How do I connect MCP Threatintel MCP Server to Claude?

The listing records `claude mcp add threatintel --transport http --scope user --url http://localhost:3707/mcp` as its setup step. Run it, then follow the repository's instructions for the client configuration; the listing names Claude Code as compatible clients.

Is MCP Threatintel MCP Server free?

The listed licence is MIT. Check the upstream terms for permitted use and commercial requirements; a public repository does not by itself mean the software is free or open source. Connected APIs and hosted services may have separate charges.

What can MCP Threatintel MCP Server do?

MCP Threatintel MCP Server documents 12 tools to the agent, including check_breach, check_domain_breaches, check_email_breaches. The descriptions above come from project documentation. A live handshake does not test individual tool behavior.

MCP Threatintel

Unclaimed

by pete-builds

Threat intelligence MCP server for Claude Code. IOC lookups, CVE checks, breach monitoring, dark web search, and OTX pulses.

Install

$claude mcp add threatintel --transport http --scope user --url http://localhost:3707/mcp

Set up this server

Compare servers My Stack

This server needs project-specific setup. Follow the project instructions; no reusable public launch command is available yet.

Project instructions

claude-codecvefastmcpmcpotxsecuritythreat-intelligence

Is this your MCP server?

This listing was auto-indexed from the public record. Claim it to edit the page, set compatibility and unlock growth tools. Takes under two minutes.

Claim this server

Security profile

Claimed and verified servers get a weekly static scan that shows what the code can reach: external services, environment variables, shell commands, agent configuration folders, plus any dependencies with known advisories. Claim this listing to get one. How the security profile works

12 of 12 tools

Documented tools (12)

From project documentation. A server handshake does not verify each tool’s description or behavior.

check_breach

Check LeakCheck for breached credentials by email, domain, username, or hash

check_domain_breaches

Check all known breaches for a domain

check_email_breaches

Check if an email is in any known breach via HIBP

check_password_breach

Check if a password has been exposed (HIBP k-anonymity, free, password never leaves machine)

get_feed_status

Show sync status and record counts for all feeds

get_latest_breach

Get the most recently added breach from HIBP

get_recent_threats

What's been added in the last N hours

lookup_cve

Check if a CVE is in the CISA Known Exploited Vulnerabilities catalog

lookup_ioc

Check an IP, domain, hash, or URL against all threat feeds

search_darkweb

Search Ahmia.fi's index of Tor hidden services

search_pulses

Search AlienVault OTX community threat pulses

search_threats

Full-text search across IOCs, OTX pulses, and CVEs

Tool change history

Compared across complete checks of the same configuration. Tools were listed, not invoked. Input-schema changes are not measured here.

No complete tool checks yet.

FAQ

Questions about MCP Threatintel MCP Server

How do I connect MCP Threatintel MCP Server to Claude?: The listing records `claude mcp add threatintel --transport http --scope user --url http://localhost:3707/mcp` as its setup step. Run it, then follow the repository's instructions for the client configuration; the listing names Claude Code as compatible clients.
Is MCP Threatintel MCP Server free?: The listed licence is MIT. Check the upstream terms for permitted use and commercial requirements; a public repository does not by itself mean the software is free or open source. Connected APIs and hosted services may have separate charges.
What can MCP Threatintel MCP Server do?: MCP Threatintel MCP Server documents 12 tools to the agent, including check_breach, check_domain_breaches, check_email_breaches. The descriptions above come from project documentation. A live handshake does not test individual tool behavior.