Summary
One question per indicator instead of seven browser tabs.
Triage usually means pasting the same address into VirusTotal, then AbuseIPDB, then Shodan. This collapses that into a single call and lets the observable type decide which services are worth asking at all.
What it is
An MCP server for threat-intelligence enrichment, built on the security-cli Python package. A single tool, lookup-observable, examines the observable you give it and routes it to the services configured to handle that type.
What you get
- An IP address, domain, URL or email address enriched in one call
- Routing that skips services which cannot answer for that observable type
- VirusTotal, HybridAnalysis, AlienVault, Shodan and Urlscan.io for IPs, domains and URLs
- AbuseIPDB for IP addresses
- HaveIBeenPwned for email addresses
Requirements
Every supported service needs its own API key, supplied through a .env file, and a config.yaml decides which of them are switched on. Nothing gets queried until at least one service is configured.
Setup effort
One command plus a key — curl -LsSf https://astral.sh/uv/install.sh | sh, then supply credentials