Mandiant MCP Server

Example Use Cases

• 1

  Query Mandiant threat intelligence (actors, malware, reports) directly from Claude Desktop.

• 2

  Analyze indicators of compromise (IPs, domains, file hashes) using Mandiant API results.

• 3

  Assess vulnerabilities and related exploits (CVE lookups and exploit information) within conversational workflows.

Description

This repository provides instructions and example code to run an MCP (Model Context Protocol) server that proxies Mandiant API v4 calls into Claude Desktop. It requires a Python virtual environment, Mandiant API credentials, and simple configuration of Claude Desktop to launch the server. The MCP exposes functions for actor/malware lookups, vulnerability/CVE queries, IoC analysis (IP/domain/hash), and report searches, enabling conversational threat intelligence and investigation workflows within Claude. The integration simplifies hands-on incident response and threat research by allowing agents to call Mandiant intelligence directly from chat.