"Information about Threat Intelligence" matching MCP servers:

Threat Intel MCP Server provides a set of tools for querying multiple threat intelligence platforms like VirusTotal, Shodan, GreyNoise, and urlscan.io. It includes enrichment tools that query all providers at once for IPs, URLs, or files.

Aggregates real-time threat intelligence from multiple sources including Feodo Tracker, URLhaus, CISA KEV, and ThreatFox, with IP/hash reputation checking via VirusTotal, AbuseIPDB, and Shodan for comprehensive security monitoring.

A comprehensive MCP server for structured threat modeling using STRIDE methodology, with automatic code validation and report generation.

Enables LLM agents to access Google Threat Intelligence data, including IOC search, file/domain/IP/URL analysis, and threat hunting rulesets, for security investigations.

Enables AI assistants to access Google's Threat Intelligence suite for file analysis, indicator of compromise searches, and reputation checking. It supports both local and cloud-based deployments for investigating campaigns, threat actors, and malware families.

Enables querying threat intelligence data about files, URLs, IPs, and domains from multiple abuse.ch platforms (MalwareBazaar, URLhaus, and ThreatFox) through a unified API. Provides comprehensive security reports and threat analysis data for cybersecurity investigations.

Provides CVE search enriched with EPSS exploit likelihood and CISA KEV status, plus live IP/domain reputation and a real-time threat feed for AI agents.

A behavioral threat hunting MCP server that focuses on adversary TTPs rather than atomic indicators, with MITRE ATT\&CK integration, advanced cognitive capabilities, and community hunt hypotheses.

Kaspersky OpenTIP Model Context Protocol Server. This server gives access to Kaspersky OpenTIP API to agentic applications.

A standalone Python/FastAPI server that implements the Model Context Protocol (MCP) for the OPTIX threat intelligence platform. It exposes 26 analyst-friendly tools that AI assistants and programmatic consumers can use to query threat feeds, search documents and indicators, manage watchlists, triage IOCs, generate detection rules, trigger AI research, and produce intelligence reports.

MCP server providing comprehensive domain intelligence (WHOIS, DNS, SSL, domain age) for due diligence and security audits, with pay-per-call via x402 micropayments.

Live threat intelligence for agents: incident clusters, threat actor and malware profiles, CVEs with KEV/EPSS/exploit status, and ransomware leak-site victims, as ten read-only tools over the ThreatCluster API with a free key. Every result carries citation URLs and the credits it cost.

Provides MCP tools for IP threat intelligence lookup and enrichment, including single IP lookup, bulk hunting, ASN expansion, and feed status queries.

Enables domain overviews for security and sales, providing registration, infrastructure, and risk signal data through a simple API request.

Sovereign AI intelligence platform with 73K+ darknet threat intel points, 65+ divination systems, and Norwegian legal database. Tools: threat_search, threat_feed, threat_stats, oracle_reading, norlex_legal.

Enables checking IP reputations and threat intelligence by querying Chaitin's global honeypot network and millions of defense nodes. Provides real-time IP profiling, malicious behavior detection, and threat alerts based on aggregated security data.

Provides unified access to multiple threat intelligence sources like AlienVault OTX, AbuseIPDB, and GreyNoise for security research and analysis. It enables users to perform simultaneous lookups on IPs, domains, hashes, and URLs across several platforms within a single response.

Enables AI agents to log, evaluate, and ground consequential decisions against an organization's authority graph, creating a traceable audit trail for governance.

Enables AI agents to verify Israeli companies and assess supplier invoice and payment risk before sending funds, exposing registry-backed evidence, company-change events, invoice gates, and x402 payee-trust checks with deterministic PAY/HOLD/BLOCK and ALLOW/REVIEW/DENY outcomes. It also provides free previews and schema/service discovery tools over remote MCP.

Enables MCP-compatible AI clients to securely access a user's personal context by exposing connector data, starting with recent Spotify listening activity, through per-user OAuth and tools.