detection-engineering MCP servers

4 tagged detection-engineering, measured the same way as everything else here.

huntable-cti-studio

01

dfirtnt/Huntable-CTI-Studio

MCP server Claude CodeCodexCursor +2

MCP server "huntable-cti-studio" as configured in dfirtnt/Huntable-CTI-Studio. Launched with bash scripts/run_mcp_server.sh.

not rated 11 +1 3d ago A tokens not measured original MIT

badchars/living-off-the-land-lolbins-mcp-server

MCP server Claude CodeCodexCursor +2

Living off the Land binaries MCP server — GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, LOLESXi, LOTP, LOLC2, WADComs intelligence with attack graph reasoning, privilege escalation paths, defense evasion, detection engineering. Runs locally from the living-off-the-land-lolbins-mcp-server npm package.

not rated 1 12d ago A tokens not measured original MIT

threadlinqs-cmd/intelthreadlinqs-mcp

MCP server Claude CodeCodexCursor +2

Threadlinqs threat-intelligence MCP — 73 tools: threats, detections, IOCs, actors, C2, MITRE, CVEs. Runs locally from the intelthreadlinqs-mcp npm package. Needs 2 environment variables to run.

not rated 0 1mo ago A tokens not measured original MIT

threatintel-mcp

04

ChristianPresley/threatintel-mcp

MCP server Claude CodeCodexCursor +2

MCP server "threatintel-mcp" as configured in ChristianPresley/threatintel-mcp. Runs locally from the threatintel-mcp Python package.

not rated 0 27d ago A tokens not measured original MIT