Indicator of Compromise MCP Server

Example Use Cases

• 1

  Perform automated OSINT research on IOCs using multiple threat intelligence sources.

• 2

  Integrate VirusTotal, Shodan, ThreatFox, and MalwareBazaar data into their workflows via MCP.

• 3

  A local MCP server to facilitate secure and environment-driven API key management for OSINT queries.

Description

This MCP server facilitates OSINT research on Indicators of Compromise such as domains, IPs, hashes, and URLs by aggregating data from VirusTotal, Shodan, ThreatFox, and MalwareBazaar. It operates over stdio and is designed to be easily integrated with LLM clients like Gemini, Claude, and Copilot. The server reads API keys from environment variables to securely access multiple OSINT services, enabling automated and programmatic threat intelligence gathering.