ip_reputationLABSCO SUMMARY
The tools are thin on purpose — the ThreatBook account behind them is the product.
Every one of the 15 tools is a call to ThreatBook under your key, so what comes back is decided there, not here. One tool differs in kind from the rest: file_analysis works from a hash you already hold, while file_upload sends the sample itself for sandbox analysis. That is a file leaving your environment, so treat it as a different decision from the lookup tools.
What it is
ThreatMCP puts the ThreatBook threat-analysis API in front of an AI assistant. It covers all 15 of that API's tools — IP, domain, file, URL and vulnerability intelligence — each exposed separately, so the assistant asks for a verdict on an indicator instead of you opening a console and pasting it in. It runs locally as a Python process and talks to ThreatBook with your own API key. MIT licensed.
What you get
- IP verdicts at three depths: reputation, then geolocation, ASN and threat type, then historical resolutions and port information — ip_reputation, ip_analysis, ip_advanced
- A direct check on whether an IP or domain is a known compromise indicator — ioc_detection
- Domain intelligence: resolved IPs and Whois, historical Whois and historical resolutions, context on a domain already judged malicious, and the subdomains beneath it — domain_analysis, domain_advanced, domain_context, subdomain
- File verdicts: the static and dynamic analysis report for a hash, results from 22 antivirus scanning engines, and sandbox analysis of a sample you upload — file_analysis, file_multiengines, file_upload
- URL handling in two steps: submit a URL for scanning, then read back the scanning-engine results — url_scan, url_report
- Vulnerability intelligence: the basics, risk assessment and PoC for a public vulnerability, and aggregation of related vulnerabilities by vendor product — vulnerability, vuln_match
Requirements
A ThreatBook account — register at x.threatbook.com and take your key from the API management page. The server runs locally as a Python process: install from requirements.txt, then point your client at run_server.py by absolute path with THREATBOOK_API_KEY set in the env block. The README gives a Claude Desktop configuration; any MCP client works the same way.
Setup effort
Build from source — git clone https://github.com/NAXG/ThreatMCP
USE CASES
01
A host is talking to an IP I don't recognise and I need to know if it's hostile
Pull the reputation first, then the geolocation, ASN and threat type, the historical resolutions and ports, and whether it is a known compromise indicator.
02
Triage a suspicious domain that showed up in DNS query logs
Resolve it to IPs and Whois, pull the historical Whois and resolution records, and get context on it if it is already known to be malicious.
03
Map out the rest of the infrastructure under a domain I'm investigating
Enumerate the subdomains, then run the interesting ones back through domain analysis.
04
Decide whether a binary found on a compromised machine is malware
Start from the MD5 or SHA256 for the full analysis report and the antivirus engine results; upload the sample itself when the hash is unknown.
05
Check a URL a user clicked before I decide how far the incident goes
Submit the URL for scanning, then read the scanning-engine results back.
06
Work out which published vulnerabilities actually matter for the products we run
Look up a specific vulnerability's risk assessment and PoC, or go the other way and aggregate vulnerabilities by vendor product.
15 tools
Listed in project docs. Your client may show a different list.
ip_analysisip_advancedioc_detectiondomain_analysisdomain_advanceddomain_contextsubdomainfile_analysisfile_multienginesfile_uploadurl_scanurl_reportvulnerabilityvuln_matchBEFORE YOU INSTALL
What to know first
Tools you get
15 tools named in the project's documentation. Only file_upload sends data, submitting your file to ThreatBook's sandbox; the other 14 only read.
Requires
THREATBOOK_API_KEY in your environment
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
You clone this one yourself.
Server setup
Clone the repository and enter the project directory
TERMINAL
git clone https://github.com/NAXG/ThreatMCP
cd ThreatMCPInstall the dependencies
TERMINAL
pip install -r requirements.txtMCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"threatbook": {
"command": "python",
"args": [
"<YOUR_PATH_TO_THREAT_MCP>/run_server.py"
],
"env": {
"THREATBOOK_API_KEY": "<YOUR_THREATBOOK_API_KEY>"
}
}
}
}
