Enrichment MCP Server

by msadministrator

343 downloads

Not rated

GitHub

About

Performs data enrichment on observables using third-party services via the security-cli Python package.

Details

Author: msadministrator
Downloads: 343
Categories: Developer Tools, Security, API, Other
Tags: #data-analysis

- Exposes a single lookup-observable tool that routes observables to the correct enrichment service
- Supports VirusTotal, HybridAnalysis, AlienVault, Shodan, Urlscan.io, AbuseIPDB, and HaveIBeenPwned
- Handles IP addresses, domains, URLs, and email addresses
- Uses environmental variables for API key configuration
- Customizable prompt templates via Jinja2 files in the templates directory
- All enrichment services require API keys

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name Enrichment MCP Server

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "enrichment mcp server": {
            "enrichment-mcp": {
                "command": "uv",
                "args": [
                    "run",
                    "--env-file",
                    ".env",
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "enrichment mcp server": {
            "enrichment-mcp": {
                "command": "uv",
                "args": [
                    "run",
                    "--env-file",
                    ".env",
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "enrichment mcp server": {
            "enrichment-mcp": {
                "command": "uv",
                "args": [
                    "run",
                    "--env-file",
                    ".env",
                    "server.py"
                ]
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "enrichment mcp server": {
            "enrichment-mcp": {
                "command": "uv",
                "args": [
                    "run",
                    "--env-file",
                    ".env",
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "enrichment mcp server": {
            "enrichment-mcp": {
                "command": "uv",
                "args": [
                    "run",
                    "--env-file",
                    ".env",
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "enrichment mcp server": {
            "enrichment-mcp": {
                "command": "uv",
                "args": [
                    "run",
                    "--env-file",
                    ".env",
                    "server.py"
                ]
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "enrichment mcp server": {
            "enrichment-mcp": {
                "command": "uv",
                "args": [
                    "run",
                    "--env-file",
                    ".env",
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "enrichment mcp server": {
            "enrichment-mcp": {
                "command": "uv",
                "args": [
                    "run",
                    "--env-file",
                    ".env",
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "enrichment mcp server": {
            "enrichment-mcp": {
                "command": "uv",
                "args": [
                    "run",
                    "--env-file",
                    ".env",
                    "server.py"
                ]
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "enrichment mcp server": {
            "enrichment-mcp": {
                "command": "uv",
                "args": [
                    "run",
                    "--env-file",
                    ".env",
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "enrichment mcp server": {
            "enrichment-mcp": {
                "command": "uv",
                "args": [
                    "run",
                    "--env-file",
                    ".env",
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "enrichment mcp server": {
            "enrichment-mcp": {
                "command": "uv",
                "args": [
                    "run",
                    "--env-file",
                    ".env",
                    "server.py"
                ]
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "enrichment mcp server": {
            "enrichment-mcp": {
                "command": "uv",
                "args": [
                    "run",
                    "--env-file",
                    ".env",
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "enrichment mcp server": {
            "enrichment-mcp": {
                "command": "uv",
                "args": [
                    "run",
                    "--env-file",
                    ".env",
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "enrichment mcp server": {
            "enrichment-mcp": {
                "command": "uv",
                "args": [
                    "run",
                    "--env-file",
                    ".env",
                    "server.py"
                ]
            }
        }
    }
}

From the repository

Run locally with uv run --env-file .env server.py after creating a .env file with the required API keys. For use with Claude Desktop, add the server to your claude_desktop_config.json file under mcpServers, pointing command to the uv binary and passing the directory and server.py as arguments.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "enrichment mcp server": {
            "enrichment-mcp": {
                "command": "uv",
                "args": [
                    "run",
                    "--env-file",
                    ".env",
                    "server.py"
                ]
            }
        }
    }
}

McpServers

{
    "enrichment-mcp": {
        "command": "uv",
        "args": [
            "run",
            "--env-file",
            ".env",
            "server.py"
        ]
    }
}

This project is a Model Context Protocol (MCP) server for performing enrichment given a provided observable. The combination of configured services and the provided observable(s) will determine which enrichment services to call.

This tool provides a simple MCP server implementation to perform third-party enrichment using common services (e.g. VirusTotal, Hybrid Analysis, etc.) utilizing thesecurity-clipython package to perform enrichment/communicate with different services.

This implementation of theenrichment-mcpMCP server exposes the following tools.

- lookup-observable - A generic endpoint which examines and routes the given observable to the correct tool.

The following services and observable types are currently supported:

If you have any suggestions or believe another service should be implemented, please create an issue or pull request!

This MCP service usessecurity-cliand a custom config.yaml.examplefile to determine which third-party enrichment services are supported for observable lookups.

The easiest way to run this on a local mac/system is:

This requires that you use the provided template .env.exampleand create a new.envfile with your secrets.

NOTE: Please review the documentation for security-clifor information on configuring different services. The default will suffice for most use cases.

NOTE: It is highly recommended to set secrets as environmental variables when implementing this service. Stop storing secrets silly goose.

In order for thesecurity-clipackage to discover these variables, they must be in a specific format. Below is the list of currently supported variables:

- ENRICHMENT_MCP_VIRUSTOTAL_KEY
- ENRICHMENT_MCP_HYBRIDANALYSIS_KEY
- ENRICHMENT_MCP_ALIENVAULT_KEY
- ENRICHMENT_MCP_SHODAN_KEY
- ENRICHMENT_MCP_URLSCAN_KEY
- ENRICHMENT_MCP_ABUSEIPDB_KEY
- ENRICHMENT_MCP_HIBP_KEY

Each enrichment service is defined in thesecuriy-cliconfig file. Additionally, I have broken out the different types of enrichment that can be performed. This means, in the current implementation, we have a single action type calledenrichbut in the future this can be expanded for things likescansorqueriesetc.

