- PhoneInfoga - International Phone Number OSINT @anshumanatrey/phoneinfoga-phone-osintPhoneInfoga - International Phone Number OSINT19% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.5 GitHub stars.
- Gitleaks Cloud - GitHub API Key Hunter & Secret Scanner @anshumanatrey/gitleaks-github-secret-scannerGitleaks Cloud - GitHub API Key Hunter & Secret Scanner26% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.3 GitHub stars.
- attAck @smithery/alex-llm-attack-mcp-serverQuery and retrieve information about various adversarial tactics and techniques used in cyber atta…15% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.3 GitHub stars.
- mlab.sh @mlab/mcpThreat intelligence: enrich IOCs (IP, domain, URL, hash), search CVEs and actors, scan SBOMs.8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.2 GitHub stars.
- HoneyLabs @honeylabs/mcpHoneypot probe data: IP reputation, scanners, CVE probing, TLS and SSH fingerprints.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.2 GitHub stars.
- Whisper @whisper-sec/whisperOne routable IPv6 per AI agent, verifiable from the DNS root. Keyless tools need no signup.12% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.2 GitHub stars.
- ThreatCluster @jam0k/threatclusterLive threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.1 GitHub stars.
- Phishunt @0xdaniellopez/phishuntPublic phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.1 GitHub stars.
- WhisperGraph @whisper-sec/whisper-graphThe internet's infrastructure graph for AI agents - 46B nodes and edges, free trial via 2 HTTP calls13% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.1 GitHub stars.
- NetAPI @netapi/mcpDomain data: Top 1M domain ranks, compromised checks, new domain search, registered domain lists.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.
- Brand Lookalike Watch @yzf75011-ui/brand-lookalike-watchPhishing/typosquat domains imitating a brand, from CT logs. Weekly email: $2.99/mo on Gumroad.52% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.
- PG1 Sovereign Threat Intelligence @project-gifted1/pg1-threat-intelThreat intel for AI agents: IOCs, CVEs (EPSS/KEV), wallet sanctions and age, domain and URL checks.7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- HackMyIP — no-key IP intelligence @0xvibly/hackmyip-mcpFree no-key IP intelligence: geolocation, VPN detection, DNS, WHOIS, blacklists, breach checks15% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Truss Threat Intelligence @truss-security/truss-mcpQuery Truss threat intelligence via hosted MCP (OAuth). Growth+ plans.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.
- TweetFeed @0xdaniellopez/tweetfeedIOCs (URLs, domains, IPs, hashes) shared by the infosec community on X/Twitter. No auth, CC0.4% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- vuln-intel @rozetyp/vuln-intelFree hosted CVE intel for bug-bounty agents: CVE fact-check, attack approaches from paid H1 reports19% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Abuseipdb @pipeworx-io/abuseipdbAbuseIPDB MCP — wraps AbuseIPDB v2 API (api.abuseipdb.com/api/v2)8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Cybersecurity Threat Intelligence MCP @foundrynet/cyber-intel-mcpCVE search, vulnerability database, EPSS exploit prediction, KEV, IP reputation & threat feed.12% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Alienvault Otx @pipeworx-io/alienvault-otxAlienVault OTX MCP — Open Threat Exchange (free with key)8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Oracle42 Intelligence @mintmas/oracle42-intelligenceAI-powered threat intelligence, smart contract auditing, and cybersecurity OSINT.18% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Nullcone Threat Intelligence @maco144/nullconeReal-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats10% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
Threat intelligence MCP servers
A server here threat feeds, malicious IPs or domains, attacker techniques or OSINT investigations.
Not here: news in general.
187 remote115 localTagged by Odel's AI, which can make mistakes
Most popular in Threat intelligence
By GitHub stars, at most two per publisher- Number 1: ContrastAPI@contrastcyber/api55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.10% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.33 GitHub stars.
- Number 2: VirusTotal@virustotal/virustotal-mcpOfficial VirusTotal MCP server: threat reports, file and URL submissions, and analysis recovery.4% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.18 GitHub stars.
- Number 3: Domain Intelligence@oti-labs/domain-intelligenceWHOIS/RDAP, DNS, SSL, live subdomains with IPs, and SPF/DMARC/DKIM for any domain.8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.14 GitHub stars.
