Integrate OpenCTI Threat Intelligence

OpenCTI MCP Server integrates an AI assistant with OpenCTI (Open Cyber Threat Intelligence), letting it query and retrieve threat intelligence data - reports, malware, indicators of compromise, threat actors, and STIX objects - through a standardized interface.

Use it when you want an AI assistant to pull the latest threat intelligence reports, look up a specific report by ID, search for malware or threat actor information, query indicators of compromise, or administer OpenCTI users and groups (listing, retrieving by ID). It also exposes system-level data like connectors, status templates, files, and marking definitions. Do not use it without a running OpenCTI instance and a valid API token - both OPENCTI_URL and OPENCTI_TOKEN are required, and per the project's own security notes, never commit your .env file or API tokens to version control.

• get_latest_reports / get_report_by_id: retrieve the most recent threat reports or a specific one by ID.
• search_malware: search for malware information in the OpenCTI database.
• search_indicators: search for indicators of compromise.
• search_threat_actors: search for threat actor information.
• get_user_by_id / list_users: retrieve a specific user or list all users.
• list_groups: list all groups with their members.
• list_attack_patterns: list all attack patterns in the system.
• get_campaign_by_name: retrieve campaign information by name.
• list_connectors: list all system connectors.
• list_status_templates: list all status templates.
• get_file_by_id / list_files: retrieve a specific file or list all files.
• list_marking_definitions: list all marking definitions.

Install automatically for Claude via Smithery:

npx -y @smithery/cli install opencti-server --client claude

Or manually:

git clone https://github.com/yourusername/opencti-mcp-server.git
cd opencti-mcp-server
npm install
npm run build

Configure your MCP client:

{
  "mcpServers": {
    "opencti": {
      "command": "node",
      "args": ["path/to/opencti-server/build/index.js"],
      "env": {
        "OPENCTI_URL": "${OPENCTI_URL}",
        "OPENCTI_TOKEN": "${OPENCTI_TOKEN}"
      }
    }
  }
}

Requires Node.js 16+ and access to an OpenCTI instance with a valid API token. Keep OPENCTI_TOKEN out of version control.

Threat intelligence analysts and security operations teams running OpenCTI who want an AI assistant to query threat data and manage platform users/groups conversationally instead of navigating the OpenCTI UI.