Mcp Threatintel

Mcp Threatintel is an open-source Model Context Protocol (MCP) server designed for security researchers, incident responders, and threat analysts. It provides unified access to multiple threat intelligence sources—such as AlienVault OTX, AbuseIPDB, GreyNoise, and various abuse.ch projects—allowing users to query IPs, domains, hashes, and URLs across all configured data feeds from a single interface. Its streamlined queries, context-correlation features, and support for free-tier APIs make it ideal for investigating malicious activity and performing comprehensive threat analysis.