LabscoMCP early access ↗
zxzinnMCP SERVER

OpenCTI MCP Server

Query an OpenCTI threat-intelligence platform in conversation — reports, malware, indicators, threat actors, attack patterns, campaigns and the platform's own users and connectors.

by zxzinn ↗Threat Intelligence & Digital ForensicsCommunity

LABSCO SUMMARY

Reads the platform, not just the intel in it.

Alongside the expected malware and indicator searches, it exposes connectors, status templates, marking definitions and group membership — the parts that tell you whether the intelligence you are reading is current and who it may be shared with. That makes it as useful for auditing an OpenCTI deployment as for querying one. Everything here reads; nothing writes back to the platform.

What it is

An MCP server that fronts an OpenCTI instance, turning its GraphQL API into named tools an assistant can call. It covers the intelligence itself (reports, malware, indicators of compromise, threat actors, attack patterns, campaigns) as well as the housekeeping around it (users, groups, connectors, status templates, files, labels and marking definitions).

What you get

  • The most recent threat intelligence reports, and any single report pulled by its id — get_latest_reports, get_report_by_id
  • Free-text search across malware, indicators of compromise and threat actors, each with a result count you choose — search_malware, search_indicators, search_threat_actors
  • STIX objects read directly: attack patterns listed, and a campaign fetched by name — list_attack_patterns, get_campaign_by_name
  • Who is on the platform and what they can see: users listed or fetched by id, and groups listed with their members — list_users, get_user_by_id, list_groups
  • Platform state for operators: the connectors feeding data in, and the status templates workflows use — list_connectors, list_status_templates
  • Files listed and fetched by id, plus the reference data that governs sharing — labels and marking definitions — list_files, get_file_by_id, list_labels, list_marking_definitions

Requirements

Access to an OpenCTI instance and an API token from it: OPENCTI_URL and OPENCTI_TOKEN. Node.js 16 or higher. The npm package name is opencti-server (0.1.0) and it is marked private, so install from a clone with npm install and npm run build. The token carries whatever that OpenCTI account can read, including its users and groups — issue a dedicated one rather than reusing an analyst's.

Setup effort

Build from source

See installation options