Enrichment MCP Server

Enrichment MCP becomes available to MCP clients through the enrichment mcp mcp server. This project is a Model Context Protocol (MCP) server for performing enrichment given a provided observable. The combination of configured services and the provided observable(s) will determine which enrichment services to call.

What Enrichment MCP does

This project is a Model Context Protocol (MCP) server for performing enrichment given a provided observable. The combination of configured services and the provided observable(s) will determine which enrichment services to call.

Installing the enrichment mcp mcp server

Setup follows the standard MCP pattern: clone or install the server, then register it in your client's configuration file and restart the client. The configuration snippets on this page cover Claude Desktop, Claude Code and Cursor.

Configuration

Before the server will start you need to supply 7 environment variables: ENRICHMENT_MCP_VIRUSTOTAL_KEY, ENRICHMENT_MCP_HYBRIDANALYSIS_KEY, ENRICHMENT_MCP_ALIENVAULT_KEY, ENRICHMENT_MCP_SHODAN_KEY, ENRICHMENT_MCP_URLSCAN_KEY, ENRICHMENT_MCP_ABUSEIPDB_KEY, ENRICHMENT_MCP_HIBP_KEY. Keep credentials in your client's env block or a secrets manager rather than committing them.

Requirements

This MCP service uses security-cli and a custom config.yaml.example file to determine which third-party enrichment services are supported for observable lookups. The easiest way to run this on a local mac/system is: This requires that you use the provided template .env.example and create a new .env file with your secrets. > NOTE: Please review the

Where it fits

Developer-tool servers are usually the first ones people connect, because they turn "help me with this code" into an assistant that can actually read the repo and act on it. Enrichment MCP sits in that group. Worth comparing against the other developer tools servers in this directory before you commit to one, since several overlap in scope but differ sharply in setup cost and permissions.

Practical notes

• This server runs locally, so it operates with whatever access your machine and its credentials already have. Scope that deliberately rather than by default.
• It will not start until its required credentials are present, so set those before wondering why the tools never appear.
• Maintained by MSAdministrator, written in Python.
• MCP clients ask for confirmation before each tool call by default. Keep that on while you learn what the enrichment mcp mcp server actually does with your data.
• Every entry in this directory is reviewed by hand before it goes live, and details are checked against the project's own documentation.