A free threat intelligence API (100 credits a day, no card) and an MCP server over it. Ask Claude, Cursor or any MCP client what is new, who was hit, whether a CVE is exploited, and get answers from…
threat-intelligence-mcp is an MCP project maintained in the jam0k/threat-intelligence-mcp repository. The maintainer describes its purpose as “A free threat intelligence API (100 credits a day, no card) and an MCP server over it. Ask Claude, Cursor or any MCP client what…”. Read the project documentation for the complete scope.
The documented npm package is threatcluster-mcp. The configuration below comes from the maintainer’s example; adapt its paths and account values to your environment.
The example declares THREATCLUSTER_API_KEY. Secret-looking values have been replaced with placeholders. Required and optional labels are shown only when the documentation states them.
Project documentation · Repository · Discovery listing. This profile records the public documentation checked on 2026-10-08.
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| search_threats | Keyword search over incident clusters; phrase, then all words, then any word; matched_stage says which |
| search_everything | Clusters, entity profiles and dark-web hits in one call |
| newest_threats | What is new in 1h / 24h / 7d / 30d, by first report or by momentum |
| get_threat | Full record for one cluster: summary, timeline, articles, entities; include_iocs adds validated indicators |
| leak_site_victims | Ransomware leak-site listings by sector / group / country / victim, plus a tally of the whole window |
| lookup_entity | Profile of an actor, malware, tool, vendor, product, country, industry or CVE |
| get_vulnerability | One CVE: CVSS, EPSS, KEV with due date, exploits, vendors, products |
| exploited_vulnerabilities | CVEs in a window filtered to KEV / public exploit / severity / vendor / product |
| trending_entities | Actors, malware, tools, vendors, CVEs, countries rising over a window |
| api_budget | Remaining credits and rate state from the last responses — no API call |
{
"mcpServers": {
"threatcluster": {
"command": "npx",
"args": [
"-y",
"threatcluster-mcp"
],
"env": {
"THREATCLUSTER_API_KEY": "YOUR_THREATCLUSTER_API_KEY"
}
}
}
}From the project documentation. Replace placeholders and example paths before connecting.
| Variable | Description | Required |
|---|---|---|
| THREATCLUSTER_API_KEY | Declared in the maintainer’s client configuration. | Check documentation |
Give your coding agent the full DevTools toolbox: traces, network, console, heap snapshots and Lighthouse.
Workers, KV, R2 and D1 by conversation — Cloudflare's official remote servers for building and observability.
Dashboards, Prometheus and Loki queries, incidents and alerts — observability by conversation.
Errors with full context — stack traces, issue triage and AI-powered root-cause analysis from Sentry's server.
Connect Flutter applications with AI coding assistants via the Model Context Protocol.
Enables natural language interaction with Splunk Enterprise and Cloud for searching data and managing resources.