#OSINT

Threat intelligence MCP server for SOC analysts, DFIR and security researchers. Scan and enrich IOCs directly from Claude, Cursor or any MCP client: IP addresses (IPv4/IPv6), domains, file hashes and blockchain addresses. Search CVEs by keyword, vendor or product, retrieve full CVE records, and explore a threat actor database (APTs, groups, TTPs) with reverse CVE-to-actor lookup. Includes scan history, bookmarks and quota management. Free tier available — no credit card required. Built by mlab.sh, the IOC & file intelligence platform.

Exposes 280+ free dev/security tools from onlinecybertools.com as MCP tools in one server: Base64/URL/JWT encoders, MD5/SHA/HMAC/bcrypt/argon2 hashes, JSON/YAML/XML formatters, regex tester, network diagnostics (ping/traceroute/dig/whois/SSL/SPF/DMARC), and OSINT lookups. No auth, no API key.

Audits a GitHub repository's stargazers for signs of fake-star injection across five deterministic axes (burst, suffix-farm, sequential-id cluster, same-second cluster, inter-star gap regularity) over two windows (oldest 100 + newest 30), plus extended signals. Returns LOW / MEDIUM / HIGH with every flag explained. Uses the anonymous GitHub API only — never reads a token, never writes files. Heuristic, not proof: read the evidence. The core (audit.py) is pure Python stdlib; this MCP server is an optional wrapper.

FrameTrace is an AI-powered reverse video search engine that helps you find any video's original source, detect duplicates, and verify authenticity across platforms like YouTube, TikTok, Instagram, and Reddit. Using advanced computer vision and machine learning, it analyzes videos frame-by-frame to trace content origins even after editing or re-encoding.

MCP server with 53 security intelligence tools — CVE/KEV, MITRE ATLAS+D3FEND, Sigma detection rules, email security posture (SPF/DMARC), domain & web intel, threat intel.

Remote-only social media MCP server for Twitter/X, Instagram, and TikTok data & insights.

A Model Context Protocol (MCP) server that provides comprehensive IP and domain intelligence. This server allows Large Language Models (LLMs) to obtain detailed security information, reputation assessments, and threat intelligence by analyzing IP addresses and domains through the Yunaq GAC platform.

A collection of MCP servers.

A lightweight, extensible cybersecurity toolkit that connects AI assistants to security tools through the Model Context Protocol (MCP), enabling AI-assisted security research, scanning, and analysis.

MCP server to gather usernames from LinkedIn using Serper

A comprehensive collection of Model Context Protocol (MCP) servers

Fast MCP integration for NetworksDB API - Query IP addresses, organizations, ASNs, and DNS records using natural language through Model Context Protocol

A Model Context Protocol server that provides network asset information based on query conditions. This server allows LLMs to obtain network asset information and supports querying network asset information by zoomeye dork etc.