mcpbeat Sign in

Threatcluster MCP Server

by jam0k Your server? Claim it
answering

Threatcluster is answering right now. Last checked 10 min ago. 49 installs a week from npm. Last commit 15 Oct 2026.

Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.

Installs per day peak 179 · avg 18 · -66% w/w
a month agotoday
Uptime history 30 days of history · worst day 96%
30 days agonow
100.0%
Uptime 24h
91 of 91 checks
—
Tools
hidden behind auth
246 ms
Response time
average over 24h
49
Installs / week
npm and PyPI

Threatcluster does not always answer

Over the last week it answered 99.4% of our checks. We check every 15 minutes, so you hear about the next outage within the hour — not from your users.

Three servers free · no card

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 10 min ago.

run in your terminal
claude mcp add threatcluster --transport http https://threatcluster.io/mcp
Settings → Connectors → Add custom connector, then paste this address
https://threatcluster.io/mcp
~/.codex/config.toml
[mcp_servers.threatcluster]
url = "https://threatcluster.io/mcp"
.cursor/mcp.json
{
  "mcpServers": {
    "threatcluster": {
      "url": "https://threatcluster.io/mcp"
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "threatcluster": {
      "type": "http",
      "url": "https://threatcluster.io/mcp"
    }
  }
}

This endpoint answered with an authorization challenge. The server is running, and it signs you in through your browser: there is no API key to paste.

Endpoints

URLTransportStateLatencyChecked
https://threatcluster.io/mcp streamable-http sign-in 272 ms 10 min ago

Alternatives to Threatcluster

same job, measured the same way
Engagelab Email
by r1ghtherewaiting

Send, receive, monitor and reply to email from AI agents with threaded inbox context.

14 installs/wk local only
N
NIFC Wildfire Data
by olyport

Active wildfire incidents from the National Interagency Fire Center

3 tools answering
Pingoru status
by pingoru

Live status, incidents and maintenance windows for 8,000+ cloud and SaaS status pages.

answering
Crowdsentinel MCP Server
by thomasxm

AI threat hunting & incident response for Elasticsearch/OpenSearch with endpoint & network forensics

332 installs/wk local only
Monitoring
by pingvera

Client-website monitoring for agencies: uptime, incidents, SSL/domain expiry, server metrics.

answering
UptimeRobot
by uptimerobot

Monitor websites, APIs, and servers: create monitors, triage incidents, and query uptime stats.

answering
All's Well
by alls-well

Set up uptime, SSL and heartbeat monitors, alert contacts and incidents for an All's Well team.

answering
Huntress MCP
by servosity

Every Huntress endpoint, plus a local SQLite mirror that delivers fleet-wide incident, coverage

local only

Threatcluster — questions

Answers built from our own checks of this server.

Why is there no tool list for Threatcluster?
The server answered our handshake with an authorization challenge, so it is running — but it will not describe its tools to an anonymous client. To see them you need to connect with your own credentials. We record it as alive, not as broken: 100.0% of checks in the last 24 hours got a reply.
Is Threatcluster working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 246 ms. The bar chart above shows every period we have measured.
How do I connect Threatcluster?
Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address. You sign in through your browser once and the client keeps the session: no key to copy, and it refuses anonymous clients.
How do you sign in to Threatcluster?
No API key is involved. Threatcluster answers our knock with an OAuth challenge, so you authorise it once in your browser and the client keeps the session. That is also why we see no tool list: it will not describe itself to an anonymous client, and that is the server working as intended, not a fault.
How fast is Threatcluster?
It answers our handshake in 246 ms on average, which is faster than 68% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.
How many people use Threatcluster?
The npm package threatcluster-mcp was installed 49 times in the last week. Week over week that is -66%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.
Is Threatcluster open source?
The code is open source: it is published under the GPL-3.0 licence, written in Python and 1 stars on GitHub. The licence covers the code in the repository, not the hosted service at threatcluster.io, which runs on its operator's own terms.