Threat Landscape MCP Server

Connect your AI agent to live threat intelligence. This MCP server gives any MCP-compatible agent — Claude, Cursor, Copilot, or your own — direct access to the Threat Landscape database of STIX 2.1 intelligence bundles and actionable IOCs.

---

What you need

• A Threat Landscape API key (from your account at threatlandscape.io)
• An MCP-compatible AI client (Claude Desktop, Cursor, Windsurf, Continue, or any client that supports remote MCP servers)

No installation. No backend to run. The server is already deployed.

---

Server URL

https://mcp.threatlandscape.io/mcp

---

Your API key

Your Threat Landscape API key authenticates you to this server. It goes in the Authorization header of every MCP connection request — exactly as you would use it with the REST API directly.

Authorization: Bearer tl_your_api_key_here

Keep your key secret. Anyone with your key can query the API on your behalf and consume your rate limit quota.

---

Setup by client

Claude Desktop

Edit your Claude Desktop configuration file:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

Add the following under mcpServers:

{
  "mcpServers": {
    "threat-landscape": {
      "type": "streamable-http",
      "url": "https://mcp.threatlandscape.io/mcp",
      "headers": {
        "Authorization": "Bearer tl_your_api_key_here"
      }
    }
  }
}

Restart Claude Desktop. You should see threat-landscape appear in the tools panel.

---

Cursor

Open Settings → MCP and add a new server:

---

Continue (VS Code / JetBrains)

In your config.json under mcpServers:

{
  "mcpServers": [
    {
      "name": "threat-landscape",
      "transport": {
        "type": "streamable-http",
        "url": "https://mcp.threatlandscape.io/mcp",
        "requestInit": {
          "headers": {
            "Authorization": "Bearer tl_your_api_key_here"
          }
        }
      }
    }
  ]
}

---

Generic / other clients

Any MCP client that supports Streamable HTTP transport can connect. Configure:

• Transport: Streamable HTTP
• URL: https://mcp.threatlandscape.io/mcp
• Header: Authorization: Bearer tl_your_api_key_here

---

Available tools

The server exposes 8 tools split across two APIs.

---

Intelligence API

Full STIX 2.1 threat intelligence — bundles containing threat actors, malware families, campaigns, CVEs, attack patterns, victims, sectors, countries, and IOC arrays.

---

tl_search_bundles

Flexible search across all intelligence bundles. Use this when you need a custom query that the workflow tools don’t cover — filter by any combination of fields, date ranges, and array containment conditions.

Key parameters:

• filters — structured filter object (threat actors, malware, vulnerabilities, sectors, countries, date ranges, IOC values, and more)
• order — sort column and direction, e.g. stix_latest_at.desc
• limit — number of results (default 10, max 200)
• offset — for pagination

Example prompts:

“Query darknet intelligence over the last 30 days involving targeting of the Finance sector” “Find all intelligence reports that extract the SHA-256 artifact abc123…”

---

tl_get_bundle

Retrieve the complete STIX 2.1 bundle for a specific bundle_id. Returns the full object graph — every threat actor, malware, indicator, relationship, and report object.

When to use: After identifying a bundle via a search or workflow tool, use this to pull the full structured STIX payload for deep analysis or export.

---

tl_get_threat_intel

Search threat intelligence by combining any of the following filters in a single call — all provided filters are ANDed together. Use this for any structured threat query: actor, malware, CVE, sector, country, TTP, campaign, victim, source type, or any combination of these.

Parameters (all optional, AND-ed):

• threat_actor — exact actor name, e.g. APT29, Lazarus Group
• malware_family — exact family name, e.g. Cobalt Strike, BlackCat
• cve — CVE ID or name, e.g. CVE-2025-27152
• ttp — MITRE ATT&CK ID or name, e.g. T1059, Valid Accounts
• campaign — campaign name, e.g. Volt Typhoon
• victim — victim organization or identity name
• sector — industry sector, e.g. Finance, Energy (exact match; values vary)
• countries — list of country names (exact match), e.g. ["United States of America", "Germany"]
• country_direction — target / source / both (default both)
• source_type — osint or darknet
• since — ISO 8601 timestamp; only bundles modified after this date
• limit — number of results (default 10, max 100)

Example prompts:

“What malware is targeting the Finance sector in the United States?” “Provide recent C2 and infrastructure IOCs associated with Lazarus Group” “Extract the last 3 months of intelligence regarding APT29 tactics” “Which threat actors have deployed Cobalt Strike beacons in recent intrusions?” “Which actors are actively exploiting CVE-2025-27152 in the wild?” “Pull the 20 most recent extortion posts from darknet ransomware leak sites” “Has ‘SolarWinds’ been targeted or compromised in recent attacks?” “Which threat actors actively use T1136.001 (Local Accounts) for persistence?”

