What can you do with this server?

This server provides MCP tools to query the CertIndex Certificate Transparency (CT) log index, enabling search and retrieval of TLS/SSL certificate metadata, domain certificate history, subdomain enumeration, and expiration tracking. * search_certificates: Search the CT index by domain, Common Name (CN), SAN, issuer, validity (expired/unexpired), and wildcard status, with pagination support. * get_certificate: Fetch full details for a single certificate by its SHA-256 fingerprint, with optional enrichment data (RDAP, DNS, ASN/hosting context). * get_domain_certificates: List all certificates ever issued for an exact domain, with options to filter to valid-only certs and include enrichment data. * get_subdomains: Enumerate unique subdomains of a given domain observed in CT logs, with pagination support. * get_latest_cert: Retrieve the most recently issued certificate for a domain, with optional enrichment data. * get_expiring_certs: Find certificates for a domain expiring within a specified number of days (default: 30). These tools support use cases such as certificate issuance tracking, domain security analysis, subdomain discovery, and certificate lifecycle management.

How do I use certindex-mcp?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@certindex-mcp List all TLS certificates for example.com" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

certindex-mcp

by certindex

Overview Schema Source Related Servers Discussions Admin

Python

Remote

certindex-mcp

PyPI License: MIT

An MCP (Model Context Protocol) server that exposes CertIndex's Certificate Transparency search tools to any MCP-compatible client (Claude Desktop, the MCP Inspector, Continue, etc.).

CertIndex indexes the full public CT corpus (~5 M certificates, growing ~100 k/day). This server wraps the public CertIndex REST API so an LLM can ask questions like:

"List every TLS certificate ever issued for example.com."
"What subdomains has Let's Encrypt seen for mycompany.io?"
"Show me certs expiring in the next 30 days for api.mycompany.io."
"Pull the full PEM and CT log metadata for SHA-256 <fingerprint>."

Why this repo exists

The CertIndex monorepo bundles an MCP server (mounted at https://api.ctindex.io/mcp) that talks directly to the production Postgres index. This standalone package is a thin client-side shim: it speaks MCP to your editor / agent and forwards every tool call to the hosted CertIndex REST API over HTTPS. Two consequences:

You don't need a copy of the index — sign up for a free API key at https://ctindex.io and you're done.
The package has a tiny dependency footprint (mcp, httpx, pydantic) — easy to audit, easy to vendor, no DB drivers.

Related MCP server: Certificate Search MCP Server

Install

pip install certindex-mcp

Or with uvx for one-shot use:

uvx certindex-mcp

To install the latest development version from source instead:

pip install git+https://github.com/certindex/certindex-mcp

Quickstart — Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "certindex": {
      "command": "uvx",
      "args": ["certindex-mcp"],
      "env": {
        "CERTINDEX_API_KEY": "ctx_live_..."
      }
    }
  }
}

Restart Claude Desktop. The ten CertIndex tools appear in the tool tray.

Tools

Ten tools, matching the hosted CertIndex MCP server 1:1:

Tool	What it does	Notable parameters
`search_certificates`	Search the CT index by domain, CN, issuer, SAN, validity, or wildcard status.	`domain`, `cn`, `issuer`, `san`, `expired`, `is_wildcard`, `page`/`limit`
`get_certificate`	Fetch a single cert by SHA-256 fingerprint.	`sha256`, `include_enrichment`
`get_domain_certificates`	Every cert ever issued for an exact domain.	`valid_only`, `include_enrichment`, `include_signals` (paid plans), `page`/`limit`
`get_subdomains`	Enumerate unique subdomains seen in CT.	Offset (`page`/`limit`) or keyset cursor mode — pass `cursor=""` to start, then feed back each response's `next_cursor`
`get_latest_cert`	Most recent currently-valid cert for a domain.	`include_enrichment`, `include_signals`, `include_precerts` (let precertificates compete for "latest")
`get_expiring_certs`	Certs for a domain expiring within `days` days.	`days`
`submit_global_sweep`	Submit an async, domain-less CN/SAN substring sweep of the entire index (`POST /v1/sweeps`).	`cn`/`san_contains` (3+ chars, at least one required), `issuer`, `is_wildcard`, `is_precert`, `expired`, `first_seen_`/`not_after_` date bounds, `strict_attribution`, `resume_token` (continuation past the result cap)
`get_sweep_results`	Poll a sweep job and paginate its results when done (`GET /v1/sweeps/{id}`).	`sweep_id`, `page`/`limit` (up to 1,000)
`get_usage`	Caller's tier, current usage, remaining quota, and entitlements.	—
`get_historical_backfill_status`	Check / start the paid deep-history backfill for a domain.	`domain`

