jalacloud/mcp-cti

开发工具

本页由 AI 翻译，技术细节请以原文为准。查看原文

27 stars 5 forks 质量 67 趋势 11MIT

Repository Install

用于实验和测试 CTI 相关研究的 MCP 服务器构建仓库。

概览

一个MCP（模型上下文协议）服务器，用于直接在Claude中访问AlienVault开放威胁交易所（OTX）威胁情报。该服务器连接AlienVault的OTX DirectConnect API，使Claude桌面客户端能够搜索、检索和分析网络威胁情报数据。使用该工具通过Claude的自然语言提示与OTX API交互。安装此MCP服务器后，您可以访问最新的威胁数据，包括： * 威胁情报脉冲 * 入侵迹象（IOC） * 恶意IP地址、域名和网址 * 恶意软件文件哈希 * 威胁行为者信息 * 实时威胁情报：访问AlienVault OTX全球社区的最新威胁数据 * 全面的IOC分析：检查IP、域名、URL或文件哈希是否已知为恶意 * 威胁行为者画像：检索已知威胁行为者及其活动信息 * 缓存结果：通过本地缓存API优化性能......

概述（AI 翻译）

一个MCP（模型上下文协议）服务器，用于直接在Claude中访问AlienVault开放威胁交易所（OTX）威胁情报。

概述

该服务器连接AlienVault的OTX DirectConnect API，使Claude桌面客户端能够搜索、检索和分析网络威胁情报数据。使用该工具通过Claude的自然语言提示与OTX API交互。安装此MCP服务器后，您可以访问最新的威胁数据，包括：

威胁情报脉冲
妥协指标（IOC）
恶意IP地址、域名和URL
恶意软件文件哈希值
威胁行为者信息

特色

实时威胁情报：访问来自AlienVault OTX全球社区的最新威胁数据
全面的IOC分析：检查IP地址、域名、URL或文件哈希值是否已知为恶意
威胁行为者画像：检索已知威胁行为者及其活动的信息
缓存结果：通过本地缓存API响应优化性能
异步API：采用现代异步Python构建，以高效处理API请求

提供工具

工具名称	说明

本页由 AI 翻译，技术细节请以原文为准。

README

以下为原文 README 节选，完整内容请查看原文。

otx-cti MCP Server

An MCP (Model Context Protocol) server for accessing AlienVault Open Threat Exchange (OTX) threat intelligence directly in Claude.

Overview

This server connects to AlienVault’s OTX DirectConnect API, allowing the Claude for desktop client to search, retrieve, and analyse cyber threat intelligence data. Use this tool to interact with the OTX API using natural language prompting via Claude. By installing this MCP server, you get access to the most recent threat data, including:

Threat intelligence pulses
Indicators of compromise (IOCs)
Malicious IP addresses, domains, and URLs
Malware file hashes
Threat actor information

Features

Real-time Threat Intelligence: Access the latest threat data from AlienVault OTX’s global community
Comprehensive IOC Analysis: Check if IPs, domains, URLs, or file hashes are known to be malicious
Threat Actor Profiling: Retrieve information about known threat actors and their activities
Cached Results: Optimised performance with local caching of API responses
Asynchronous API: Built with modern async Python for efficient handling of API requests

Tools Provided

Tool Name	Description
`search_pulses`	Search for threat intelligence pulses in OTX
`get_recent_pulses`	Get recent threat intelligence pulses
`get_pulse_details`	Get detailed information about a specific pulse
`get_pulse_indicators`	Get indicators of compromise (IOCs) from a specific pulse
`get_indicator_details`	Get detailed information about a specific indicator
`check_indicator_malicious`	Check if an indicator is known to be malicious
`get_threat_actor`	Get information about a specific threat actor

Installation

Prerequisites

Python 3.8 or higher
An AlienVault OTX account and API key (Sign up here)
uv package manager (recommended) or pip

Set Up Using UV (Recommended)

Clone this repository:

git clone https://github.com/your-username/otx-mcp-server.git
cd otx-mcp-server

Create a Python environment and install dependencies:

uv venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate
uv pip install -e

Set Up Using Pip

Clone this repository:

git clone https://github.com/your-username/otx-mcp-server.git
cd otx-mcp-server

Create a Python environment and install dependencies:

python -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate
pip install -e

Quick install with Claude Desktop

Add the following to your Claude Desktop configuration (claude_desktop_config.json):

  "mcpServers": {
    "otx": {
      "command": "uv",
      "args": [
        "--directory",
        "/path/to/otx-mcp-server",
        "run",
        "otx"
      ],
      "env": {

在 GitHub 查看完整 README

安装

This server does not publish a one-line install command.

Open the repository installation guide 新手？先看 mcpskill.org 教程 →

配置

"mcpServers": {
    "otx": {
      "command": "uv",
      "args": [
        "--directory",
        "/path/to/otx-mcp-server",
        "run",
        "otx"
      ],
      "env": {
        "OTX_API_KEY": "YOUR_API_KEY_HERE"
      }
    }
  }
}