OpenCTI
Free与 OpenCTI 平台交互，检索威胁情报数据（报告、指标、恶意软件等）。
FreeFree tier
About OpenCTI
OpenCTI MCP Server is a Model Context Protocol (MCP) server that provides seamless integration with the OpenCTI (Open Cyber Threat Intelligence) platform. It enables AI assistants to query and retrieve threat intelligence data through a standardized interface, including reports, indicators of compromise, malware information, threat actors, and more. The server supports full GraphQL query access, user and group management, STIX object operations, system management, file operations, and reference data access. It requires Node.js 16+, an OpenCTI instance, and an API token.
Key Features
Fetch and search threat intelligence data
Get latest reports and search by ID
Search for malware information
Query indicators of compromise
Search for threat actors
User and group management (list users, get user details)
STIX object operations (list attack patterns, get campaign info)
System management (list connectors, view status templates)
File operations (list files, get file details)
Reference data access (list marking definitions, view labels)
Pros & Cons
Pros
- Open source and free to use
- Standardized MCP interface for AI tool integration
- Comprehensive coverage of OpenCTI entities (reports, IoCs, malware, actors, etc.)
- Supports GraphQL for flexible and efficient queries
- Easy installation via Smithery or manual setup
- Includes user and group management capabilities
Cons
- Requires a self-hosted OpenCTI instance
- Requires an API token and configuration
- Limited to data available within the connected OpenCTI platform
- Node.js dependency and manual build step
Best For
Threat intelligence aggregation from OpenCTISecurity operations automation and enrichmentIncident response with real-time IoC lookupsResearch on malware, threat actors, and attack patterns
FAQ
What is OpenCTI MCP Server?
OpenCTI MCP Server is a Model Context Protocol server that enables querying and retrieving threat intelligence data from the OpenCTI platform through a standardized MCP interface.
What are the prerequisites?
Node.js 16 or higher, access to an OpenCTI instance, and an OpenCTI API token.
How can I install OpenCTI MCP Server?
You can install it automatically via Smithery using 'npx -y @smithery/cli install opencti-server --client claude', or manually by cloning the repository, installing dependencies, and building the project.
What tools are available?
Available tools include get_latest_reports, get_report_by_id, search_malware, search_indicators, search_threat_actors, get_user_by_id, list_users, and many more for STIX objects, system management, file operations, and reference data.
How do I configure the server?
Copy the .env.example file to .env and set the OPENCTI_URL and OPENCTI_TOKEN environment variables with your OpenCTI instance URL and API token.