analyze_iocsLABSCO SUMMARY
Querying several sources at once is the correct default — a single feed's silence is not evidence of anything.
One reputation service returning nothing on an address means that service has not seen it, which analysts routinely over-read as clean. Fanning the same indicator across sources turns a lookup into a judgement. Treat the attribution output with more caution than the enrichment: naming a threat actor from indicator overlap is genuinely hard, and a confident label is easier to produce than to justify. Useful as a starting hypothesis, not a conclusion.
What it is
A threat intelligence server that takes an indicator of compromise, queries several sources, and produces an attributed, reportable result.
What you get
- Multi-source analysis of an indicator rather than a single lookup
- Attribution against known threat actor groups
- Interactive reporting on the findings
Requirements
Python; also published as a Docker image and on PyPI. Apache licensed.
Setup effort
One command plus a key — pip install fastmcp-threatintel, then supply credentials
USE CASES
01
Checking an indicator properly
Several sources rather than whichever one you have open.
02
Forming a hypothesis about who
Attribution as a starting point, not a verdict.
03
Writing it up
The report comes out of the same pass.
1 tool
Listed in project docs. Your client may show a different list.
BEFORE YOU INSTALL
What to know first
Tools you get
1 tool named in the project's documentation.
Requires
- threatintel on PATH
- VIRUSTOTAL_API_KEY in your environment
- OTX_API_KEY in your environment
INSTALLATION
Connect your client
Server setup
TERMINAL
pip install fastmcp-threatintelMCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"threatintel": {
"command": "threatintel",
"args": [
"server"
],
"env": {
"VIRUSTOTAL_API_KEY": "<YOUR_VIRUSTOTAL_API_KEY>",
"OTX_API_KEY": "<YOUR_OTX_API_KEY>",
"ABUSEIPDB_API_KEY": "<YOUR_ABUSEIPDB_API_KEY>",
"IPINFO_API_KEY": "<YOUR_IPINFO_API_KEY>"
}
}
}
}Roo Code — pip
ROO CODE — PIP · JSON
{
"mcpServers": {
"threatintel": {
"command": "threatintel",
"args": [
"server",
"--port",
"8001"
],
"env": {
"VIRUSTOTAL_API_KEY": "<YOUR_VIRUSTOTAL_API_KEY>",
"OTX_API_KEY": "<YOUR_OTX_API_KEY>"
}
}
}
}Roo Code — uv
ROO CODE — UV · TERMINAL
git clone https://github.com/4R9UN/fastmcp-threatintel.git
cd fastmcp-threatintel
uv syncThen add this to Roo Code's mcp_settings.json:
ROO CODE — UV · JSON
{
"mcpServers": {
"threatintel": {
"command": "uv",
"args": [
"run",
"threatintel",
"server",
"--port",
"8001"
],
"cwd": "<YOUR_PATH_TO_FASTMCP_THREATINTEL>",
"env": {
"VIRUSTOTAL_API_KEY": "<YOUR_VIRUSTOTAL_API_KEY>",
"OTX_API_KEY": "<YOUR_OTX_API_KEY>"
}
}
}
}Set cwd to the full path of your fastmcp-threatintel clone.
Roo Code — Poetry
ROO CODE — POETRY · TERMINAL
git clone https://github.com/4R9UN/fastmcp-threatintel.git
cd fastmcp-threatintel
poetry installThen add this to Roo Code's mcp_settings.json:
ROO CODE — POETRY · JSON
{
"mcpServers": {
"threatintel": {
"command": "poetry",
"args": [
"run",
"threatintel",
"server",
"--port",
"8001"
],
"cwd": "<YOUR_PATH_TO_FASTMCP_THREATINTEL>"
}
}
}Set cwd to the full path of your fastmcp-threatintel clone. This block sets no API keys: put VIRUSTOTAL_API_KEY and OTX_API_KEY in a .env file in that folder, or add an env block.
Any MCP client — virtualenv
ANY MCP CLIENT — VIRTUALENV · JSON
{
"mcpServers": {
"threatintel": {
"command": "<YOUR_PATH_TO_VENV>/bin/python",
"args": [
"-m",
"threatintel.cli",
"server",
"--port",
"8001"
],
"cwd": "<YOUR_PATH_TO_PROJECT>"
}
}
}<YOUR_PATH_TO_VENV>/bin/python is the python of the virtual environment you installed fastmcp-threatintel into (pip install fastmcp-threatintel, above), and <YOUR_PATH_TO_PROJECT> is the folder holding your .env. This block sets no API keys, so VIRUSTOTAL_API_KEY and OTX_API_KEY come from that .env.
