OpenCTI MCP Server

Example Use Cases

• 1

  Fetch and search the latest threat intelligence reports and related metadata from an OpenCTI instance.

• 2

  Query and filter indicators, malware, and threat actor information programmatically using a standardized MCP interface.

• 3

  Browse and retrieve STIX objects, files, users/groups, connectors, and reference data (labels, marking definitions) from OpenCTI.

Description

OpenCTI MCP Server provides a Model Context Protocol (MCP) wrapper around an OpenCTI instance, enabling agents to query and retrieve threat intelligence data through standardized calls. It supports fetching latest reports, searching malware, indicators, threat actors, STIX objects, user/group management, connectors, files, labels and marking definitions. The server is configurable via environment variables and MCP settings and aims to simplify integration between agents and the OpenCTI platform. It is distributed under an MIT license and intended for self-hosting with an OpenCTI API token.