OpenCTI MCP Server
A Model Context Protocol (MCP) server for OpenCTI — the Open Cyber Threat Intelligence Platform developed by Filigran.
Connect your AI assistant to your OpenCTI instance for threat intelligence search, indicator lookup, report analysis, and connector monitoring through natural conversation.
Tools
| Tool | Description |
|---|---|
search_entities | Search any STIX entity type (reports, malware, threat actors, etc) |
get_report | Get full report details by STIX ID |
search_indicators | Search IOCs by value, pattern type, or keyword |
create_indicator | Create new indicator with STIX/YARA/Sigma pattern |
list_connectors | List all connectors with status and queue depth |
Quick Start
Environment Variables
| Variable | Required | Default | Description |
|---|---|---|---|
OPENCTI_URL | Yes | — | URL of your OpenCTI instance |
OPENCTI_TOKEN | Yes | — | OpenCTI API token |
OPENCTI_SSL_VERIFY | No | false | Verify SSL certificates |
MCP_TRANSPORT | No | stdio | Transport: stdio or http |
MCP_HOST | No | 0.0.0.0 | Host to bind (http mode) |
MCP_PORT | No | 8000 | Port to bind (http mode) |
Docker
git clone https://github.com/DarkAngel-agents/opencti-mcp.git
cd opencti-mcp
export OPENCTI_URL=https://your-opencti-instance.com
export OPENCTI_TOKEN=your-api-token
docker compose up -d
Local
pip install -r requirements.txt
export OPENCTI_URL=https://your-opencti-instance.com
export OPENCTI_TOKEN=your-api-token
# stdio mode
python server.py
# http mode
MCP_TRANSPORT=http python server.py
Claude Desktop
{
"mcpServers": {
"opencti": {
"command": "python",
"args": ["/path/to/opencti-mcp/server.py"],
"env": {
"OPENCTI_URL": "https://your-opencti-instance.com",
"OPENCTI_TOKEN": "your-api-token"
}
}
}
}
Example Prompts
- "Search OpenCTI for threat actors related to APT28"
- "Show me the latest reports about ransomware"
- "Look up indicators matching this IP: 192.168.1.100"
- "Create a STIX indicator for domain evil.example.com"
- "What connectors are active and what's their queue status?"
Related Projects
- misp-mcp — MCP server for MISP
- nixos-anssi-bp028 — NixOS ANSSI hardening module
License
MIT