MISP Tool MCP Server: All 44 Operations for AI Agents

This workflow transforms n8n into a fully functional MCP (Model Context Protocol) server for the MISP Tool, providing instant access to all 44 operations including attribute management (create/delete/get/update/filter), event handling (create/delete/publish/unpublish/update/filter), event tags, feeds (create/disable/enable/update), galaxies, notice lists, and more. The MCP Trigger node acts as the endpoint for AI agents, automatically populating parameters with $fromAI() expressions and leveraging the official n8n MISP Tool integration with robust error handling.

Benefits include zero setup time—no custom nodes or configurations needed. Simply import, activate, copy the webhook URL, and connect your AI agents (e.g., Claude, GPT) for real-time MISP interactions. It saves hours of development by pre-building every operation, enabling scalable threat intelligence automation without coding.

Use cases: Automate cybersecurity workflows like ingesting IOCs into MISP events, querying attributes for malware analysis, managing feeds for OSINT, or tagging galaxies for cluster analysis—all via natural language AI prompts. Ideal for SOC teams, threat hunters, and red teams integrating MISP with AI for faster incident response and intel sharing.