A Model Context Protocol server
A Model Context Protocol server
To install OpenCTI Server for Claude Desktop automatically via Smithery:
OpenCTI MCP Server is a Model Context Protocol (MCP) server that provides seamless integration with OpenCTI (Open Cyber Threat Intelligence) platform. It enables querying and retrieving threat intelligence data through a standardized interface.
Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| get_latest_reports | Retrieves the most recent threat intelligence reports. typescript { "name": "get_latest_reports", "arguments": { "first": 10 // Optional, defaults to 10 } } |
| get_report_by_id | Retrieves a specific report by its ID. typescript { "name": "get_report_by_id", "arguments": { "id": "report-uuid" // Required } } |
| search_malware | Searches for malware information in the OpenCTI database. typescript { "name": "search_malware", "arguments": { "query": "ransomware", "first": 10 // Optional, defaults to 10 } } |
| search_indicators | Searches for indicators of compromise. typescript { "name": "search_indicators", "arguments": { "query": "domain", "first": 10 // Optional, defaults to 10 } } |
| search_threat_actors | Searches for threat actor information. typescript { "name": "search_threat_actors", "arguments": { "query": "APT", "first": 10 // Optional, defaults to 10 } } |
| get_user_by_id | Retrieves user information by ID. typescript { "name": "get_user_by_id", "arguments": { "id": "user-uuid" // Required } } |
| list_users | Lists all users in the system. typescript { "name": "list_users", "arguments": {} } |
| list_groups | Lists all groups with their members. typescript { "name": "list_groups", "arguments": { "first": 10 // Optional, defaults to 10 } } |
| list_attack_patterns | Lists all attack patterns in the system. typescript { "name": "list_attack_patterns", "arguments": { "first": 10 // Optional, defaults to 10 } } |
| get_campaign_by_name | Retrieves campaign information by name. typescript { "name": "get_campaign_by_name", "arguments": { "name": "campaign-name" // Required } } |
| list_connectors | Lists all system connectors. typescript { "name": "list_connectors", "arguments": {} } |
| list_status_templates | Lists all status templates. typescript { "name": "list_status_templates", "arguments": {} } |
| get_file_by_id | Retrieves file information by ID. typescript { "name": "get_file_by_id", "arguments": { "id": "file-uuid" // Required } } |
| Variable | Description | Required |
|---|---|---|
| OPENCTI_URL | Endpoint or connection string the server talks to. | Yes |
| OPENCTI_TOKEN | Credential the server authenticates with. | Yes |
Search built for AI, not humans — semantic web search that returns model-ready content, plus code context.
Put 6,000+ pre-built scrapers at your assistant's fingertips through one MCP endpoint.
Fetches and analyzes content from Reddit, providing access to hot threads and post details.
Enables interaction with X (formerly Twitter) for retrieving tweets, creating new posts, and replying to existing ones.
Automates LinkedIn interactions and extracts data through browser automation, respecting terms of service and rate limits.
Automates SEO tasks and provides AI-powered optimization by integrating with the Google Ads Keyword Planner API.