- Crowdsentinel @thomasxm/crowdsentinel-mcp-serverAI threat hunting & incident response for Elasticsearch/OpenSearch with endpoint & network forensics6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.209 GitHub stars.
- Shodan @w0h1v/shodanMCP server for Shodan API — device search, IP lookup, DNS, and CVE/CPE queries.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.174 GitHub stars.
- VirusTotal @burtthecoder/virustotalMCP server for querying VirusTotal API with comprehensive security analysis tools.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.150 GitHub stars.
- Cybersec Toolkit @26zl/cybersec-toolkitAuthorization-gated MCP server to discover and run 670+ security tools for CTF, pentest, and DFIR.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.69 GitHub stars.
- ZettelForge @rolandpg/zettelforgeAgentic memory for cyber threat intelligence. STIX graphs, actor aliasing, offline RAG, Sigma/YARA.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.65 GitHub stars.
- Proofpoint MCP @servosity/proofpoint-mcpProofpoint TAP threats, VAPs, clickers, and IOCs from your terminal, with a local threat store.8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from MCPB.47 GitHub stars.
- AynOps @aynops/aynopsAynOps is a reconnaissance focused MCP Server which gives reconnaissance capabilities to AI Clients18% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.27 GitHub stars.
- Operant @operantlabs/operant-mcpSecurity testing MCP server for penetration testing, forensics, and vulnerability assessment12% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.25 GitHub stars.
- Cyberbro MCP Server @stanfrbd/mcp-cyberbroMCP server for Cyberbro IOC extraction, enrichment and reputation analysis.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.19 GitHub stars.
- MITRE ATT&CK @luongnv89/mitre-mcpMCP server exposing the MITRE ATT&CK framework via the official MCP Python SDK.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.15 GitHub stars.
- Ntobjmanager @lupingqaq/ntobjmanager-mcpStateful Windows RPC attack-surface research for AI agents: 22 tools on NtObjectManager.Not assessed yet.Runs on your machine, installed from a package registry.14 GitHub stars.
- VulnCheck @vulncheck-oss/mcpVulnCheck exploit intelligence — CVE research, exploit data, advisories, and threat analysis.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.10 GitHub stars.
- HackTricks MCP Server @xplo8e/hacktricks-mcp-serverSearch and query HackTricks pentesting documentation with quick lookup and section extraction14% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.10 GitHub stars.
- Clearfront @clearfront/clearfrontOSINT sweep of a digital footprint: breaches, accounts, data brokers, domains and IPs17% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.9 GitHub stars.
- Threatintel @aplaceforallmystuff/mcp-threatintelUnified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.8 GitHub stars.
- Proofpoint @wyre-ai/proofpoint-mcpMCP server for Proofpoint TAP — threat intelligence, forensics, quarantine, and email security.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.5 GitHub stars.
- Proofpoint @wyre-technology/proofpoint-mcpMCP server for Proofpoint TAP — threat intelligence, forensics, quarantine, and email security.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.5 GitHub stars.
- MITRE Attack @imouiche/mitre-attack-mcp-serverMCP server providing 50+ tools for MITRE ATT&CK techniques, groups, and mitigations11% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.5 GitHub stars.
- DugganUSA CLI — Local STDIO MCP @pduggusa/dugganusa-cliLocal STDIO MCP for DugganUSA threat intel. 1.13M IOCs. Read-only. npm: dugganusa-cli.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2 GitHub stars.
- BeVigil OSINT @santhosh-005/bevigilDiscover mobile app attack surfaces via BeVigil OSINT — hosts, subdomains, URLs, and more.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- Cybersec @xu-c0/cybersec-mcpCybersecurity MCP server: 323 prompts + 7 workflows for red team, blue team, SOC, cloud, OSINT.12% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
Threat intelligence MCP servers
A server here threat feeds, malicious IPs or domains, attacker techniques or OSINT investigations.
Not here: news in general.
187 remote115 localTagged by Odel's AI, which can make mistakes
Most popular in Threat intelligence
By GitHub stars, at most two per publisher- Number 1: Robin: AI-Powered Dark Web OSINT@apurvsinghgautam/robinDark web OSINT over Tor: search onion engines, scrape pages, report with your own model.12% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.7,493 GitHub stars.
- Number 2: Jshookmcp@vmoranv/jshookmcpSearch-first MCP server for JavaScript reverse engineering: 735 tools across 36 domains.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2,035 GitHub stars.
- Number 3: OpenOSINT@openosint/openosintAI-powered OSINT agent & MCP server. 21 tools: email, breach, IP, WHOIS, DNS, Shodan, GitHub & more.11% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.1,744 GitHub stars.
