Enables AI agents to perform security alert triage by ingesting raw logs, extracting IOCs, querying threat intelligence sources, and generating structured NIST/MITRE assessments with reasoning traces.
An MCP server for offline network forensic analysis and threat intelligence, enabling LLMs to analyze PCAP files, extract streams, detect threats, and identify credentials using tshark.
Dark web & threat intelligence for AI agents. HIBP, ThreatFox, ransomware tracking, Tor .onion access, blockchain intel, exploit search, stealer logs, malware analysis — unified into a single MCP server.
Local, no-API-key MCP server with seven defensive SecOps tools for AI agents: extract IOCs (IPs, URLs, domains, hashes, CVE IDs) from text with defang/refang, hash strings, estimate password entropy, and run CIDR/subnet checks. Built on FastMCP with no outbound network calls.
Enables natural language threat hunting and incident response by connecting LLMs to enterprise security data sources like Elasticsearch, EVTX logs, PCAP files, and Velociraptor.