A Model Context Protocol server
Most database access work still happens through a UI a human drives. Opencti MCP MCP server moves it into the conversation instead. A Model Context Protocol server.
To install OpenCTI Server for Claude Desktop automatically via Smithery:
OpenCTI MCP Server is a Model Context Protocol (MCP) server that provides seamless integration with OpenCTI (Open Cyber Threat Intelligence) platform. It enables querying and retrieving threat intelligence data through a standardized interface.
The server publishes 14 tools. What each one is for:
Reports — The Reports tool exposed by this serverget_latest_reports — Retrieves the most recent threat intelligence reports. typescript { "name": "get_latest_reports", "arguments": { "first": 10 // Optional, defaults toget_report_by_id — Retrieves a specific report by its ID. typescript { "name": "get_report_by_id", "arguments": { "id": "report-uuid" // Required } }search_malware — Searches for malware information in the OpenCTI database. typescript { "name": "search_malware", "arguments": { "query": "ransomware", "first": 10 //search_indicators — Searches for indicators of compromise. typescript { "name": "search_indicators", "arguments": { "query": "domain", "first": 10 // Optional, defaultssearch_threat_actors — Searches for threat actor information. typescript { "name": "search_threat_actors", "arguments": { "query": "APT", "first": 10 // Optional, defaultsget_user_by_id — Retrieves user information by ID. typescript { "name": "get_user_by_id", "arguments": { "id": "user-uuid" // Required } }list_users — Lists all users in the system. typescript { "name": "list_users", "arguments": {} }list_groups — Lists all groups with their members. typescript { "name": "list_groups", "arguments": { "first": 10 // Optional, defaults to 10 } }list_attack_patterns — Lists all attack patterns in the system. typescript { "name": "list_attack_patterns", "arguments": { "first": 10 // Optional, defaults to 10 } }get_campaign_by_name — Retrieves campaign information by name. typescript { "name": "get_campaign_by_name", "arguments": { "name": "campaign-name" // Required } }list_connectors — Lists all system connectors. typescript { "name": "list_connectors", "arguments": {} }Configuration is passed through the environment: OPENCTI_URL, OPENCTI_TOKEN. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
@smithery/cli on npm is all you need. Most clients run it directly, so configuration is a few lines and a restart.
Plenty of database access servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Opencti MCP's toolset — Reports, get_latest_reports, get_report_by_id and 11 more — is a fair guide to whether it matches your workflow. It is maintained by Spathodea-Network; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| Reports | The Reports tool exposed by this server. |
| get_latest_reports | Retrieves the most recent threat intelligence reports. typescript { "name": "get_latest_reports", "arguments": { "first": 10 // Optional, defaults to 10 } } |
| get_report_by_id | Retrieves a specific report by its ID. typescript { "name": "get_report_by_id", "arguments": { "id": "report-uuid" // Required } } |
| search_malware | Searches for malware information in the OpenCTI database. typescript { "name": "search_malware", "arguments": { "query": "ransomware", "first": 10 // Optional, defaults to 10 } } |
| search_indicators | Searches for indicators of compromise. typescript { "name": "search_indicators", "arguments": { "query": "domain", "first": 10 // Optional, defaults to 10 } } |
| search_threat_actors | Searches for threat actor information. typescript { "name": "search_threat_actors", "arguments": { "query": "APT", "first": 10 // Optional, defaults to 10 } } |
| get_user_by_id | Retrieves user information by ID. typescript { "name": "get_user_by_id", "arguments": { "id": "user-uuid" // Required } } |
| list_users | Lists all users in the system. typescript { "name": "list_users", "arguments": {} } |
| list_groups | Lists all groups with their members. typescript { "name": "list_groups", "arguments": { "first": 10 // Optional, defaults to 10 } } |
| list_attack_patterns | Lists all attack patterns in the system. typescript { "name": "list_attack_patterns", "arguments": { "first": 10 // Optional, defaults to 10 } } |
| get_campaign_by_name | Retrieves campaign information by name. typescript { "name": "get_campaign_by_name", "arguments": { "name": "campaign-name" // Required } } |
| list_connectors | Lists all system connectors. typescript { "name": "list_connectors", "arguments": {} } |
| list_status_templates | Lists all status templates. typescript { "name": "list_status_templates", "arguments": {} } |
| get_file_by_id | Retrieves file information by ID. typescript { "name": "get_file_by_id", "arguments": { "id": "file-uuid" // Required } } |
{
"mcpServers": {
"opencti": {
"command": "npx",
"args": ["-y", "@smithery/cli"],
"env": {
"OPENCTI_URL": "your-value",
"OPENCTI_TOKEN": "your-value"
}
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
| Variable | Description | Required |
|---|---|---|
| OPENCTI_URL | Endpoint or connection string the server talks to. | Yes |
| OPENCTI_TOKEN | Credential the server authenticates with. | Yes |
Read-only SQL access to Postgres — let your assistant inspect schemas and answer questions from real data.
Manage your whole Supabase project in conversation — database, auth, storage, Edge Functions and branches.
Query, modify and analyse local SQLite databases in conversation — the fastest way to chat with a data file.
Metabase ships its own MCP endpoint — search your BI content, build and run queries, and save questions and dashboards without leaving the chat.
Official MongoDB server covering data, schemas and Atlas management — from find queries to spinning up clusters.
Serverless Postgres with database branching — point your assistant at Neon and let it work on disposable copies.