Quickstart — MCP Inspector

export CERTINDEX_API_KEY=ctx_live_...
npx @modelcontextprotocol/inspector uvx certindex-mcp

Configuration

Env var	Default	Description
`CERTINDEX_API_KEY`	(required)	Your CertIndex API key. Mint one at https://ctindex.io/app/keys
`CERTINDEX_BASE_URL`	`https://api.ctindex.io`	Override for self-hosted deployments / staging
`CERTINDEX_TIMEOUT`	`30`	Per-request HTTP timeout (seconds)

Security

Input validation, rate-limit handling, and our supply-chain posture are documented in SECURITY.md. Please report vulnerabilities to security@ctindex.io rather than filing public issues.

Development

git clone https://github.com/certindex/certindex-mcp
cd certindex-mcp
pip install -e ".[dev]"
pytest

CI runs on Python 3.11 / 3.12 / 3.13.

License

MIT © CertIndex contributors.

Available Tools

6 tools

get_certificateA

Fetch a single cert by its 64-char hex SHA-256 fingerprint.

Set include_enrichment=true to attach RDAP + DNS + ASN/hosting context for the cert's primary hostname under enrichment.

ParametersJSON Schema

Name	Required	Description	Default
`sha256`	Yes
`include_enrichment`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

A4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description carries the full burden. It explains the fetch action and the optional enrichment parameter, but lacks details on error handling (e.g., if fingerprint not found) or any other behavioral traits like rate limits or idempotency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no wasted words. Front-loaded with the primary action and identifier, then the optional parameter. Efficient and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (2 parameters, output schema exists), the description covers the key aspects. It could mention what happens on failure (e.g., returns null or error) but overall is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description adds significant value. It specifies that sha256 is a 64-char hex string and explains what include_enrichment does (attach RDAP, DNS, ASN/hosting context under 'enrichment'), which is not in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the action (Fetch) and the resource (single cert) with the unique identifier (64-char hex SHA-256 fingerprint), distinguishing it from sibling tools that fetch by domain or other criteria.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use vs alternatives. While the purpose is clear, it does not mention when not to use this tool or comparisons to siblings like get_domain_certificates or search_certificates.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_domain_certificatesA

List certificates for an exact domain name. Cold domains return a backfill_status sentinel; retry per the hint.

Set include_enrichment=true to attach RDAP + DNS + ASN/hosting context for the domain under enrichment.

ParametersJSON Schema

Name	Required	Description	Default
`page`	No
`limit`	No
`domain`	Yes
`valid_only`	No
`include_enrichment`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

A4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description discloses important behavioral traits: cold domains return a backfill_status sentinel requiring retry, and include_enrichment adds context. This goes beyond basic listing behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with clear front-loading of purpose. Every sentence adds value with no extraneous words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 5 parameters and no annotations, the description covers core behavior and one parameter but misses pagination details and the valid_only parameter. Output schema exists, so return values are covered, but overall completeness is moderate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It only explains include_enrichment; other parameters (page, limit, valid_only, domain) are left undefined. This is insufficient for a 5-parameter tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List' and the resource 'certificates' with a specific constraint 'for an exact domain name'. This distinguishes the tool from siblings like search_certificates (fuzzy) and get_subdomains (different resource).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for exact domain lookups and explains cold domain behavior and enrichment options. However, it does not explicitly state when to avoid this tool or provide direct alternatives, though sibling tools are listed externally.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_expiring_certsB

Certificates for domain expiring within days days.

