Skip to main content
Glama
enesjakozh
MSAdministrator

Enrichment MCP Server

by MSAdministrator
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

丰富 MCP 服务器

该项目是一个模型上下文协议 (MCP) 服务器，用于根据提供的可观察对象执行丰富功能。配置的服务与提供的可观察对象的组合将决定调用哪些丰富服务。

该工具提供了一个简单的 MCP 服务器实现，使用常见服务（例如 VirusTotal、Hybrid Analysis 等）执行第三方丰富功能，利用security-cli python 包执行丰富功能/与不同的服务通信。

MCP 服务器

enrichment-mcp MCP 服务器的此实现公开了以下工具。

  • lookup-observable - 一个通用端点，用于检查给定的可观察对象并将其路由到正确的工具。

Related MCP server: ADEO CTI MCP Server

支持的服务

目前支持以下服务和可观察类型：

如果您有任何建议或认为应该实施其他服务，请创建问题或拉取请求！

姓名

需要 API 密钥

支持IP

支持域名

支持 URL

支持电子邮件

VirusTotal

是的

是的

是的

是的

不

混合分析

是的

是的

是的

是的

不

AlienVault

是的

是的

是的

是的

不

初段

是的

是的

是的

是的

不

Urlscan.io

是的

是的

是的

是的

不

滥用IPDB

是的

是的

不

不

不

已获得

是的

不

不

不

是的

要求

此 MCP 服务使用security-cli和自定义config.yaml.example文件来确定哪些第三方丰富服务支持可观察查找。

在本地 Mac/系统上运行此程序的最简单方法是：

uv run --env-file .env server.py

这要求您使用提供的模板.env.example并创建一个包含您的机密的新.env文件。

注意：有关配置不同服务的信息，请参阅security-cli的文档。默认值足以满足大多数用例。

环境变量

注意：强烈建议在实现此服务时将机密设置为环境变量。别再存储机密了，傻瓜。

为了让security-cli包能够发现这些变量，它们必须采用特定的格式。以下是当前支持的变量列表：

  • 丰富_MCP_VIRUSTOTAL_KEY

  • 富集_MCP_杂交分析_密钥

  • 丰富_MCP_ALIENVAULT_KEY

  • ENRICHMENT_MCP_SHODAN_KEY

  • 丰富_MCP_URLSCAN_KEY

  • ENRICHMENT_MCP_ABUSEIPDB_KEY

  • 富集_MCP_HIBP_KEY

丰富配置

每个增强服务都在securiy-cli配置文件中定义。此外，我还列出了可以执行的不同类型的增强操作。这意味着，在当前实现中，我们只有一个名为enrich的操作类型，但未来可以将其扩展到scans或queries等操作。

在这些高级操作下方，我们列出了可观察对象的类型，后面跟着支持该类型的服务列表。当前支持的可观察对象类型包括：

  • ipaddress - ipv4 地址

  • 域 - 域或 netloc

  • url - 带有架构等的完全限定 URL。

  • 电子邮件 - 标准电子邮件地址

我们也支持这些类型，但目前尚未实现：

  • md5 - 文件 MD5 哈希值

  • sha1 - 文件 SHA1 哈希

  • sha256 - 文件 SHA256 哈希

每个服务必须有一个name和一个template 。 apikey字段可以提供，但我们建议使用环境变量。

提示模板

每个服务和可观察对象类型都可以拥有自己的响应模板。这些模板位于security-cli templates目录中，所有模板都应位于此处。

每个定义的服务都有一个使用 jinja2 模板的提示模板。您可以根据需要修改这些模板，但文件名的格式必须保持不变。

这些文件具有以下文件名模式。

{service.name}.{enrichment.type}.jinja2

确保响应对象在模板本身中具有正确的字段，否则您将收到错误。

下面是提示Enrich this IP 91.195.240.94的示例输出，其中混杂了一些错误：

{
    "virustotal": "error occurred looking up ip 91.195.240.94 in virustotal",
    "alienvault": "Service: alienvault\nIPAddress: \nReputation Score: 0\nTotal Votes: ",
    "shodan": "Service: shodan\nIPAddress: 91.195.240.94\nLast Analysis Results: 2025-04-25T21:02:52.644602\n\nTags\n\n\nAdditional information includes:\n\n* Latitude: 48.13743\n* Longitude: 11.57549\n* ASN: AS47846\n* Domains: ["servervps.net"]",
    "hybridanalysis": "error occurred looking up ip 91.195.240.94 in hybridanalysis",
    "urlscan": "Service: urlscan\nResult: https://urlscan.io/api/v1/result/01966efe-c8fa-74a4-bfc0-1ed479838e85/\n\nStats\n\n* uniqIPs - 6\n\n* uniqCountries - 2\n\n* dataLength - 432561\n\n* encodedDataLength - 218606\n\n* requests - 14\n\n\nPage\n* country - DE\n* server - Parking/1.0\n* ip - 91.195.240.94\n* mimeType - text/html\n* title - wearab.org\xa0-\xa0Informationen zum Thema wearab.\n* url - https://login.wearab.org/\n* tlsValidDays - 364\n* tlsAgeDays - 0\n* tlsValidFrom - 2025-04-25T00:00:00.000Z\n* domain - login.wearab.org\n* apexDomain - wearab.org\n* asnname - SEDO-AS SEDO GmbH, DE\n* asn - AS47846\n* tlsIssuer - Encryption Everywhere DV TLS CA - G2\n* status - 200\n",
    "abuseipdb": "Service: abuseripdb\nIPAddress: 91.195.240.94\nLast Analysis Result: 2025-03-30T14:04:45+00:00\nScore: 7\nUsage: Data Center/Web Hosting/Transit\nIs Tor: False\nIs Whitelisted: False\nISP: Sedo Domain Parking"
}

