Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@OpenCTI MCP Server Check if the campaign APT29 exists"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
This MCP server provides tools to interact with the OpenCTI platform using the pycti library.
check_campaign_exists: Check if a campaign exists in OpenCTI by name
Related MCP server: deeptempo-mcp-servers
Python 3.8+
pycti 5.12.33
fastmcp
Install dependencies:
pip install -r requirements.txtSet up environment variables:
OPENCTI_URL: The URL of your OpenCTI instance (e.g., https://your-opencti-instance.com)
OPENCTI_TOKEN: Your OpenCTI API token
Add the following to your MCP settings configuration file:
{
"mcpServers": {
"opencti": {
"command": "python",
"args": ["C:/Users/JIT/Documents/Cline/MCP/opencti-server/server.py"],
"env": {
"OPENCTI_URL": "your-opencti-url",
"OPENCTI_TOKEN": "your-opencti-token"
}
}
}
}Once configured, you can use the following tool:
Check if a campaign exists in OpenCTI by providing its name:
Input: {"name": "APT28"}
Output: {
"exists": true,
"campaign": {
"id": "campaign-id",
"name": "APT28",
"description": "...",
...
},
"message": "Campaign 'APT28' found in OpenCTI"
}Log in to your OpenCTI instance
Navigate to your profile settings
Generate an API token
Copy the token and your OpenCTI instance URL
This server cannot be deployed
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
Enrich and search people and companies, resolve identities, and enrich IP addresses.
Submit files and URLs to a malware sandbox, poll scans, fetch reports, hashes and IOCs.
Create AI images and videos, manage projects and credits, and use workspace campaign context.