ParametersJSON Schema

Name	Required	Description	Default
`days`	No
`domain`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

B3.3/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It states it returns certs expiring within days but does not disclose if it includes already expired certs, the response format, or whether it is read-only. Minimal behavioral context beyond purpose.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no filler words, achieving conciseness. However, it could be structured to include parameter details without losing brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the return value burden is reduced. The description covers the core purpose and parameters, but for a tool with 2 parameters and no annotations, it leaves gaps in parameter semantics and behavioral context. Adequate but not thorough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain parameters. It mentions domain and days in a template but does not add meaning beyond the field names (e.g., what is the valid range for days? Is domain a full domain or part?). The default for days (30) is not mentioned.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly uses a specific verb ('get') and resource ('certificates') with an explicit filter (expiring within days). It distinguishes from sibling tools like get_certificate (single cert) and get_domain_certificates (all certs) by focusing on expiry.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied (when you need certs expiring soon) but no explicit guidance on when not to use it or which sibling to choose instead. The description lacks exclusion criteria or alternative suggestions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_latest_certA

Most recently issued cert for a domain (or {cert: null} with a backfill sentinel on cold domains).

Set include_enrichment=true to attach RDAP + DNS + ASN/hosting context for the domain under cert.enrichment.

ParametersJSON Schema

Name	Required	Description	Default
`domain`	Yes
`include_enrichment`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses the return format including the null sentinel for cold domains and explains the enrichment behavior. This is adequate for a read-only tool, but could mention any caching or data freshness details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences. First sentence states core purpose with edge case; second explains optional parameter. No wasted words, front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (2 params, 1 required) and has an output schema described externally. The description covers core behavior, edge case, and optional enrichment. Missing domain format specification but otherwise complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 0% coverage (no parameter descriptions). The description adds meaning for include_enrichment by detailing what enrichment includes, but leaves domain parameter underdefined (no format or validation hints). Some compensation but not full.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves the most recently issued certificate for a domain, including the edge case of null with a backfill sentinel for cold domains. This specific verb+resource combination distinguishes it from siblings like get_certificate (specific certificate) and get_domain_certificates (all certificates).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides guidance on when to use include_enrichment=true, explaining the additional context it provides (RDAP, DNS, ASN/hosting). However, it does not explicitly state when to use this tool versus siblings, though the sibling names and tool name offer implicit guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_subdomainsB

Enumerate unique subdomains seen in CT logs.

ParametersJSON Schema

Name	Required	Description	Default
`page`	No
`limit`	No
`domain`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

B3.1/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full responsibility for behavioral disclosure. It only mentions enumeration from CT logs and uniqueness, but does not disclose pagination behavior, rate limits, response size, or whether results are sorted. The presence of page and limit parameters is not addressed in the description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence that immediately conveys the tool's purpose. No extraneous words or repetition. It is efficiently front-loaded and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of annotations and the presence of three parameters with pagination defaults, the description is too brief. It does not cover pagination, result ordering, or what 'unique' means in practice. The tool has an output schema, but without its content, the description remains incomplete for safe invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description does not explain any parameters. While parameter names (page, limit, domain) are self-evident, the description adds no additional meaning about their format, constraints, or interaction. For a tool with low schema coverage, this is insufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Enumerate unique subdomains seen in CT logs', which is a specific verb (enumerate) and resource (unique subdomains from CT logs). This effectively distinguishes it from sibling tools that focus on certificates (e.g., get_certificate, get_domain_certificates).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not specify prerequisites, typical scenarios, or when not to use it. Without any usage context, the agent cannot make an informed choice among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_certificatesA

Search the CT certificate index by domain, CN, issuer, SAN, validity, or wildcard status. Returns a has_more boolean for paging (no unbounded COUNT).

