#threat-intelligence

28 WhoisXML API tools for AI agents — WHOIS lookups & history, reverse WHOIS, DNS lookup & history, reverse DNS/MX/NS, IP geolocation, IP netblocks, SSL certificates, subdomain discovery, threat intelligence, domain categorization, email verification, typosquatting detection, and bulk variants for batched lookups. Stdio and Streamable-HTTP transports, OAuth 2.1 with PKCE for hosted mode, npm and Docker distributions.

A live MCP server exposing DugganUSA's threat-intelligence corpus to MCP-speaking agents. Read-only, secure-by-default. JSON-RPC 2.0 over HTTP at `https://analytics.dugganusa.com/api/v1/mcp`.

AI security intelligence on Base. Three paid MCP tools: CVE vulnerability lookup ($0.01), IP/domain reputation check ($0.01), and secret/credential scan ($0.05). Pay-per-call via x402 USDC on Base. No API keys required for callers. Hosted on Cloudflare Workers with per-tool x402 payment challenges.

WhoisJSON MCP Server exposes four domain intelligence tools directly inside Claude, Cursor, and Windsurf — no code required. whois_lookup: Full WHOIS registration record for any domain — registrar, creation and expiry dates, nameservers, registrant contacts, and DNSSEC status. dns_lookup: All DNS records in a single call — A, AAAA, MX, TXT, CNAME, NS, SOA, CAA, DMARC, and more. Useful for mail server audits, SPF/DKIM verification, and infrastructure mapping. ssl_check: TLS certificate details including issuer, expiry date, Subject Alternative Names, and full chain validity. Detect expired or misconfigured certificates instantly. domain_availability: Instant registration availability check for any TLD. Returns a clear registered/available status. Your WhoisJSON API key works identically for the REST API and the MCP server. 1,000 free requests/month, no credit card required. Get your API key at whoisjson.com.

MCP server with 53 security intelligence tools — CVE/KEV, MITRE ATLAS+D3FEND, Sigma detection rules, email security posture (SPF/DMARC), domain & web intel, threat intel.

Real-time phishing detection, IP reputation, and CVE risk analysis API for AI agents. Powered by live threat feeds (OpenPhish, Feodo Tracker, URLhaus). Pay per request via x402 micropayments (USDC on Base). First 1,000 requests free, no signup required.

x402-paid threat intelligence and market data for AI agents on Solana. Real-time threat feeds from URLhaus, ThreatFox, and MalwareBazaar. Live market data from CoinGecko, DeFi Llama, and Coinbase. Network health monitoring. All endpoints pay-per-call via x402 USDC micropayments. Part of the RelayZero agent economy network.

DNS, IP, AS, domain reputation, and Lightning Network intelligence. 44 tools for DNS lookups, reverse DNS, passive DNS, IP reputation, threat intelligence, AS/BGP routing, domain rankings, MAC address lookups, and Bitcoin Lightning Network data. No authentication required.

Connect real-time cybersecurity threat intelligence to your AI workflows through standardized tools and resources. Access comprehensive IOCs, CVEs, TTPs, and threat actor data from FalconFeeds.io with seamless integration across Claude Desktop, VS Code, and other MCP-enabled applications.

Kaspersky OpenTIP Model Context Protocol Server This server gives access to Kaspersky OpenTIP API to agentic applications.

Kaspersky OpenTIP Model Context Protocol Server This server gives access to Kaspersky OpenTIP API to agentic applications.

AlienVault/USM Anywhere MCP Server - Threat intelligence and security monitoring

AgentNull: AI System Security Threat Catalog + Proof-of-Concepts. Collection of PoCs for using Agents, MCP, and RAG in bad ways.

MCP server for Microsoft Sentinel. Enables access to Sentinel logs, incidents, analytics, and Entra ID data via a modular, queryable interface. Strictly non-production. Designed for use with Claude and other LLMs.

A Model Context Protocol (MCP) server that integrates with the MISP (Malware Information Sharing Platform) to provide threat intelligence capabilities to Large Language Models.

MCP server for ORKL Threat Intelligence Library

MCP server for Threat info collection in cyber security

MCP Server for mallory.ai intelligence

This is a threat intel MCP server connected to the ORKL API to retrieve threat report and ask for IOCs, Threat Actors and breaches.