mlab.sh is answering right now. Last checked 11 min ago. Last commit 31 Oct 2026.
Threat intelligence: enrich IOCs (IP, domain, URL, hash), search CVEs and actors, scan SBOMs.
mlab.sh missed 2 checks this week
Everything else answered, so this is steady rather than shaky. We check every 15 minutes, which is how a one-off gets told apart from the start of a pattern, and how you hear about the next one within the hour instead of from your users.
Connect this server
Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 11 min ago.
claude mcp add mcp --transport sse https://mlab.sh/mcphttps://mlab.sh/mcp[mcp_servers.mcp]
url = "https://mlab.sh/mcp"{
"mcpServers": {
"mcp": {
"url": "https://mlab.sh/mcp"
}
}
}{
"servers": {
"mcp": {
"type": "sse",
"url": "https://mlab.sh/mcp"
}
}
}This endpoint answered with an authorization challenge. The server is running, and it signs you in through your browser: there is no API key to paste.
Endpoints
| URL | Transport | State | Latency | Checked |
|---|---|---|---|---|
| https://mlab.sh/mcp | sse | sign-in | 146 ms | 11 min ago |
Alternatives to mlab.sh
same job, measured the same wayReputation for IPs, domains, URLs, hashes, emails, phones; CVEs; injection and email scans
Threadlinqs threat-intelligence MCP — 49 tools: threats, detections, IOCs, actors, C2, MITRE, CVEs
Threadlinqs threat-intelligence MCP — 73 tools: threats, detections, IOCs, actors, C2, MITRE, CVEs
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
MCP server for AlienVault OTX threat intelligence: indicators, pulses, search, and users.
Pulsedive MCP — threat-intelligence IOC enrichment (pulsedive.com)
VulnCheck exploit intelligence — CVE research, exploit data, advisories, and threat analysis.
Threat-intelligence verdicts on a URL, domain or IP before a coding agent connects to it.
mlab.sh — questions
Answers built from our own checks of this server.