ParametersJSON Schema

Name	Required	Description	Default
`cn`	No
`san`	No
`page`	No
`limit`	No
`domain`	No
`issuer`	No
`expired`	No
`is_wildcard`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

A3.7/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description does some work: it discloses paging via has_more and notes that no unbounded COUNT is supported. However, it does not mention auth needs, rate limits, or other behavioral traits. It adds value beyond the schema but is not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences: first states purpose and criteria, second adds key paging behavior. No wasted words, front-loaded with purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 8 parameters and an output schema (not shown), the description covers pagination but lacks detail on parameter interactions and result structure. It is adequate but not thorough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description names most parameters (domain, CN, issuer, SAN, validity, wildcard) but does not explain page and limit or how parameters combine (e.g., AND/OR). With 0% schema coverage, it provides some but not full meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches the CT certificate index by specified criteria (domain, CN, issuer, SAN, validity, wildcard status), which distinguishes it from siblings like get_certificate (single certificate) and get_domain_certificates (domain-specific). The mention of pagination further differentiates it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use for searching by various fields, but does not explicitly state when to use alternatives like get_certificate or get_domain_certificates. No when-not-to-use guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

6 tool updatesv0.1.0Jul 11, 2026
- First observedget_certificate
- First observedget_domain_certificates
- First observedget_expiring_certs
- First observedget_latest_cert
- First observedget_subdomains
- First observedsearch_certificates

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.9/5.0

Scored 2026-07-11 12:15 across 6 tools

Disambiguation5/5

Each tool has a distinct purpose: fetching a single certificate by fingerprint, listing certificates for a domain, finding expiring certs, getting the latest cert, enumerating subdomains, and performing a general search. No ambiguity between them.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern in snake_case (e.g., get_certificate, get_domain_certificates). The naming is predictable and clear.

Tool Count5/5

With 6 tools covering the core operations of a certificate index (fetch, list, search, subdomain enumeration), the count is well-scoped and not excessive.

Completeness4/5

The set covers the main operations expected from a CT log index: retrieval by fingerprint, domain listing, expiry checks, latest cert, subdomain enumeration, and general search. Minor gaps like raw log entry access are not critical for the stated purpose.

Maintenance

ActivitySlowing

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

CTlogs.ioOAuth
io.github.ABTdomain
Certificate Transparency search: subdomains, certificate history and hostname keyword search.
Penetration Testing Open Data
1
Lattis A
dev.lattis
Search indexed websites, read raw page markdown, and score AI visibility for any site.
Search Web Scraping Browser Automation
2
fetcher B
cloud.fetcher
The web capability layer for AI agents: render, extract, DNS, SSL, WHOIS & more via x402.
Browser Automation Networking & Infrastructure
191
Search1API AOAuth
io.github.superagents-lab
Web search, news, page retrieval, sitemaps, and trending topics through Search1API.
Search Browser Automation
1173

Related MCP Servers

SEQ MCP Server
Monitoring Observability Databases
RoeeJ
A
license
B
quality
D
maintenance
Enables LLMs to query and analyze logs from SEQ structured logging server with capabilities for searching events, retrieving event details, analyzing log patterns, and accessing saved searches.
Updated 10 months ago (2025-11-24 20:42 UTC)
5
MIT
Certificate Search MCP Server
Security Search Web Scraping
Randark-JMT
F
license
Not graded
quality
D
maintenance
Enables SSL/TLS certificate search and analysis using crt.sh data, supporting domain certificate discovery, subdomain enumeration, and security auditing through Cloudflare Workers deployment.
Updated a year ago (2025-10-23 14:55 UTC)
-
ctscout
Search Open Data
minghsuy
A
license
A
quality
A
maintenance
Enables named-entity attribution from Certificate Transparency logs (OV/EV only) for mapping legal-entity digital footprints and domain discovery via LLM-driven workflows.
Updated 3 days ago (2026-09-10 18:57 UTC)
7
333 npm
MIT
Google Threat Intelligence MCP
Security Search
jmaciasc-google
A
license
B
quality
B
maintenance
Enables LLM agents to access Google Threat Intelligence data, including IOC search, file/domain/IP/URL analysis, and threat hunting rulesets, for security investigations.
Updated 2 months ago (2026-07-13 15:56 UTC)
36
Apache 2.0