Misp MCP Server

MCP server for MISP threat intelligence platform - IOC lookups, event management, correlation discovery, and intelligence enrichment. The misp mcp server wraps that behind the Model Context Protocol, so an assistant can use it through 14 defined tools rather than through you.

What it actually does

Query and manage your MISP threat-intelligence platform from any MCP client.

• 36 MCP tools — covering events, attributes, correlations, tags, exports, sightings, warninglists, objects, galaxies, feeds, organisations, and server administration
• 3 MCP resources — for browsing attribute types, instance statistics, and available taxonomies
• 3 MCP prompts — for guided IOC investigation, incident event creation, and threat reporting
• Confirmation-gated writes — so destructive tools refuse to run without confirm: true (and confirmHard: true for permanent deletes)
• MITRE ATT&CK integration — via galaxy cluster search and attachment
• Export formats — including CSV, STIX, Suricata, Snort, text, RPZ, and hash lists

Adding it to your client

misp-mcp on npm is all you need. Most clients run it directly, so configuration is a few lines and a restart.

Its toolset

Everything the assistant can do here goes through one of these:

• misp_search_events — Search events by IOC value, type, tags, date range, organization
• misp_get_event — Get full event details including attributes, objects, galaxies, related events
• misp_create_event — Create a new event with threat level, distribution, and analysis status
• misp_update_event — Update event metadata (info, threat level, analysis, publish state)
• misp_publish_event — Publish an event to trigger alerts to sharing partners (requires confirm:true)
• misp_tag_event — Add or remove tags (TLP, MITRE ATT&CK, custom) from an event (removal requires confirm:true)
• misp_search_attributes — Search IOCs across all events with type, category, and correlation filters
• misp_add_attribute — Add a single IOC to an event
• misp_add_attributes_bulk — Add multiple IOCs to an event in one operation
• misp_delete_attribute — Soft or hard delete an attribute (requires confirm:true; hard delete also requires confirmHard:true)
• misp_correlate — Find all events and attributes matching a value, with cross-event correlations
• misp_get_related_events — Discover events related through shared IOCs

Configuration

You will need 3 environment variables: MISP_URL, MISP_API_KEY, MISP_VERIFY_SSL. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.

• Node.js 20 or later. - A running MISP instance with API access. - A MISP API key (MISP UI: Administration > List Auth Keys).

Caveats

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• With 14 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Misp.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the misp mcp server does with a few real requests.

When to reach for it

This sits in the developer tooling group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Misp's toolset — misp_search_events, misp_get_event, misp_create_event and 11 more — is a fair guide to whether it matches your workflow. It is maintained by GitHub Actions; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.