- Crowdsentinel @thomasxm/crowdsentinel-mcp-serverAI threat hunting & incident response for Elasticsearch/OpenSearch with endpoint & network forensics6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.209 GitHub stars.
- Shodan @w0h1v/shodanMCP server for Shodan API — device search, IP lookup, DNS, and CVE/CPE queries.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.174 GitHub stars.
- VirusTotal @burtthecoder/virustotalMCP server for querying VirusTotal API with comprehensive security analysis tools.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.150 GitHub stars.
- Cybersec Toolkit @26zl/cybersec-toolkitAuthorization-gated MCP server to discover and run 670+ security tools for CTF, pentest, and DFIR.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.69 GitHub stars.
- ZettelForge @rolandpg/zettelforgeAgentic memory for cyber threat intelligence. STIX graphs, actor aliasing, offline RAG, Sigma/YARA.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.65 GitHub stars.
- Proofpoint MCP @servosity/proofpoint-mcpProofpoint TAP threats, VAPs, clickers, and IOCs from your terminal, with a local threat store.8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from MCPB.47 GitHub stars.
- ContrastAPI @contrastcyber/api55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.10% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.33 GitHub stars.
- AynOps @aynops/aynopsAynOps is a reconnaissance focused MCP Server which gives reconnaissance capabilities to AI Clients18% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.27 GitHub stars.
- Operant @operantlabs/operant-mcpSecurity testing MCP server for penetration testing, forensics, and vulnerability assessment12% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.25 GitHub stars.
- Cyberbro MCP Server @stanfrbd/mcp-cyberbroMCP server for Cyberbro IOC extraction, enrichment and reputation analysis.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.19 GitHub stars.
- VirusTotal @virustotal/virustotal-mcpOfficial VirusTotal MCP server: threat reports, file and URL submissions, and analysis recovery.4% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.18 GitHub stars.
- MITRE ATT&CK @luongnv89/mitre-mcpMCP server exposing the MITRE ATT&CK framework via the official MCP Python SDK.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.15 GitHub stars.
- Domain Intelligence @oti-labs/domain-intelligenceWHOIS/RDAP, DNS, SSL, live subdomains with IPs, and SPF/DMARC/DKIM for any domain.8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.14 GitHub stars.
- Ntobjmanager @lupingqaq/ntobjmanager-mcpStateful Windows RPC attack-surface research for AI agents: 22 tools on NtObjectManager.Not assessed yet.Runs on your machine, installed from a package registry.14 GitHub stars.
- VulnCheck @vulncheck-oss/mcpVulnCheck exploit intelligence — CVE research, exploit data, advisories, and threat analysis.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.10 GitHub stars.
- HackTricks MCP Server @xplo8e/hacktricks-mcp-serverSearch and query HackTricks pentesting documentation with quick lookup and section extraction14% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.10 GitHub stars.
- Clearfront @clearfront/clearfrontOSINT sweep of a digital footprint: breaches, accounts, data brokers, domains and IPs17% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.9 GitHub stars.
- Threatintel @aplaceforallmystuff/mcp-threatintelUnified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.8 GitHub stars.
- PhoneInfoga - International Phone Number OSINT @anshumanatrey/phoneinfoga-phone-osintPhoneInfoga - International Phone Number OSINT19% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.5 GitHub stars.
- Proofpoint @wyre-ai/proofpoint-mcpMCP server for Proofpoint TAP — threat intelligence, forensics, quarantine, and email security.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.5 GitHub stars.
- Proofpoint @wyre-technology/proofpoint-mcpMCP server for Proofpoint TAP — threat intelligence, forensics, quarantine, and email security.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.5 GitHub stars.
Threat intelligence MCP servers
A server here threat feeds, malicious IPs or domains, attacker techniques or OSINT investigations.
Not here: news in general.
187 remote115 localTagged by Odel's AI, which can make mistakes
Most popular in Threat intelligence
By GitHub stars, at most two per publisher- Number 1: Robin: AI-Powered Dark Web OSINT@apurvsinghgautam/robinDark web OSINT over Tor: search onion engines, scrape pages, report with your own model.12% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.7,493 GitHub stars.
- Number 2: Jshookmcp@vmoranv/jshookmcpSearch-first MCP server for JavaScript reverse engineering: 735 tools across 36 domains.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2,035 GitHub stars.
- Number 3: OpenOSINT@openosint/openosintAI-powered OSINT agent & MCP server. 21 tools: email, breach, IP, WHOIS, DNS, Shodan, GitHub & more.11% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.1,744 GitHub stars.
