pete-builds

MCP Threatintel — Security skill for Claude Code

Security community

Threat intelligence MCP server for Claude Code.

How to install MCP Threatintel

This entry records only its repository, not the path inside it, so there is no exact command to give. Open pete-builds/mcp-threatintel and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What MCP Threatintel does

Threat intelligence MCP server for Claude Code. IOC lookups, CVE checks, breach monitoring, dark web search, and OTX pulses.

Alternatives in Security

Trail Of Bits Claude-code-config — Opinionated production defaults from a top security firm: sandboxing, permissions, hooks, skills, MCP server c 1.6k ★
Cve MCP Server — Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS sco 1.2k ★
Google MCP Security Servers — Security Operations and Threat Intelligence MCP servers 453 ★

README

mcp-threatintel

A threat intelligence MCP server for [Claude Code](https://claude.com/claude-code). Gives Claude tools to look up IOCs, search threat feeds, check breached credentials, query CVEs, and search the dark web.

Built with [FastMCP](https://github.com/jlowin/fastmcp) and SQLite. Feeds are synced locally by a background poller so lookups are fast and don't depend on external API availability.

Tools

Tool	What it does
`lookup_ioc`	Check an IP, domain, hash, or URL against all threat feeds
`search_threats`	Full-text search across IOCs, OTX pulses, and CVEs
`get_recent_threats`	What's been added in the last N hours
`lookup_cve`	Check if a CVE is in the CISA Known Exploited Vulnerabilities catalog
`get_feed_status`	Show sync status and record counts for all feeds
`search_pulses`	Search AlienVault OTX community threat pulses
`check_breach`	Check LeakCheck for breached credentials by email, domain, username, or hash
`check_domain_breaches`	Check all known breaches for a domain
`search_darkweb`	Search Ahmia.fi's index of Tor hidden services
`check_password_breach`	Check if a password has been exposed (HIBP k-anonymity, free, password never leaves machine)
`check_email_breaches`	Check if an email is in any known breach via HIBP
`get_latest_breach`	Get the most recently added breach from HIBP

Data Sources

Source	What it provides	Auth	Cost
abuse.ch (URLhaus, MalwareBazaar, ThreatFox, Feodo)	Malware URLs, hashes, C2s, botnet IPs	`ABUSECH_API_KEY`	Free
AlienVault OTX	Community threat pulses, IOC enrichment	`OTX_API_KEY`	Free
CISA KEV	Known exploited vulnerabilities catalog	None	Free
Ahmia.fi	Dark web search (.onion index)	Non