OpenCTI MCP Server

by Spathodea-Network

9 stars

Not rated

GitHub

About

A Model Context Protocol server that facilitates integration with OpenCTI, allowing users to query and retrieve cyber threat intelligence data via a standardized interface.

Details

Author: Spathodea-Network
Repository: zxzinn/opencti-mcp
GitHub stars: 9
License: MIT License
Categories: Database, Security, Developer Tools
Tags: #data

- Fetch and search threat intelligence data
- Get latest reports and search by ID
- Search for malware information
- Query indicators of compromise
- Search for threat actors
- User and group management
- List all users and groups
- Get user details by ID
- STIX object operations
- List attack patterns
- Get campaign information by name
- System management
- List connectors
- View status templates
- File operations
- List all files
- Get file details by ID
- Reference data access
- List marking definitions
- View available labels
- Customizable query limits
- Full GraphQL query support

Setting up with Highlight

Follow these steps to add this server as a custom Highlight plugin:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below
Plugin Name OpenCTI MCP Server

Command (node, npx, python, etc.) node
Arguments
- Argument 1 path/to/opencti-server/build/index.js
Environment
- OPENCTI_URL $${OPENCTI_URL}
- OPENCTI_TOKEN $${OPENCTI_TOKEN}
Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "opencti mcp server": {
            "env": {
                "OPENCTI_URL": "$${OPENCTI_URL}",
                "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
            },
            "args": [
                "path/to/opencti-server/build/index.js"
            ],
            "command": "node"
        }
    }
}

JSON

{
    "mcpServers": {
        "opencti mcp server": {
            "env": {
                "OPENCTI_URL": "$${OPENCTI_URL}",
                "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
            },
            "args": [
                "path/to/opencti-server/build/index.js"
            ],
            "command": "node"
        }
    }
}

JSON

{
    "mcpServers": {
        "opencti mcp server": {
            "env": {
                "OPENCTI_URL": "$${OPENCTI_URL}",
                "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
            },
            "args": [
                "path/to/opencti-server/build/index.js"
            ],
            "command": "node"
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "opencti mcp server": {
            "env": {
                "OPENCTI_URL": "$${OPENCTI_URL}",
                "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
            },
            "args": [
                "path/to/opencti-server/build/index.js"
            ],
            "command": "node"
        }
    }
}

JSON

{
    "mcpServers": {
        "opencti mcp server": {
            "env": {
                "OPENCTI_URL": "$${OPENCTI_URL}",
                "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
            },
            "args": [
                "path/to/opencti-server/build/index.js"
            ],
            "command": "node"
        }
    }
}

JSON

{
    "mcpServers": {
        "opencti mcp server": {
            "env": {
                "OPENCTI_URL": "$${OPENCTI_URL}",
                "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
            },
            "args": [
                "path/to/opencti-server/build/index.js"
            ],
            "command": "node"
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "opencti mcp server": {
            "env": {
                "OPENCTI_URL": "$${OPENCTI_URL}",
                "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
            },
            "args": [
                "path/to/opencti-server/build/index.js"
            ],
            "command": "node"
        }
    }
}

JSON

{
    "mcpServers": {
        "opencti mcp server": {
            "env": {
                "OPENCTI_URL": "$${OPENCTI_URL}",
                "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
            },
            "args": [
                "path/to/opencti-server/build/index.js"
            ],
            "command": "node"
        }
    }
}

JSON

{
    "mcpServers": {
        "opencti mcp server": {
            "env": {
                "OPENCTI_URL": "$${OPENCTI_URL}",
                "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
            },
            "args": [
                "path/to/opencti-server/build/index.js"
            ],
            "command": "node"
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "opencti mcp server": {
            "env": {
                "OPENCTI_URL": "$${OPENCTI_URL}",
                "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
            },
            "args": [
                "path/to/opencti-server/build/index.js"
            ],
            "command": "node"
        }
    }
}

JSON

{
    "mcpServers": {
        "opencti mcp server": {
            "env": {
                "OPENCTI_URL": "$${OPENCTI_URL}",
                "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
            },
            "args": [
                "path/to/opencti-server/build/index.js"
            ],
            "command": "node"
        }
    }
}

JSON

{
    "mcpServers": {
        "opencti mcp server": {
            "env": {
                "OPENCTI_URL": "$${OPENCTI_URL}",
                "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
            },
            "args": [
                "path/to/opencti-server/build/index.js"
            ],
            "command": "node"
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "opencti mcp server": {
            "env": {
                "OPENCTI_URL": "$${OPENCTI_URL}",
                "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
            },
            "args": [
                "path/to/opencti-server/build/index.js"
            ],
            "command": "node"
        }
    }
}

JSON

{
    "mcpServers": {
        "opencti mcp server": {
            "env": {
                "OPENCTI_URL": "$${OPENCTI_URL}",
                "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
            },
            "args": [
                "path/to/opencti-server/build/index.js"
            ],
            "command": "node"
        }
    }
}

