threat intelligence mcp servers

13 tagged threat intelligence, measured the same way as everything else here.

misp-mcp

01

MISP/misp-mcp

MCP server Claude CodeCodexCursor

MCP server "misp-mcp" as configured in MISP/misp-mcp. Runs locally from the misp-mcp Python package.

9 2mo ago A tokens not measured

mallorymcp

02

malloryai/mallorymcp

MCP server Claude CodeCodexCursor +2

Deprecated — use the Mallory Remote MCP service: https://docs.mallory.ai/use/agent/mcp. Runs locally from the mallorymcp Python package.

8 2mo ago A tokens not measured original Apache-2.0 archived

data

03

RTKMotion/motion-intelligence

MCP server Claude CodeCodexCursor

Mocap, rehab biomechanics, threat intel, fleet vision. 21 MCP tools, 10 free. x402/USDC paid. Remote server at api.rtkmotion.io.

1 27d ago A tokens not measured original MIT

phishunt

04

0xDanielLopez/phishunt-mcp

MCP server Claude CodeCodexCursor

Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0. Remote server at mcp.phishunt.io.

1 5d ago A tokens not measured original MIT

scry

05

TunnelMind/scry-mcp

MCP server Claude CodeCodexCursor

Free IPv4 lookups against a distributed attacker-observation corpus. Remote server at mcp.tunnelmind.ai.

0 3mo ago A tokens not measured archived

tweetfeed

06

0xDanielLopez/tweetfeed-mcp

MCP server Claude CodeCodexCursor

IOCs (URLs, domains, IPs, hashes) shared by the infosec community on X/Twitter. No auth, CC0. Remote server at mcp.tweetfeed.live.

0 3d ago A tokens not measured original MIT

agentrisk

07

Neurobyteio/agentrisk

MCP server Claude CodeCodexCursor

Pre-trade token risk scoring API for Base tokens, paid via x402. Remote server at agentrisk.dev.

0 yesterday A tokens not measured

truesignal

08

RudrenduPaul/truesignal

MCP server Claude CodeCodexCursor

Provenance-first OSINT/security intelligence feed CLI. Every item ships a real source URL, a real timestamp, and an explicit live/fallback flag -- never a fabricated or silently-replayed data point. Runs locally from the truesignal-cli Python package.

0 7d ago A tokens not measured original MIT

nullcone

09

maco144/nullcone-mcp

MCP server Claude CodeCodexCursor

Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats. Remote server at nullcone.ai.

0 1mo ago A tokens not measured

greynoise

10

nickjlucker/mcp-greynoise

MCP server Claude CodeCodexCursor

MCP server for GreyNoise API - Check if IPs are internet background noise or targeted attacks. Runs locally from the mcp-greynoise npm package. Needs 1 environment variable to run.

0 6mo ago A tokens not measured original MIT

axur-mcp

11

just5ky/axur-mcp

MCP server Claude CodeCodexCursor +2

MCP server "axur-mcp" as configured in just5ky/axur-mcp. Runs locally from the axur-mcp npm package.

0 1mo ago A tokens not measured original MIT

urlscan-mcp

12

blackhole8080-darkmatter/urlscan-mcp

MCP server Claude CodeCodexCursor +2

MCP server "urlscan-mcp" as configured in blackhole8080-darkmatter/urlscan-mcp. Runs locally from the urlscan-mcp Python package.

0 7d ago A tokens not measured original MIT

beepboop2025/data-breach-detector

MCP server Claude CodeCodexCursor +2

Read-only breach-intelligence MCP: reports THAT an organization was breached and which data types leaked, across full history from public feeds (HaveIBeenPwned, RansomLook, ransomwatch archive, SEC 8-K 1.05). Never the leaked data. Runs locally from the data-breach-detector Python package.

0 10d ago A tokens not measured original MIT