Threatfox MCP Server: Install & Setup

Install Threatfox in Claude Code

Claude Code

claude mcp add --transport http threatfox https://gateway.pipeworx.io/threatfox/mcp

mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)

{
  "mcpServers": {
    "threatfox": {
      "url": "https://gateway.pipeworx.io/threatfox/mcp"
    }
  }
}

Claude Code

claude mcp add threatfox -- npx -y @pipeworx/mcp-threatfox

mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)

{
  "mcpServers": {
    "threatfox": {
      "command": "npx",
      "args": [
        "-y",
        "@pipeworx/mcp-threatfox"
      ]
    }
  }
}

ThreatFox MCP — abuse.ch indicator-of-compromise feed (free, key required)

Yes, most likely. Open source and no paid account or API key is mentioned in the listing. Check the provider for current pricing.

Local + Remote. Can run locally or be used as a hosted remote server.

Run: claude mcp add --transport http threatfox https://gateway.pipeworx.io/threatfox/mcp

semgrep/semgrep/mcp

Scan code for security vulnerabilities using Semgrep.

mrexodia/ida-pro-mcp

IDA Pro plugin for binary analysis: decompilation, disassembly and automatic malware analysis reports.

LaurieWired/GhidraMCP

Autonomous reverse engineering with Ghidra: decompile binaries, rename methods and data, and list methods, classes, imports and exports.

nowork-studio/notfair-plugin

OAuth MCP for Google, Meta, X, LinkedIn, Reddit, TikTok, GSC, GA4, WordPress and GHL.

zinja-coder/jadx-ai-mcp

JADX decompiler plugin providing live, LLM-assisted reverse engineering.

ENTERPILOT/GoModel

Self-hosted gateway aggregating upstream MCP servers behind one authenticated HTTP endpoint.