Truss MCP server

What it does

Truss MCP exposes threat intelligence queries via Model Context Protocol, available as a hosted OAuth service (for Growth+ plans) or local stdio server. It integrates with Cursor, Claude Desktop, and other MCP-compatible clients to search threat data, generate detection rules, and export results in JSON or STIX format.

• Search and filter Truss threat intelligence data using guided FilterQL queries within Claude or Cursor.
• Generate detection rules for Splunk, Falcon, or Cortex based on threat intelligence search results.
• Export threat data as STIX documents or JSON for downstream security tools and workflows.

Tools this server exposes

Tool	Does
search_threats	Query Truss threat intelligence with FilterQL syntax and receive structured product data.
search_products	Search Truss products (local stdio mode).
detect_splunk	Generate Splunk detection rules from threat intelligence results.
detect_falcon	Generate CrowdStrike Falcon detection rules from threat intelligence results.
detect_cortex	Generate Palo Alto Cortex detection rules from threat intelligence results.

Before you enable it

An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.