MCP 服务器使用情况

要使用预建服务器，请参阅此处的说明： https://modelcontextprotocol.io/quickstart/user

  • 下载 Claude 桌面版

  • 安装 uv

curl -LsSf https://astral.sh/uv/install.sh | sh

  • 下载此 repo 并添加到 Claude 桌面配置

    • Claude 桌面版 > 设置 > 开发者 > 编辑配置

您可以复制提供的.desktop_config.example.json文件

如果您想自己创建，这些是 Claude Desktop 的路径。

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

在任何文本编辑器中打开配置文件。将文件内容替换为以下内容：

{
	"mcpServers": {
		"enrichment-mcp": {
			"command": "/ABSOLUTE/PATH/TO/PARENT/FOLDER/uv",
			"args": [
				"--directory",
				"/ABSOLUTE/PATH/TO/CLONED/REPOSITORY/enrichment-mcp",
				"run",
				"server.py"
			]
		}
    }
}

  1. 重新启动 Claude 桌面版

您现在应该在聊天栏中看到两个图标，一个锤子图标（显示可用的工具）和一个连接图标（显示定义的提示和所需的输入）。

贡献

欢迎贡献代码！欢迎随时提交 Pull Request。

Available Tools

1 tool
lookup-observableD

A generic tool which takes any observable and passes it the correct tool.

ParametersJSON Schema
NameRequiredDescriptionDefault
valueYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

D1.6/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It fails to describe any traits—such as whether it's read-only, destructive, requires authentication, or has rate limits—and does not explain what 'passes it' means in terms of output or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, which is appropriately concise, but it is not front-loaded with critical information. It wastes space on vague phrasing like 'generic tool' without adding value, though it avoids excessive verbosity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (with an output schema but no annotations and 0% schema coverage), the description is incomplete. It does not clarify the tool's purpose, parameters, or behavior, failing to compensate for the lack of structured data, though the output schema might help mitigate some gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not add any meaning beyond the schema. It does not explain what 'value' represents (e.g., what an 'observable' is), its format, or constraints, leaving the single parameter undocumented and unclear.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'takes any observable and passes it the correct tool,' which is tautological—it restates the tool's name 'lookup-observable' without specifying what an 'observable' is or what 'passes it' entails. It lacks a clear verb+resource combination, making the purpose vague and minimally informative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool, such as context, prerequisites, or alternatives. The description is generic and does not provide any usage instructions, leaving the agent with no direction on its application.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool update
    • First observedlookup-observable
Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

C2.1/5.0

Scored across 1 tool

Disambiguation5/5

With only one tool, there is no possibility of ambiguity or overlap between tools. The single tool 'lookup-observable' has a clear, distinct purpose of routing observables to appropriate handlers, leaving no room for confusion or misselection.

Naming Consistency5/5

The naming is trivially consistent as there is only one tool. The tool name 'lookup-observable' follows a clear verb_noun pattern, and with no other tools to compare, there is no inconsistency in naming conventions.

Tool Count2/5

A single tool is too few for a server named 'Enrichment MCP Server', which suggests a purpose of enriching various observables. This minimal toolset feels thin and inadequate for the implied scope, as it relies on internal routing rather than exposing a comprehensive set of enrichment operations directly.

Completeness1/5

The tool surface is severely incomplete for an enrichment server. There are obvious gaps, such as no direct tools for specific observable types (e.g., IP addresses, domains, files) or enrichment actions (e.g., threat intelligence lookup, geolocation). The single generic tool creates a dead end for agents, lacking the necessary coverage for the domain.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • OpenCTI MCP Server

    zxzinn
    A
    license
    A
    quality
    C
    maintenance
    A Model Context Protocol server that facilitates integration with OpenCTI, allowing users to query and retrieve cyber threat intelligence data via a standardized interface.
    16
    40
    MIT

  • ADEO CTI MCP Server

    ADEOSec
    F
    license
    Not graded
    quality
    D
    maintenance
    A Model Context Protocol server that provides access to Shodan and VirusTotal APIs for cybersecurity analysis, enabling analysts to perform network intelligence operations including host lookups, vulnerability analysis, and threat intelligence gathering.
    25
    -

  • Enrichment MCP Server

    synackpwn
    F
    license
    Not graded
    quality
    D
    maintenance
    A Model Context Protocol server that performs third-party threat intelligence enrichment for various observables (IP addresses, domains, URLs, emails) using services like VirusTotal, Shodan, and AbuseIPDB.
    -

  • MCP Vulnerability Checker

    firetix
    A
    license
    A
    quality
    D
    maintenance
    A Model Context Protocol server providing security vulnerability intelligence tools including CVE lookup, EPSS scoring, CVSS calculation, exploit detection, and Python package vulnerability checking.
    8
    9
    MIT

Appeared in Searches