opencti-mcp
If you are the rightful owner of opencti-mcp and would like to certify it and/or have it hosted online, please leave a comment on the right or send an email to henry@mcphub.com.
OpenCTI MCP Server is a Model Context Protocol server that integrates with the OpenCTI platform for threat intelligence data retrieval.
OpenCTI MCP Server is designed to facilitate seamless integration with the OpenCTI platform, allowing users to query and retrieve cyber threat intelligence data through a standardized interface. It supports a wide range of operations including fetching threat intelligence reports, searching for malware and threat actors, managing users and groups, and performing STIX object operations. The server is built to handle system management tasks such as listing connectors and status templates, as well as file operations like listing and retrieving file details. With full GraphQL query support, users can customize their queries to suit specific needs. The server requires Node.js 16 or higher and access to an OpenCTI instance with a valid API token.
Features
- Fetch and search threat intelligence data
- User and group management
- STIX object operations
- System management
- File operations
Tools
get_latest_reports
Retrieves the most recent threat intelligence reports.
get_report_by_id
Retrieves a specific report by its ID.
search_malware
Searches for malware information in the OpenCTI database.
search_indicators
Searches for indicators of compromise.
search_threat_actors
Searches for threat actor information.
get_user_by_id
Retrieves user information by ID.
list_users
Lists all users in the system.
list_groups
Lists all groups with their members.
list_attack_patterns
Lists all attack patterns in the system.
get_campaign_by_name
Retrieves campaign information by name.
list_connectors
Lists all system connectors.
list_status_templates
Lists all status templates.
get_file_by_id
Retrieves file information by ID.
list_files
Lists all files in the system.
list_marking_definitions
Lists all marking definitions.
list_labels
Lists all available labels.
