Threat Landscape MCP Server

Connect your AI agent to live threat intelligence. This MCP server gives any MCP-compatible agent — Claude, Cursor, Copilot, or your own — direct access to the Threat Landscape database of STIX 2.1 intelligence bundles and actionable IOCs.

---

What you need

• A Threat Landscape API key (from your account at threatlandscape.io)
• An MCP-compatible AI client (Claude Desktop, Cursor, Windsurf, Continue, or any client that supports remote MCP servers)

No installation. No backend to run. The server is already deployed.

---

Server URL

https://mcp.threatlandscape.io/mcp

---

Your API key

Your Threat Landscape API key authenticates you to this server. It goes in the Authorization header of every MCP connection request — exactly as you would use it with the REST API directly.

Authorization: Bearer tl_your_api_key_here

Keep your key secret. Anyone with your key can query the API on your behalf and consume your rate limit quota.

---

Setup by client

Claude Desktop

Edit your Claude Desktop configuration file:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

Add the following under mcpServers:

{
  "mcpServers": {
    "threat-landscape": {
      "type": "streamable-http",
      "url": "https://mcp.threatlandscape.io/mcp",
      "headers": {
        "Authorization": "Bearer tl_your_api_key_here"
      }
    }
  }
}

Restart Claude Desktop. You should see threat-landscape appear in the tools panel.

---

Cursor

Open Settings → MCP and add a new server:

---

Continue (VS Code / JetBrains)

In your config.json under mcpServers:

{
  "mcpServers": [
    {
      "name": "threat-landscape",
      "transport": {
        "type": "streamable-http",
        "url": "https://mcp.threatlandscape.io/mcp",
        "requestInit": {
          "headers": {
            "Authorization": "Bearer tl_your_api_key_here"
          }
        }
      }
    }
  ]
}

---

Generic / other clients

Any MCP client that supports Streamable HTTP transport can connect. Configure:

• Transport: Streamable HTTP
• URL: https://mcp.threatlandscape.io/mcp
• Header: Authorization: Bearer tl_your_api_key_here

---

Available tools

The server exposes 8 tools split across two APIs.

---

Intelligence API

Full STIX 2.1 threat intelligence — bundles containing threat actors, malware families, campaigns, CVEs, attack patterns, victims, sectors, countries, and IOC arrays.

---

tl_search_bundles