MCP Threat Intel Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| OTX_API_KEY | No | AlienVault OTX API key for threat pulses and community intelligence. | |
| ABUSECH_AUTH_KEY | No | abuse.ch auth key for URLhaus, MalwareBazaar, and ThreatFox. | |
| ABUSEIPDB_API_KEY | No | AbuseIPDB API key for IP reputation and abuse reports. | |
| GREYNOISE_API_KEY | No | GreyNoise API key to identify internet noise vs targeted attacks. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| threatintel_statusA | Check which threat intelligence sources are configured. Currently available: greynoise, feodo |
| threatintel_lookup_ipA | Look up an IP address across all configured threat intelligence sources (OTX, AbuseIPDB, GreyNoise, Feodo Tracker) |
| threatintel_lookup_domainA | Look up a domain across threat intelligence sources (OTX, URLhaus) |
| threatintel_lookup_hashA | Look up a file hash (MD5, SHA1, SHA256) across threat intelligence sources (OTX, MalwareBazaar) |
| threatintel_lookup_urlB | Look up a URL for malware/phishing indicators (OTX, URLhaus) |
| greynoise_ipA | Check if an IP is internet background noise or a targeted threat (GreyNoise) |
| feodo_trackerA | Get active botnet C2 servers from Feodo Tracker (Emotet, Dridex, QakBot, etc.) |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool targets a distinct IOC type or source: feodo_tracker for botnet C2s, greynoise_ip for noise classification, and threatintel_lookup_* for domain, hash, IP, and URL lookups. There is no confusion about which tool to use for a given input type.
Most tools follow a 'threatintel_lookup_<type>' pattern, but 'feodo_tracker' and 'greynoise_ip' break this convention, creating a mix of styles. The naming is not fully predictable.
With 7 tools, the server covers the core threat intelligence operations without being bloated. The count feels well-scoped for the domain.
The set covers common IOC types (IP, domain, hash, URL) but has redundancy: feodo_tracker and greynoise_ip overlap with the combined threatintel_lookup_ip. Missing IOC types like email or CVE, and no write/update operations, though acceptable for a lookup service.