Local + RemoteFree server, account needed

Threat Intelligence MCP server

Jam0k/Threat-Intelligence-MCP

Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.

3 GitHub stars214 npm downloads / month

Install Threat Intelligence in Claude Code

Remote URL

Claude Code
claude mcp add --transport http threat-intelligence https://threatcluster.io/mcp
mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)
{
  "mcpServers": {
    "threat-intelligence": {
      "url": "https://threatcluster.io/mcp"
    }
  }
}

npm

Claude Code
claude mcp add threat-intelligence -e THREATCLUSTER_API_KEY=... -- npx -y threatcluster-mcp
mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)
{
  "mcpServers": {
    "threat-intelligence": {
      "command": "npx",
      "args": [
        "-y",
        "threatcluster-mcp"
      ],
      "env": {
        "THREATCLUSTER_API_KEY": "..."
      }
    }
  }
}

Replace each ... with your own value.

Frequently asked questions

What does the Threat Intelligence MCP server do?

Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.

Is the Threat Intelligence MCP server free?

The server is free, but you will likely need an account. The server itself is free, but it connects to a service that needs an account or API key, which may have paid tiers. Check the provider for current pricing.

Does Threat Intelligence run locally or remotely?

Local + Remote. Can run locally or be used as a hosted remote server.

How do I add Threat Intelligence to Claude Code?

Run: claude mcp add --transport http threat-intelligence https://threatcluster.io/mcp

More security & identity MCP servers

View all