Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker
Use this profile to copy client config, check auth requirements, review tools and resources, and compare related MCP servers before adding it to an AI client.
npx -y mcp-threatintel-server{
"OTX_API_KEY": "YOUR_SECRET_VALUE",
"ABUSEIPDB_API_KEY": "YOUR_SECRET_VALUE",
"GREYNOISE_API_KEY": "YOUR_SECRET_VALUE",
"ABUSECH_AUTH_KEY": "YOUR_SECRET_VALUE"
}Add this server entry to the mcpServers object in your Claude Desktop config, then restart the app.
{
"mcpServers": {
"io-github-aplaceforallmystuff-mcp-threatintel": {
"command": "npx",
"args": [
"-y",
"mcp-threatintel-server"
],
"env": {
"OTX_API_KEY": "YOUR_SECRET_VALUE",
"ABUSEIPDB_API_KEY": "YOUR_SECRET_VALUE",
"GREYNOISE_API_KEY": "YOUR_SECRET_VALUE",
"ABUSECH_AUTH_KEY": "YOUR_SECRET_VALUE"
}
}
}
}~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.jsonNo remote HTTP endpoint is advertised. Use the package or stdio setup shown in Install.
mcp-threatintel is an MCP server for Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker. It supports STDIO transport.
Use the generated config in Install. This server runs with npx -y mcp-threatintel-server; add any required environment variables before starting your client.
Choose the Claude Desktop tab in Install and copy the config for npx -y mcp-threatintel-server. Add required environment variables before starting Claude Desktop.
Choose the Claude Code tab in Install and copy the config for npx -y mcp-threatintel-server. Add required environment variables before starting Claude Code.
Choose the Codex tab in Install and copy the config for npx -y mcp-threatintel-server. Add required environment variables before starting Codex.
Choose the Cursor or VS Code tab in Install and copy the config for npx -y mcp-threatintel-server. Add required environment variables before starting Cursor or VS Code.
mcp-threatintel uses STDIO transport. Use the package or command config in Install.
mcp-threatintel inventory is listed when the MCP endpoint exposes tools, resources, or prompts. Some servers require auth first.
mcp-threatintel does not advertise a verified auth requirement. If discovery fails, it may still need provider login, an API key, a bearer token, or a session header.
| Package | Registry | Version | Inputs |
|---|---|---|---|
mcp-threatintel-serverstdio | npm | 1.0.1 | Env: OTX_API_KEY secret Env: ABUSEIPDB_API_KEY secret Env: GREYNOISE_API_KEY secret Env: ABUSECH_AUTH_KEY secret |