JSON

{
    "mcpServers": {
        "opencti mcp server": {
            "env": {
                "OPENCTI_URL": "$${OPENCTI_URL}",
                "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
            },
            "args": [
                "path/to/opencti-server/build/index.js"
            ],
            "command": "node"
        }
    }
}

From the repository

To install OpenCTI Server for Claude Desktop automatically via Smithery:

npx -y @smithery/cli install opencti-server --client claude

cd opencti-mcp-server npm install

Copy .env.example to .env and update with your OpenCTI credentials:

bash
cp .env.example .env
``

Required environment variables: -OPENCTI_URL: Your OpenCTI instance URL -OPENCTI_TOKEN`: Your OpenCTI API token

`get_latest_reports`

Retrieves the most recent threat intelligence reports. Parameters: first (optional integer, defaults to 10)

`get_report_by_id`

Retrieves a specific report by its ID. Parameters: id (string, required)

`search_malware`

Searches for malware information in the OpenCTI database. Parameters: query (string), first (optional integer, defaults to 10)

`search_indicators`

Searches for indicators of compromise. Parameters: query (string), first (optional integer, defaults to 10)

`search_threat_actors`

Searches for threat actor information. Parameters: query (string), first (optional integer, defaults to 10)

`get_user_by_id`

Retrieves user information by ID. Parameters: id (string, required)

`list_users`

Lists all users in the system. Parameters: none

`list_groups`

Lists all groups with their members. Parameters: first (optional integer, defaults to 10)

`list_attack_patterns`

Lists all attack patterns in the system. Parameters: first (optional integer, defaults to 10)

`get_campaign_by_name`

Retrieves campaign information by name. Parameters: name (string, required)

`list_connectors`

Lists all system connectors. Parameters: none

`list_status_templates`

Lists all status templates. Parameters: none

`get_file_by_id`

Retrieves file information by ID. Parameters: id (string, required)

`list_files`

Lists all files in the system. Parameters: none

`list_marking_definitions`

Lists all marking definitions. Parameters: none

`list_labels`

Lists all available labels. Parameters: none

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "opencti mcp server": {
            "env": {
                "OPENCTI_URL": "$${OPENCTI_URL}",
                "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
            },
            "args": [
                "path/to/opencti-server/build/index.js"
            ],
            "command": "node"
        }
    }
}

Linux

{
    "env": {
        "OPENCTI_URL": "$${OPENCTI_URL}",
        "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
    },
    "args": [
        "path/to/opencti-server/build/index.js"
    ],
    "command": "node"
}

Macos

{
    "env": {
        "OPENCTI_URL": "$${OPENCTI_URL}",
        "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
    },
    "args": [
        "path/to/opencti-server/build/index.js"
    ],
    "command": "node"
}

Windows

{
    "env": {
        "OPENCTI_URL": "$${OPENCTI_URL}",
        "OPENCTI_TOKEN": "$${OPENCTI_TOKEN}"
    },
    "args": [
        "path/to/opencti-server/build/index.js"
    ],
    "command": "node"
}

OpenCTI MCP Server

Traditional Chinese (繁體中文)

Overview

OpenCTI MCP Server is a Model Context Protocol (MCP) server that provides seamless integration with OpenCTI (Open Cyber Threat Intelligence) platform. It enables querying and retrieving threat intelligence data through a standardized interface.

Features

- Fetch and search threat intelligence data - Get latest reports and search by ID - Search for malware information - Query indicators of compromise - Search for threat actors - User and group management - List all users and groups - Get user details by ID - STIX object operations - List attack patterns - Get campaign information by name - System management - List connectors - View status templates - File operations - List all files - Get file details by ID - Reference data access - List marking definitions - View available labels - Customizable query limits - Full GraphQL query support

Prerequisites

- Node.js 16 or higher - Access to an OpenCTI instance - OpenCTI API token

Installation

Installing via Smithery

To install OpenCTI Server for Claude Desktop automatically via Smithery:

npx -y @smithery/cli install opencti-server --client claude

Manual Installation

```bash

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Jump to

Setting up with Highlight

From the repository

get_latest_reports

get_report_by_id

search_malware

search_indicators

search_threat_actors

get_user_by_id

list_users

list_groups

list_attack_patterns

get_campaign_by_name

list_connectors

list_status_templates

get_file_by_id

list_files

list_marking_definitions

list_labels

Claude Desktop / Cursor

Linux

Macos

Windows

OpenCTI MCP Server

Overview

Features

Prerequisites

Installation

Installing via Smithery

Manual Installation

Install

More like this

Redis

Sqlite

PostgreSQL

Npx Y convex@latest mcp start

AWS MCP Servers

Lamda

`get_latest_reports`

`get_report_by_id`

`search_malware`

`search_indicators`

`search_threat_actors`

`get_user_by_id`

`list_users`

`list_groups`

`list_attack_patterns`

`get_campaign_by_name`

`list_connectors`

`list_status_templates`

`get_file_by_id`

`list_files`

`list_marking_definitions`

`list_labels`