Underneath these high-level actions, we list out the observable type followed by a list of services that support that type. The currently supported observable types are:

- ipaddress - ipv4 addresses
- domain - A domain or netloc
- url - A fully qualified URL with schema, etc.
- email - A standard email address

We also support these types but they are currently not implemented:

- md5 - A file MD5 hash
- sha1 - A file SHA1 hash
- sha256 - A file SHA256 hash

Each service must have anameand atemplate. Theapikeyfield can be provided but we recommend to use environmental variables.

Each service and observable type can have it's own response template. These reside in thesecurity-clitemplatesdirectory and all templates are expected to exist here.

Each service defined has a prompt template using jinja2 templates. You can modify these are needed, but the format of the filename must remain the same.

These files have the following filename pattern.

Ensure that the response object has the correct fields in the template itself or you will receive an error.

Below is an example output for a prompt ofEnrich this IP 91.195.240.94with some errors mixed in:

{ "virustotal": "error occurred looking up ip 91.195.240.94 in virustotal", "alienvault": "Service: alienvault\nIPAddress: \nReputation Score: 0\nTotal Votes: ", "shodan": "Service: shodan\nIPAddress: 91.195.240.94\nLast Analysis Results: 2025-04-25T21:02:52.644602\n\nTags\n\n\nAdditional information includes:\n\n Latitude: 48.13743\n Longitude: 11.57549\n ASN: AS47846\n Domains: ["servervps.net"]", "hybridanalysis": "error occurred looking up ip 91.195.240.94 in hybridanalysis", "urlscan": "Service: urlscan\nResult: https://urlscan.io/api/v1/result/01966efe-c8fa-74a4-bfc0-1ed479838e85/\n\nStats\n\n uniqIPs - 6\n\n uniqCountries - 2\n\n dataLength - 432561\n\n encodedDataLength - 218606\n\n requests - 14\n\n\nPage\n country - DE\n server - Parking/1.0\n ip - 91.195.240.94\n mimeType - text/html\n title - wearab.org\xa0-\xa0Informationen zum Thema wearab.\n url - https://login.wearab.org/\n tlsValidDays - 364\n tlsAgeDays - 0\n tlsValidFrom - 2025-04-25T00:00:00.000Z\n domain - login.wearab.org\n apexDomain - wearab.org\n asnname - SEDO-AS SEDO GmbH, DE\n asn - AS47846\n tlsIssuer - Encryption Everywhere DV TLS CA - G2\n status - 200\n", "abuseipdb": "Service: abuseripdb\nIPAddress: 91.195.240.94\nLast Analysis Result: 2025-03-30T14:04:45+00:00\nScore: 7\nUsage: Data Center/Web Hosting/Transit\nIs Tor: False\nIs Whitelisted: False\nISP: Sedo Domain Parking" }

For using a pre-built server, instructions from here:https://modelcontextprotocol.io/quickstart/user

curl -LsSf https://astral.sh/uv/install.sh | sh

- Download this repo and add to Claude for Desktop config

- Claude for Desktop > Settings > Developer > Edit Config

You can copy the provided .desktop_config.example.jsonfile

If you want to create it yourself, these are the paths for Claude Desktop.

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

Open up the configuration file in any text editor. Replace the file contents with this:

{ "mcpServers": { "enrichment-mcp": { "command": "/ABSOLUTE/PATH/TO/PARENT/FOLDER/uv", "args": [ "--directory", "/ABSOLUTE/PATH/TO/CLONED/REPOSITORY/enrichment-mcp", "run", "server.py" ] } } }

You should now see two icons in the chat bar, a hammer which shows the tools available and a connection icon which shows the prompt defined and the input required.

Contributions are welcome! Please feel free to submit pull requests.

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Hosted Streamable HTTP MCP server for IP intelligence, fraud risk scoring, email validation, DNS, WHOIS, domain age, quota, and usage tools for AI agents.

GeoIP and ASN intelligence for AI agents with country, city, timezone, network ownership and ASN lookups.

Paid x402 MCP server for Base-USDC balances, blocks, gas prices, URL security headers, and profile bios.

An MCP server for memory forensics using the Volatility 3 framework.

IP2Location.io API integration to retrieve the geolocation information for an IP address.

Open-source, self-hostable MCP server for WhisperGraph — a graph of 7.39B nodes / 39B edges mapping DNS, BGP, GeoIP, WHOIS, and threat intelligence. Six read-only tools (Cypher query + schema introspection + threat assessment), six resources, eight investigation prompts. stdio and Streamable HTTP transports.

A Model Context Protocol (MCP) server implementation that provides seamless integration with the AbuseIPDB API for IP reputation checking and abuse report management.

Extracts Indicators of Compromise (IoCs) from text and checks their reputation using multiple threat intelligence services.

Official MCP server for IP geolocation, IP security, abuse contacts, ASN, timezone, astronomy, and user-agent parsing.

Fraud and abuse scoring for operators who can't justify an enterprise fraud team.

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

Enrichment MCP Server

About

Details

Jump to

Setting up with Highlight

Setting up with Cursor

JSON

JSON

JSON

Setting up with Claude Desktop

JSON

JSON

JSON

Setting up with Windsurf

JSON

JSON

JSON

Setting up with Cline

JSON

JSON

JSON

Setting up with Goose

JSON

JSON

JSON

From the repository

Claude Desktop / Cursor

McpServers

Install

About

Details

Jump to

Setting up with Highlight

From the repository

Claude Desktop / Cursor

McpServers

Install

More like this

Sentry

Github

Git

GitLab

Context 7

Playwright