misp.example.com"
export MISP_API_KEY="your-api-key"
misp-mcpsearch_events - Search events by IOC values, tags, dates, organisations
search_attributes - Search individual attributes/indicators
search_objects - Search MISP objects
search_event_index - Lightweight event metadata search
get_event - Get full event by ID
get_attribute - Get attribute by ID
get_object - Get object by ID
search_tags - Search tags by name
list_taxonomies - List all taxonomy vocabularies
get_taxonomy - Get taxonomy details and entries
search_galaxies - Search galaxies (threat actors, malware, ATT&CK, etc.)
get_galaxy - Get galaxy with clusters
search_galaxy_clusters - Search within a specific galaxy
search_feeds - Search/list configured threat intelligence feeds
AGPL-3.0-or-later - same as MISP.
Copyright (C) 2026 Andras Iklody
This server cannot be deployed
Query your org's data in natural language — read-only MCP access to SQL, NoSQL, files & warehouses.
Free, read-only public-source threat intel over MCP. No account or API key.
Search and read Cyber Library, a free structured cybersecurity knowledge base. Read-only, no auth.
Query and retrieve information about various adversarial tactics and techniques used in cyber atta…
