OTX MCP Server

Example Use Cases

• 1

  Search and retrieve detailed threat indicators and their reputations from AlienVault OTX to enrich analysis or triage workflows.

• 2

  Create, edit, and extract indicators from threat intelligence pulses and manage subscriptions or follows for intelligence feeds.

• 3

  Submit suspicious URLs for analysis and monitor recent events/activities on OTX as part of automated threat monitoring.

Description

This MCP server implements the Tools portion of the Model Context Protocol to give LLMs programmatic access to AlienVault OTX via the OTX API. It provides indicator search and validation, pulse creation and extraction, user and subscription management, URL submission for analysis, and recent event monitoring. The server can run in Docker or locally and is designed to communicate over stdin/stdout so it integrates with MCP clients like Claude Desktop; it requires an OTX API key to operate.