maltego-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MALTEGO_MCP_OUTPUT_DIR | No | Default output directory for .mtgx files | ~/MaltegoGraphs |
| MALTEGO_MCP_LOOKUP_TIMEOUT_MS | No | Per-lookup timeout in ms (currently applied to crt.sh only; whois, dns, asn use library defaults) | 30000 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| maltego_create_graphA | Create a new empty Maltego graph in memory. Returns graphId for use with maltego_add_entity / maltego_add_link / maltego_save_graph. |
| maltego_add_entityA | Add an entity (node) to a graph. Returns entityId for use with maltego_add_link. |
| maltego_add_linkC | Add a directed link between two entities. Returns linkId. |
| maltego_save_graphA | Save a graph to a .mtgx file inside the configured outputDir. Refuses to overwrite unless overwrite=true. |
| maltego_load_graphB | Load an existing .mtgx into a new graph handle. Returns the new graphId. |
| maltego_whoisB | Run a whois lookup for a domain. Returns registrar, nameservers, dates. |
| maltego_dnsB | Run a DNS lookup (A / AAAA / MX / NS / TXT) for a domain. |
| maltego_asnA | Look up ASN, netblock, country, and org for an IP via Team Cymru. |
| maltego_crtshC | Certificate Transparency search via crt.sh. Honors lookupTimeoutMs. |
| maltego_expand_ipC | Build a .mtgx graph around an IP (ASN + netblock). |
| maltego_expand_domainB | Build a .mtgx graph around a domain (whois + DNS + ASN per A record). |
| maltego_expand_hashC | Build a .mtgx graph with a Hash entity (extend in later versions). |
| maltego_build_ioc_graphB | Build a .mtgx investigation graph from one IOC plus enrichment summaries gathered from MISP, TheHive, Cortex, MITRE, or other MCPs. This tool does not call those services itself. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 13 tools
Most tools have distinct purposes (graph manipulation vs lookups vs expansions), but expand_domain overlaps with individual lookup tools (whois, dns, asn). This could cause an agent to pick the wrong tool for a specific lookup, though descriptions help differentiate.
Tool names mix verb_noun (add_entity, create_graph) and bare nouns (asn, dns, whois). While all start with 'maltego_', the pattern is inconsistent. The use of 'expand_' vs 'build_' also adds minor inconsistency.
13 tools is well-scoped for a Maltego integration covering graph creation/editing, lookups, and automated expansion. Each tool serves a clear purpose without bloat.
Core Maltego operations (create, add entity/link, save, load) are present, along with key lookups. Missing update/delete operations for graph elements, and some common lookups (e.g., reverse IP) are absent. Build_ioc_graph depends on external MCPs, limiting standalone completeness.