agentmods.dev

intelthreadlinqs-mcp

A locally run connection to Threadlinqs, a cyber-threat intelligence service covering threats, detections, indicators, attackers, malware infrastructure, and software vulnerabilities.

In plain words
What is it for?
Investigating threats, detections, indicators of compromise, attackers, command-and-control infrastructure, MITRE ATT&CK techniques, and CVEs.
Why use it?
It gives security work access to threat data and investigation tools without requiring a separately hosted setup, but it needs an API key and URL.

MCP server for Claude CodeCodexCursorGemini CLIOpenCode

0 9d ago A scan tokens not measured original MIT
View the source file threadlinqs-cmd/intelthreadlinqs-mcp
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add mcp/threadlinqs-cmd/intelthreadlinqs-mcp/intelthreadlinqs-mcp
Clone the repo
git clone --depth 1 https://github.com/threadlinqs-cmd/intelthreadlinqs-mcp

Made for: Claude Code, Codex, Cursor, Gemini CLI, OpenCode.

Per session not measured What this adds to a session before it is invoked.
When invoked not measured Not applicable: nothing here is loaded into a session.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Security

Grade A, and why

intelthreadlinqs-mcp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

server.json · 13 lines

What it actually says

{
  "intelthreadlinqs-mcp": {
    "command": "npx",
    "args": [
      "-y",
      "intelthreadlinqs-mcp"
    ],
    "env": {
      "THREADLINQS_API_KEY": "",
      "THREADLINQS_API_URL": ""
    }
  }
}
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 13 lines scan A 258a59334183

Subscribe to this mod's changes

intelthreadlinqs-mcp is an MCP server published in the GitHub repository threadlinqs-cmd/intelthreadlinqs-mcp (0 stars, last pushed 9d ago), licensed MIT. Its token cost is not measured: an MCP server costs its tool schemas, not its config file. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Securitycybersecuritydetection-engineeringiocmcpmitre-attackmodel-context-protocol
Related

Other mcp servers, from other repositories

threatintel-mcp

MCP server "threatintel-mcp" as configured in ChristianPresley/threatintel-mcp. Runs locally from the threatintel-mcp Python package.

ChristianPresley/threatintel-mcp · not measured

huntable-cti-studio

MCP server "huntable-cti-studio" as configured in dfirtnt/Huntable-CTI-Studio. Launched with bash scripts/run_mcp_server.sh.

dfirtnt/Huntable-CTI-Studio · not measured

mcp-threatintel

Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker. Runs locally from the mcp-threatintel-server npm package. Needs 4 environment variables to run.

aplaceforallmystuff/mcp-threatintel · not measured

aegisforge

MCP server "aegisforge" as configured in sunilgentyala/AegisForge-MCP. Launched with cargo run --manifest-path mcp-server/Cargo.toml --release --. Needs 1 environment variable to run.

sunilgentyala/AegisForge-MCP · not measured

mcp-tool-security-inspector

MCP server "mcp-tool-security-inspector" as configured in danveil/mcp-security-inspector. Runs locally from the mcp-tool-security-inspector Python package.

danveil/mcp-security-inspector · not measured

pentest-mcp-server

Offline methodology engine for authorized penetration testing, CTF, and security research. Runs locally from the @cyanheads/pentest-mcp-server npm package. Needs 1 environment variable to run.

cyanheads/pentest-mcp-server · not measured