🛠️ MISP Tool MCP Server: All 44 Operations

This workflow creates a fully operational MCP (Model Context Protocol) server that exposes every single one of the 44 MISP Tool operations directly to AI agents. MISP (Malware Information Sharing Platform) is a powerful open-source threat intelligence platform, and this server allows seamless integration without any manual configuration. The MCP Trigger node acts as the endpoint, routing requests to pre-configured nodes for operations across Attributes (create/delete/get/update/filter), Events (create/delete/get/publish/unpublish/update/filter), Event tags, Feeds (create/disable/enable/get/update), Galaxies (delete/get/list), and more including Noticelists.

Key benefits include zero-setup deployment—just import, activate, and copy the webhook URL. AI expressions using $fromAI() placeholders automatically handle parameters, with built-in error handling ensuring robust performance. It leverages the official n8n MISP Tool node for reliability and supports high-volume threat intel tasks.

Ideal use cases: Automate threat hunting with AI agents querying/creating MISP events and attributes; integrate with LLMs for real-time IOC (Indicators of Compromise) enrichment; manage feeds and galaxies programmatically; enable security teams to publish/unpublish events via natural language AI prompts. Perfect for SOCs, cybersecurity firms, and red teams saving hours on API wrappers.