mcpdirectory.dev
9,129 servers · updated 23 Sept

Intelthreadlinqs MCP server

community Active last commit 30 d 
{
  "mcpServers": {
    "threadlinqs-intelthreadlinqs": {
      "command": "npx",
      "args": [
        "-y",
        "intelthreadlinqs-mcp@latest"
      ],
      "env": {
        "THREADLINQS_API_KEY": "<threadlinqs_api_key>"
      }
    }
  }
}
file .mcp.json (in your project root)install npx -y intelthreadlinqs-mcpversion 8.1.1

What it does

MCP server exposing Threadlinqs Intelligence threat data including 1,700+ threats, 16,000+ detection rules, 47,000+ IOCs, 500+ threat actors, and C2 infrastructure. Built for security analysts and threat hunters who need access to curated threat intelligence, detection rules, and MITRE attack-chain analysis through Claude and other MCP-compatible clients.

  • Query a threat ID to retrieve a complete hunting dossier with IOCs, Splunk/KQL/Sigma detection rules, and infrastructure pivots in one call.
  • Look up an indicator of compromise to find all associated threats, actor attribution, DNS enrichment, and confidence scores across multiple feeds.
  • Analyze a threat actor by name to get their profile, attributed threats, MITRE techniques, active C2 infrastructure, and shared IOCs with other groups.

Tools this server exposes

ToolDoes
get_threat_hunting_bundleReturns complete threat dossier with metadata, IOCs, detection queries (SPL/KQL/Sigma), similar threats, and infrastructure pivots by threat ID.
get_actor_intelligenceReturns comprehensive adversary profile including attributed threats, MITRE techniques, IOCs, detection rules, timeline, and correlated C2 infrastructure by act
get_ioc_intelligenceReturns all threats associated with an IOC (IP, domain, hash, URL), actor attribution, DNS enrichment, and consensus confidence score across 7 external feeds.
get_cve_intelligenceReturns CVE details, linked threats, EPSS score, KEV status, detection coverage, and available attack simulations by CVE ID.
get_mitre_gap_analysisReturns prioritized MITRE techniques lacking detection coverage, sorted by threat exposure and KEV count, with recommended detection types.
predict_mitre_transitionsReturns predicted next MITRE techniques based on observed technique transition patterns by technique ID.

Before you enable it

An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.