Which integrations are available for this server?

Provides tools for analyzing IPs, domains, URLs, and hashes using VirusTotal's threat intelligence data.

How do I use ThreatWatch MCP?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@ThreatWatch MCP Analyze IP 185.220.101.1 for threats" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

ThreatWatch MCP

by Abraar02

Overview Schema Related Servers Score Discussions

Python

Local

🛡️ ThreatWatch MCP

AI-Powered Threat Intelligence with Real-Time Alert Monitoring

A Model Context Protocol (MCP) server that brings multi-source threat intelligence directly into Claude Desktop and any MCP-compatible AI assistant.

Python 3.11+ License: Apache-2.0 MCP

✨ What Makes ThreatWatch Different

Feature	ThreatWatch	fastmcp-threatintel
Real-time watch-list & alerts	✅	❌
Persistent alert history	✅	❌
Shodan InternetDB (free, no key needed)	✅	❌
Status-change detection	✅	❌
IOC extraction from freeform text	✅	❌
Works with zero API keys	✅	❌

Related MCP server: FastMCP ThreatIntel

🔌 Available MCP Tools

Tool	Description
`analyze_ioc`	Analyse a single IP / domain / URL / hash
`bulk_analyze`	Analyse up to 50 IOCs concurrently
`detect_iocs_in_text`	Extract IOCs from log files, reports, pastes
`add_watch`	Add an IOC to the real-time watch-list
`remove_watch`	Remove an IOC from the watch-list
`list_watches`	Show all monitored IOCs and their status
`get_alerts`	Retrieve alerts from monitored IOCs
`run_monitor_cycle`	Manually trigger a re-scan of all watches
`server_status`	Show configured sources and monitor state

🚀 Installation

Prerequisites

Python 3.11 or higher
Claude Desktop
API keys (see below — all free tier)

Step 1 — Clone the repo

git clone https://github.com/YOUR_USERNAME/threatwatch-mcp.git
cd threatwatch-mcp

Step 2 — Install

pip3 install fastmcp httpx python-dotenv
pip3 install -e .

Step 3 — Verify installation

which threatwatch

You should see a path like /usr/local/bin/threatwatch or /Library/Frameworks/Python.framework/Versions/3.x/bin/threatwatch. Copy this path — you'll need it in Step 5.

🔑 API Keys (All Free)

Source	Required	Free Limit	Sign Up
VirusTotal	Recommended	1,000 req/day	virustotal.com
AlienVault OTX	Recommended	Unlimited	otx.alienvault.com
AbuseIPDB	Optional	1,000 req/day	abuseipdb.com
IPinfo	Optional	50,000 req/month	ipinfo.io
Shodan InternetDB	None needed	Always free	Built-in

ThreatWatch works with zero API keys — Shodan InternetDB is always available and returns open ports, CVEs, and hostnames for any IP for free.

⚙️ Connect to Claude Desktop

Step 4 — Open the Claude Desktop config

macOS:

open -e ~/Library/Application\ Support/Claude/claude_desktop_config.json

Windows:

%APPDATA%\Claude\claude_desktop_config.json

Step 5 — Add ThreatWatch

Add the threatwatch entry to your mcpServers block. Replace the command path with the output of which threatwatch from Step 3, and fill in your API keys:

{
  "mcpServers": {
    "threatwatch": {
      "command": "/Library/Frameworks/Python.framework/Versions/3.13/bin/threatwatch",
      "env": {
        "VIRUSTOTAL_API_KEY": "your_virustotal_key_here",
        "OTX_API_KEY": "your_otx_key_here",
        "ABUSEIPDB_API_KEY": "your_abuseipdb_key_here",
        "IPINFO_API_KEY": "your_ipinfo_key_here"
      }
    }
  }
}

If you already have other MCP servers configured, just add the threatwatch block inside your existing mcpServers object — don't replace the whole file.

Step 6 — Restart Claude Desktop

Fully quit Claude Desktop (Cmd + Q on Mac, system tray → Exit on Windows) and reopen it.

Step 7 — Verify

Click the "+" button at the bottom of the Claude chat → Connectors. You should see ThreatWatch listed with all 9 tools.

Then test it:

Run server_status

💬 Example Prompts

Analyse IP 185.220.101.1 for threats

Check if domain update-adobe-flash.ru is malicious

Is this hash dangerous: d41d8cd98f00b204e9800998ecf8427e

Extract all IOCs from this log and analyse them:
[paste your firewall log, SIEM alert, or email header]

Add a watch on 185.220.101.1 and alert me if it becomes malicious

Get all alerts from the last hour

Run a full monitor cycle now

🔔 How Real-Time Monitoring Works

add_watch("185.220.101.1", alert_on=["malicious", "suspicious"])
         │
         ▼
   Watch-list saved to ~/.threatwatch/watchlist.json
         │
         ▼
run_monitor_cycle()   ← trigger manually or on a schedule
         │
         ▼
   Re-queries all sources for each watched IOC
         │
         ▼
   Status changed or threshold crossed?
         │
    Yes  │  No
    ▼    ▼
  Alert  (no-op)
    │
    ▼
get_alerts(since_minutes=60)

🏗️ Project Structure

threatwatch-mcp/
├── src/
│   └── threatwatch/
│       ├── __init__.py        ← package definition
│       ├── server.py          ← FastMCP server + all 9 MCP tools
│       ├── config.py          ← settings from environment variables
│       ├── ioc_detector.py    ← IOC type detection (IP/domain/URL/hash)
│       ├── intel_sources.py   ← API adapters (VT, OTX, AbuseIPDB, IPinfo, Shodan)
│       ├── alert_monitor.py   ← real-time watch-list + alert engine
│       └── reporter.py        ← Markdown report builder
├── tests/
│   └── test_core.py           ← unit tests
├── pyproject.toml             ← package config + dependencies
├── .env.example               ← environment variable template
└── README.md

🔒 Security Notes

Never commit your .env file — it is in .gitignore by default

Restrict config file permissions on your machine:

chmod 600 ~/Library/Application\ Support/Claude/claude_desktop_config.json

All API keys used are read-only — they can query data but cannot modify anything
If a key is ever leaked, regenerate it instantly from each service's dashboard

🧪 Running Tests

pip3 install pytest pytest-asyncio
pytest tests/ -v

📜 License

Apache 2.0 — see LICENSE for details.

🙏 Acknowledgments

FastMCP — the MCP framework that powers ThreatWatch
fastmcp-threatintel — original inspiration
VirusTotal, AlienVault OTX, AbuseIPDB, IPinfo, Shodan — threat intelligence sources

This server cannot be installed

license - permissive license

quality - not tested

maintenance

How are these scores calculated?

Maintenance

–Maintainers

–Response time

–Release cycle

–Releases (12mo)

Commit activity

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Latest Blog Posts

Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly
Lightport: Open-Sourcing Glama's AI Gateway
By punkpeye on April 27, 2026.
OpenAI
open source

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Abraar02/threatwatch-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server