threatfox_search

MCP tool from MCP Threatintel by aplaceforallmystuff

Search ThreatFox IOCs

How to use it

Project documentation lists threatfox_search for the MCP Threatintel MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.

Install MCP Threatintel

$npx -y mcp-threatintel-server
FULL MCP THREATINTEL LISTING

Other tools in MCP Threatintel (16)

abuseipdb_check

Check IP reputation and abuse history

feodo_tracker

Get active botnet C2 servers (QakBot, Emotet, Dridex, etc.)

greynoise_ip

Check if IP is internet noise or targeted threat

malwarebazaar_hash

Look up malware sample by hash

malwarebazaar_recent

Get recent malware samples

malwarebazaar_tag

Search samples by tag

otx_get_pulses

Get recent threat intelligence pulses

otx_search_pulses

Search pulses by keyword

threatfox_iocs

Get recent IOCs from ThreatFox

threatintel_lookup_domain

Look up domain across all configured sources

threatintel_lookup_hash

Look up file hash (MD5/SHA1/SHA256) across sources

threatintel_lookup_ip

Look up IP across all configured sources

threatintel_lookup_url

Look up URL across sources

threatintel_status

Check which threat intelligence sources are configured

urlhaus_lookup

Look up URL, domain, or IP in URLhaus

urlhaus_recent

Get recent malware URLs