Every one of the 15 tools is a call to ThreatBook under your key, so what comes back is decided there, not here. One tool differs in kind from the rest: file_analysis works from a hash you already hold, while file_upload sends the sample itself for sandbox analysis. That is a file leaving your environment, so treat it as a different decision from the lookup tools.
ThreatMCP puts the ThreatBook threat-analysis API in front of an AI assistant. It covers all 15 of that API's tools — IP, domain, file, URL and vulnerability intelligence — each exposed separately, so the assistant asks for a verdict on an indicator instead of you opening a console and pasting it in. It runs locally as a Python process and talks to ThreatBook with your own API key. MIT licensed.
- IP verdicts at three depths: reputation, then geolocation, ASN and threat type, then historical resolutions and port information — ip_reputation, ip_analysis, ip_advanced
- A direct check on whether an IP or domain is a known compromise indicator — ioc_detection
- Domain intelligence: resolved IPs and Whois, historical Whois and historical resolutions, context on a domain already judged malicious, and the subdomains beneath it — domain_analysis, domain_advanced, domain_context, subdomain
- File verdicts: the static and dynamic analysis report for a hash, results from 22 antivirus scanning engines, and sandbox analysis of a sample you upload — file_analysis, file_multiengines, file_upload
- URL handling in two steps: submit a URL for scanning, then read back the scanning-engine results — url_scan, url_report
- Vulnerability intelligence: the basics, risk assessment and PoC for a public vulnerability, and aggregation of related vulnerabilities by vendor product — vulnerability, vuln_match
A ThreatBook account — register at x.threatbook.com and take your key from the API management page. The server runs locally as a Python process: install from requirements.txt, then point your client at run_server.py by absolute path with THREATBOOK_API_KEY set in the env block. The README gives a Claude Desktop configuration; any MCP client works the same way.