Threat Intelligence MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| OTX_API_KEY | No | AlienVault OTX API key for threat pulse feeds | |
| SHODAN_API_KEY | No | Shodan API key for IP intelligence and port scanning | |
| ABUSEIPDB_API_KEY | No | AbuseIPDB API key for IP reputation and abuse reports | |
| VIRUSTOTAL_API_KEY | No | VirusTotal API key for hash and IP lookups |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tasks | {
"list": {},
"cancel": {},
"requests": {
"tools": {
"call": {}
},
"prompts": {
"get": {}
},
"resources": {
"read": {}
}
}
} |
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_threat_feedsB | Get list of all available threat intelligence feeds. Returns: JSON with available feeds and their descriptions |
| fetch_threat_feedB | Fetch and parse a specific threat intelligence feed. Args: feed_name: Name of the feed (feodo_tracker, urlhaus_recent, etc.) Returns: JSON with IOCs from the feed |
| check_ip_reputationC | Check an IP address against multiple threat intelligence sources. Args: ip: IP address to check Returns: JSON with reputation data from multiple sources |
| check_hash_reputationA | Check a file hash (MD5/SHA1/SHA256) against threat intelligence. Args: file_hash: File hash to check Returns: JSON with reputation data |
| check_bulk_ipsC | Check multiple IP addresses against threat feeds in bulk. Args: ips: JSON array of IP addresses or comma-separated list Returns: JSON with reputation results for all IPs |
| get_cisa_kevA | Get CISA Known Exploited Vulnerabilities. Args: days: Get vulnerabilities added in last N days (default: 30) vendor: Filter by vendor name (optional) Returns: JSON with recent KEVs |
| get_dashboard_summaryB | Get a summary of all threat intelligence for dashboard display. Returns: JSON with aggregated threat data for visualization |
| get_recent_iocsB | Get recent IOCs (Indicators of Compromise) from ThreatFox. Args: ioc_type: Filter by type (ip:port, domain, url, md5, sha256) limit: Maximum IOCs to return (default: 100, max: 500) Returns: JSON with recent IOCs |
| check_network_against_threatsC | Check network scan results against threat intelligence. Args: scan_results: JSON string from network scanner with device IPs Returns: JSON with any matched threats |
| get_threat_statsB | Get statistics about loaded threat data and cache status. Returns: JSON with threat intelligence statistics |
| clear_threat_cacheB | Clear the threat intelligence cache to force fresh data fetch. Returns: JSON confirmation |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 11 tools
Each tool has a clearly distinct purpose with no ambiguity. The tools cover specific threat intelligence operations like checking IPs/hashes, fetching feeds, getting CISA KEVs, retrieving IOCs, and managing cache/stats, all with well-defined boundaries. There is no overlap that would cause misselection.
Tool names follow a consistent verb_noun pattern throughout, such as check_bulk_ips, fetch_threat_feed, get_cisa_kev, and clear_threat_cache. All tools use snake_case with clear, descriptive names that align with their functions, making them predictable and readable.
With 11 tools, the count is well-scoped for a threat intelligence server, covering essential operations like reputation checks, feed management, data retrieval, and cache control. Each tool earns its place without feeling excessive or insufficient for the domain.
The tool surface provides complete coverage for threat intelligence workflows, including checking various IOCs (IPs, hashes, networks), fetching and managing feeds, retrieving vulnerabilities and recent IOCs, and supporting dashboards and statistics. There are no obvious gaps that would hinder agent operations.