MCP server for MISP threat intelligence platform - IOC lookups, event management, correlation discovery, and intelligence enrichment
MCP server for MISP threat intelligence platform - IOC lookups, event management, correlation discovery, and intelligence enrichment
Query and manage your MISP threat-intelligence platform from any MCP client.
Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| misp_search_events | Search events by IOC value, type, tags, date range, organization |
| misp_get_event | Get full event details including attributes, objects, galaxies, related events |
| misp_create_event | Create a new event with threat level, distribution, and analysis status |
| misp_update_event | Update event metadata (info, threat level, analysis, publish state) |
| misp_publish_event | Publish an event to trigger alerts to sharing partners (requires confirm:true) |
| misp_tag_event | Add or remove tags (TLP, MITRE ATT&CK, custom) from an event (removal requires confirm:true) |
| misp_search_attributes | Search IOCs across all events with type, category, and correlation filters |
| misp_add_attribute | Add a single IOC to an event |
| misp_add_attributes_bulk | Add multiple IOCs to an event in one operation |
| misp_delete_attribute | Soft or hard delete an attribute (requires confirm:true; hard delete also requires confirmHard:true) |
| misp_correlate | Find all events and attributes matching a value, with cross-event correlations |
| misp_get_related_events | Discover events related through shared IOCs |
| misp_describe_types | Get all available attribute types and category mappings |
| misp_list_tags | List available tags with usage statistics |
{
"mcpServers": {
"misp-1": {
"command": "npx",
"args": ["-y", "misp-mcp"],
"env": {
"MISP_URL": "your-value",
"MISP_API_KEY": "your-value",
"MISP_VERIFY_SSL": "your-value"
}
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
| Variable | Description | Required |
|---|---|---|
| MISP_URL | Endpoint or connection string the server talks to. | Yes |
| MISP_API_KEY | Credential the server authenticates with. | Yes |
| MISP_VERIFY_SSL | Configuration value read at startup. | Optional |
Read, search and edit files inside allowed directories with the Model Context Protocol reference Filesystem server.
Retrieve version-aware library documentation and code examples with Context7 MCP, using resolve-library-id and query-docs.
Connect any two APIs and keep them in sync — 45 MCP tools with shadow previews and diagnostics.
# PayLink MCP Server **PayLink** is an open-source framework designed to streamline payment integration for developers building AI agents and
There are two ways to connect. Pick the hosted endpoint unless your client only speaks stdio.
Model Context Protocol server that proxies local Ollama to MCP clients like Windsurf and VS Code