---

tl_free_text_search

Search threat intelligence natively via keyword across title, summary, and all extracted semantic arrays (threat actors, malware, campaigns, TTPs, vulnerabilities, victims, sectors, and countries).

Parameters: keyword, limit

Example prompts:

“Search for mentions of ‘NTDS.dit extraction’ or credential dumping” “Are there any reports discussing ‘golden SAML’ forging?” “Find intelligence discussing ‘Living off the Land’ tactics”

---

IOC API

Lean indicator feeds for automated ingestion and real-time lookups. Each IOC is deduplicated by value — the same indicator is never stored twice.

---

tl_lookup_ioc

Check whether a specific value is a known Threat Landscape IOC. Provide the ioc_type for a faster active-only lookup; omit it to search the full history including expired indicators.

Parameters: ioc_value, ioc_type (optional)

Example prompts:

“Query the database for the C2 IP 198.51.100.42 to identify active campaigns” “Check if the domain evil.example.com is an active staging or exfiltration node” “Validate this suspicious SHA-256 hash against known malware payloads: e3b0c44…”

---

tl_get_active_iocs

Fetch currently active IOCs — indicators where valid_until is in the future. Optionally filter to a specific type (ipv4, domain, url, hash_sha256, etc.). Use for bulk ingestion into SIEMs, EDRs, or blocklists.

Parameters: ioc_type (optional), limit, order

Example prompts:

“Retrieve all active malicious domains for SIEM DNS sinkholing” “Export the current active IPv4 blocklist for firewall edge blocking”

---

tl_ioc_sync

Incremental sync using a seq_id watermark — designed for automated pipelines. Call with since_seq_id=0 for the initial full sync; save the returned next_since_seq_id and pass it on the next run to receive only new records.

Parameters: since_seq_id, limit

Use case: Automated nightly jobs, SIEM integration pipelines, blocklist refresh scripts.

---

tl_ioc_context

Retrieve the full STIX 2.1 indicator bundle for a specific IOC value — includes the STIX pattern, valid_from, valid_until, TLP markings, and the source_bundle_id that links back to the full intelligence bundle.

Parameters: ioc_value

Example prompts:

“Retrieve the STIX pattern and TLP markings for the domain evil.example.com” “Pivot from this IPv4 indicator to trace its source report and threat context”

---

Example agent session

Below is a realistic multi-step threat intelligence workflow using the tools:

Prompt: “I need a threat brief on ransomware targeting US healthcare. Include any active IOCs and relevant CVEs.”

1. Agent calls tl_get_threat_intel with sector="Health", countries=["United States of America"], source_type="darknet", since="2026-01-01T00:00:00Z"
2. Agent correlates results, identifies top ransomware groups and CVEs from the metadata
3. Agent calls tl_get_bundle for the most relevant report to inspect the full STIX graph
4. Agent calls tl_get_active_iocs with ioc_type="domain" to pull current active indicators
5. Agent composes a structured brief with actors, campaigns, CVEs, and a live IOC list

---

Rate limits & quotas

Rate limits are enforced by your Threat Landscape API subscription tier. The MCP server does not impose additional limits. If you hit a rate limit, the tool will return an actionable error message.

---

Troubleshooting

“Unauthorized” error when connecting → Check that your API key is correct and hasn’t expired. The key must match the format Authorization: Bearer exactly.

Tool returns no results → The query returned zero matching records — not an error. Try broadening filters (remove date constraints, check spelling of actor/malware names).

“Rate limited” error → You’ve exceeded your plan’s request quota. Reduce frequency or contact support to upgrade.

Tools don’t appear in my client → Some clients require a restart after adding a new MCP server. Ensure the Authorization header is configured correctly — the server returns 401 before the MCP handshake completes if the key is missing.

---

© Threat Landscape — threatlandscape.io. All rights reserved.