"Intel" matching MCP servers:

Enables prioritized vulnerability intelligence with exploitation-aware ranking, fact-checking of agent claims, and transferable attack mechanics from disclosed bug bounty reports.

Enables domain intelligence lookups including RDAP registration data, DNS records, and Certificate Transparency searches.

Enables users to scan MCP servers for security threats, check installed servers, and analyze config files for risks, all from AI assistants like Claude, Cursor, or Windsurf.

Package intelligence for AI coding agents that checks npm and PyPI package health, deprecation, vulnerabilities, bundle size, and compares alternatives.

MCP server for Threadlinqs Intelligence — 49 tools across threat intelligence, detections, IOCs, threat actors, MITRE attack-chains, C2 infrastructure, and Purple-tier composite intelligence. Drop-in for Claude Code, Claude Desktop, Cursor, and any MCP-compatible client.

Enables AI assistants to look up CVE details, EPSS exploit probability, and CISA KEV status from free public APIs to prioritize vulnerabilities by real-world risk. Combines these sources into a single enriched, prioritized view using a KEV > EPSS > CVSS rule.

Enables AI agents to run domain-intelligence investigations through six free tools: sanctions screening, IP geolocation with VPN/Tor detection, email validation with breach status, company profiling, WHOIS and email-security scoring, and a single-call domain dossier.

Vulnerability intelligence for AI agents that enables CVE lookup, package vulnerability checks, and dependency auditing without API keys.

Provides CVE lookup, search, and exploit intelligence from public vulnerability sources (NVD, CISA KEV, EPSS) for AI agents to produce remediation guidance without consuming LLM tokens for data fetching.

Provides counterparty risk checks for any EVM address, returning malicious-history flags, tiered risk scoring, and plain-language summaries via x402 payment.

Threat Intel MCP Server provides a set of tools for querying multiple threat intelligence platforms like VirusTotal, Shodan, GreyNoise, and urlscan.io. It includes enrichment tools that query all providers at once for IPs, URLs, or files.

Provides unified access to multiple threat intelligence sources like AlienVault OTX, AbuseIPDB, and GreyNoise for security research and analysis. It enables users to perform simultaneous lookups on IPs, domains, hashes, and URLs across several platforms within a single response.

Provides threat intelligence and vulnerability research tools by integrating with NVD, VirusTotal, AbuseIPDB, Shodan, and MITRE ATT\&CK. It enables users to perform CVE lookups, analyze IP reputation, and retrieve detailed MITRE ATT\&CK technique information.

Enables AI assistants to search and analyze vulnerabilities and exploits from multiple intelligence sources, including NVD, CISA KEV, ExploitDB, Metasploit, and more, with tools for CVE research, exploit analysis, and report generation.

Sovereign AI intelligence platform with 73K+ darknet threat intel points, 65+ divination systems, and Norwegian legal database. Tools: threat_search, threat_feed, threat_stats, oracle_reading, norlex_legal.

Enables AI agents to interact with the npm registry, covering package intel, dist-tags, trusted publisher configuration, access and team governance, tokens, security advisories, and publishing, with read-only tools by default.

Self-hostable MCP server for WhisperGraph — a graph of 7.39B nodes / 39B edges mapping DNS, BGP, GeoIP, WHOIS, and threat intelligence. Six read-only tools (Cypher query + schema introspection + threat assessment), six resources, eight investigation prompts. stdio and Streamable HTTP transports.

Security intelligence API for AI models. CVE lookup with EPSS/KEV, domain recon (DNS, WHOIS, SSL, subdomains, WAF), and code security checks (secrets, injection, headers). 16 tools, no API key required.

Pre-install trust scoring & safety scanning for MCP servers, AI skills & npm packages — 15 signals incl. OSV/KEV/EPSS vuln intel and an auto-gate go/no-go.

Dark web & threat intelligence for AI agents. HIBP, ThreatFox, ransomware tracking, Tor .onion access, blockchain intel, exploit search, stealer logs, malware analysis — unified into a single MCP server.