Labsco
MCP SERVER

OpenCTI MCP Server

by Spathodea-Network ↗

Query an OpenCTI threat-intelligence platform in conversation — reports, malware, indicators, threat actors, attack patterns, campaigns and the platform's own users and connectors.

Threat Intelligence & Digital Forensics✓ Verified
Summary
Reads the platform, not just the intel in it.

Alongside the expected malware and indicator searches, it exposes connectors, status templates, marking definitions and group membership — the parts that tell you whether the intelligence you are reading is current and who it may be shared with. That makes it as useful for auditing an OpenCTI deployment as for querying one. Everything here reads; nothing writes back to the platform.

What it is

An MCP server that fronts an OpenCTI instance, turning its GraphQL API into named tools an assistant can call. It covers the intelligence itself (reports, malware, indicators of compromise, threat actors, attack patterns, campaigns) as well as the housekeeping around it (users, groups, connectors, status templates, files, labels and marking definitions).

What you get
  • The most recent threat intelligence reports, and any single report pulled by its id — `get_latest_reports`, `get_report_by_id`
  • Free-text search across malware, indicators of compromise and threat actors, each with a result count you choose — `search_malware`, `search_indicators`, `search_threat_actors`
  • STIX objects read directly: attack patterns listed, and a campaign fetched by name — `list_attack_patterns`, `get_campaign_by_name`
  • Who is on the platform and what they can see: users listed or fetched by id, and groups listed with their members — `list_users`, `get_user_by_id`, `list_groups`
  • Platform state for operators: the connectors feeding data in, and the status templates workflows use — `list_connectors`, `list_status_templates`
  • Files listed and fetched by id, plus the reference data that governs sharing — labels and marking definitions — `list_files`, `get_file_by_id`, `list_labels`, `list_marking_definitions`
Requirements

Access to an OpenCTI instance and an API token from it: `OPENCTI_URL` and `OPENCTI_TOKEN`. Node.js 16 or higher. The npm package name is `opencti-server` (0.1.0) and it is marked private, so install from a clone with `npm install` and `npm run build`, or let the Smithery installer write the client entry. The token carries whatever that OpenCTI account can read, including its users and groups — issue a dedicated one rather than reusing an analyst's.

Setup effort

One command plus a key — npx -y @smithery/cli install opencti-server --client claude, then supply credentials