ThreatCluster

Description

Live threat intelligence for agents: incident clusters, threat actor and malware profiles, CVEs with KEV/EPSS/exploit status, and ransomware leak-site victims. ThreatCluster clusters every public security report into one deduplicated story per incident, scores it, extracts the entities (actors, malware, tools, vendors, CVEs, countries, industries) and tracks ransomware leak sites with its own collectors. This server exposes that corpus as ten read-only tools: `search_threats`, `search_everything`, `newest_threats`, `get_threat` (with IOCs), `leak_site_victims`, `lookup_entity`, `get_vulnerability`, `exploited_vulnerabilities`, `trending_entities` and `api_budget`. Every result carries citation URLs and the credits it cost. **Key:** free on every account, 100 credits a day, 7 days of history. Get one at https://threatcluster.io/api and send it as the `x-api-key` header. Starter ($7.99/month) lifts that to 1,000 credits and 90 days. Also runs locally: `npx -y threatcluster-mcp` or `uvx threatcluster-mcp`. Source: https://github.com/Jam0k/Threat-Intelligence-MCP

Community Metrics

Categories

• mcp

Tags

• mcp
• smithery

Capabilities

• Remote MCP server

Information