Threat intelligence MCP servers

Provider-side MCP firewall: identity, threat-intel, barter, rate limits, DLP, audit.

Remote MCP firewall with barter protocol: identity, threat-intel, IoC lookup.

Real-time global intelligence across conflict, markets, energy, trade, shipping and cyber. 97 tools.

WatchGuard Cloud Firebox, Endpoint Security, ThreatSync, NDR and AuthPoint APIs for every customer

Proofpoint TAP threats, VAPs, clickers, and IOCs from your terminal, with a local threat store.

MCP server for Teramind's insider-threat/employee-monitoring API (read-only, metadata-only surface).

Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade.

Unofficial threat level from the air for a place in Poland, worked out on your own computer.

Guard Core security MCP: SecurityConfig validation, docs search, live threat detection.

MCP server for Cyberbro IOC extraction, enrichment and reputation analysis.

MCP server for NetIntel — DNS, SSL, WHOIS, email security, OSINT via x402 micropayments

Architecture intelligence, security analysis, and living docs. 15 tools, Mermaid output.

MCP server for Proofpoint TAP — threat intelligence, forensics, quarantine, and email security.

MCP server for querying VirusTotal API with comprehensive security analysis tools.

MCP server for AlienVault OTX threat intelligence: indicators, pulses, search, and users.

Secure MCP server framework with 23 security layers and ML threat detection. Zero deps.

Official VirusTotal MCP server: threat reports, file and URL submissions, and analysis recovery.

MCP server for Mimecast email security: message queue, held messages, domains, and threats.

Security reviews, threat models over a repo or website, and remediation tracking, in your editor.

Screen crypto wallets vs OFAC SDN + threat intel; pre-payment checks, signed receipts; SAR drafts

Abnormal Security MCP: threats, search, remediation, ATO cases, vendor/BEC, and evidence download.

Weavatrix Online extension: guarded sync, advisories, malware review, architecture contracts.

Weavatrix Online extension: guarded sync, advisories, malware review, architecture contracts.

MCP server for Mimecast email security: message queue, held messages, domains, and threats.

MCP server for Blackpoint Cyber MDR — alerts, threats, and operations.

MCP server for Proofpoint TAP — threat intelligence, forensics, quarantine, and email security.

Wraps the truesignal CLI as a single generic MCP tool for threat/connector status checks.

Live honeypot threat intel: attacker IPs, IOCs, credentials, payloads, actors.

Mocap, rehab biomechanics, threat intel, fleet vision. 21 MCP tools, 10 free. x402/USDC paid.

Query Truss threat intelligence via hosted MCP (OAuth). Growth+ plans.

Cited EU & global law, regulations & security frameworks via Ansvar Gateway. OAuth, free + paid.

Live honeypot threat intel: attacker IPs, IOCs, credentials, payloads, actors.

Cybersecurity MCP server: 323 prompts + 7 workflows for red team, blue team, SOC, cloud, OSINT.

Local STDIO MCP for DugganUSA threat intel. 1.13M IOCs. Read-only. npm: dugganusa-cli.

Agentic memory for cyber threat intelligence. STIX graphs, actor aliasing, offline RAG, Sigma/YARA.

Professional network analysis with tshark. Security audits, deep-dives, and threat detection.

MCP server for querying VirusTotal API with comprehensive security analysis tools.

Enterprise code intelligence for M&A, security audits, and tech debt. Hosted server with 200k free.

Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker