MISP MCP Server

An MCP server that provides read-only access to MISP threat intelligence data.

Features

• Event search - Find threat intelligence events by IOC values, tags, dates, organisations

• Attribute search - Search individual indicators of compromise across all events

• Object search - Find grouped attributes (file objects, network connections, etc.)

• Event index - Lightweight event metadata browsing

• Tags & Taxonomies - Search tags and browse taxonomy vocabularies (TLP, kill chain, etc.)

• Galaxies - Search threat actors, malware, ATT&CK techniques, and other knowledge bases

• Feeds - Browse configured threat intelligence feeds

All access is read-only - no data modification is possible through this server.

Related MCP server: KeyboardCrumbs MCP Server

Installation

pip install misp-mcp

Or install from source:

cd misp-mcp
pip install -e .

Configuration

Set the following environment variables:

Usage

Claude Desktop / Claude Code

Add to your MCP configuration:

{
  "mcpServers": {
    "misp": {
      "command": "misp-mcp",
      "env": {
        "MISP_URL": "https://misp.example.com",
        "MISP_API_KEY": "your-api-key-here"
      }
    }
  }
}

Standalone (stdio)

export MISP_URL="https://misp.example.com"
export MISP_API_KEY="your-api-key"
misp-mcp

Available Tools

Events & Attributes

• search_events - Search events by IOC values, tags, dates, organisations

• search_attributes - Search individual attributes/indicators

• search_objects - Search MISP objects

• search_event_index - Lightweight event metadata search

• get_event - Get full event by ID

• get_attribute - Get attribute by ID

• get_object - Get object by ID

Tags & Taxonomies

• search_tags - Search tags by name

• list_taxonomies - List all taxonomy vocabularies

• get_taxonomy - Get taxonomy details and entries

Galaxies

• search_galaxies - Search galaxies (threat actors, malware, ATT&CK, etc.)

• get_galaxy - Get galaxy with clusters

• search_galaxy_clusters - Search within a specific galaxy

Feeds

• search_feeds - Search/list configured threat intelligence feeds

License

AGPL-3.0-or-later - same as MISP.

Copyright (C) 2026 Andras Iklody