MCP Threatintel MCP Server

by aplaceforallmystuff Your server? Claim it

local only

MCP Threatintel runs on your own machine — the client starts it, so there is no endpoint to ping. 100 installs a week from npm. Last commit 9 Aug 2026.

Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker

Installs per day peak 24 · avg 12 · -5% w/w

a month agotoday

100

Installs / week

npm · mcp-threatintel-server

Stars

1 open issue

9 Aug 2026

Last commit

no releases in 90 days

MIT

License

JavaScript

Nothing serious here today

Today is the operative word: we check MCP Threatintel every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add mcp-threatintel -- npx -y mcp-threatintel-server

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "mcp-threatintel": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-threatintel-server"
      ]
    }
  }
}

~/.codex/config.toml

[mcp_servers.mcp-threatintel]
command = "npx"
args = ["-y", "mcp-threatintel-server"]

.cursor/mcp.json

{
  "mcpServers": {
    "mcp-threatintel": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-threatintel-server"
      ]
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "mcp-threatintel": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "mcp-threatintel-server"
      ]
    }
  }
}

Optional settings from the registry entry, left out of the block above: OTX_API_KEY (AlienVault OTX API key (free at otx.alienvault.com)), ABUSEIPDB_API_KEY (AbuseIPDB API key (free at abuseipdb.com)), GREYNOISE_API_KEY (GreyNoise API key (free at greynoise.io)), ABUSECH_AUTH_KEY (abuse.ch Auth Key for URLhaus, MalwareBazaar, ThreatFox (free at auth.abuse.ch)).

Alternatives to MCP Threatintel

same job, measured the same way

Feodotracker

by pipeworx-io

Feodo Tracker MCP — botnet C&C IP blocklist from abuse.ch.

456 installs/wk 48 tools answering

Threatfox

by pipeworx-io

ThreatFox MCP — abuse.ch indicator-of-compromise feed (free, key required)

271 installs/wk 48 tools answering

Greynoise

by nickjlucker

MCP server for GreyNoise API - Check if IPs are internet background noise or targeted attacks

33 installs/wk local only

Otx

by w0h1v

MCP server for AlienVault OTX threat intelligence: indicators, pulses, search, and users.

99 installs/wk local only

CI Sentinel

by baneado98

Multi-CI security scanner with a live threat-intel feed of compromised CI components

answering

OT Intel API

by no3men60

OT/ICS threat intel for AI agents: 40 tools, pay per call in USDC on Base via x402.

40 tools answering

Greynoise

by pipeworx-io

GreyNoise Community MCP — internet scanner classification (free tier with key)

464 installs/wk 45 tools answering

IZeat

by izeat

The five-star chef calorie tracker: meals that fill you up, logged in one sentence.

answering

MCP Threatintel — questions

Answers built from our own checks of this server.

Why is there no uptime for MCP Threatintel?

MCP Threatintel runs on your own machine over stdio — there is no network address to reach, so uptime cannot be measured for it by anyone. What can be measured is adoption: the npm package mcp-threatintel-server was installed 100 times last week.

How do I connect MCP Threatintel?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It runs locally, so the command pulls mcp-threatintel-server straight from npm; nothing to host, nothing to sign up for.

How many people use MCP Threatintel?

The npm package mcp-threatintel-server was installed 100 times in the last week. Week over week that is -5%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.

Is MCP Threatintel open source?

Yes — it is published under the MIT licence, written in JavaScript, 10 stars on GitHub and 1 open issue. The source link is on this page, so you can read exactly what it does with your data before you connect it.