MISP MCP Server

Created By
sairambokkaa year ago
An MCP server for the open source MISP project
Overview

what is MISP MCP Server?

MISP MCP Server is a Model Context Protocol (MCP) server designed to expose MISP (Malware Information Sharing Platform) IOC retrieval functions to MCP-compatible clients like Claude Desktop.

how to use MISP MCP Server?

To use the MISP MCP Server, clone the repository, install the required dependencies, set up your environment variables with your MISP credentials, and run the server using Python. Connect it to compatible clients by configuring their MCP settings.

key features of MISP MCP Server?

  • Retrieve recent IOCs added to MISP in the last 24 hours.
  • Get statistics and counts by IOC type.
  • Filter IOCs by specific types (IP, domain, URL, etc.).
  • Export IOCs to JSON files.
  • Verify MISP connectivity and configuration.

use cases of MISP MCP Server?

  1. Integrating with threat intelligence platforms to retrieve recent IOCs.
  2. Automating the collection of malware indicators for analysis.
  3. Supporting security operations teams in monitoring and responding to threats.

FAQ from MISP MCP Server?

  • What is required to run the MISP MCP Server?

You need Python 3.8+, access to a MISP instance, and a valid MISP API key.

  • Can I use this server for any MISP instance?

Yes, as long as you have the correct API key and permissions.

  • How do I troubleshoot connection issues?

Check your MISP URL and API key in the environment variables, and ensure your MISP instance is accessible.

Project Info
Created At
a year ago
Updated At
a year ago
Author Name
sairambokka
Star
0
Language
Python
License
-

Recommend Servers

View All
Bring your real authenticated browser session to AI coding agents. Local-first MCP server + Chrome MV3 extension. No cloud. No telemetry.
@Cubenest

peek records the user's actual logged-in browser (DOM via rrweb, console events, network metadata, optional response bodies via opt-in Deep capture) through a Chrome MV3 extension. The extension ships events through a native-messaging stdio bridge to a local MCP server (peek-mcp), which persists them to a SQLite database at ~/.peek/sessions.db. AI coding agents (Claude Code, Cursor, Cline, Windsurf) read sessions from the database via 10 MCP tools: Tool What it does list_recent_sessions List recently recorded sessions (id, origin, ts, event count). get_session_summary LLM-readable narrative summary of a session. get_session_console_errors Console errors recorded in a session. get_session_network_errors Failed/notable network requests in a session. get_user_action_before_error Last N user actions before a console error. generate_playwright_repro Generate a runnable Playwright test from a session. get_dom_snapshot Reconstruct the DOM at a given timestamp. query_dom_history Timeline of attribute/text changes for a selector. request_authorization Side-panel consent for write actions (Level 3). execute_action Dispatch a UI action (gated by permission level + destructive blocklist). Why local-first matters Every other "browser session for AI" tool ships to a vendor cloud. peek's SQLite + extension live on the user's machine — no remote endpoints, no telemetry. The privacy policy (docs/peek/PRIVACY_POLICY.md) is the source of truth. Install # 1. Add the MCP server to Claude Code claude mcp add peek -- npx -y @peekdev/mcp # 2. Install the Chrome extension from the Chrome Web Store # (link added once the CWS listing is approved)

a day ago