Ansvar: Threat Intelligence MCP Server

Ansvar: Threat Intelligence MCP server exists for a simple reason — assistants are far more useful when they can act on Ansvar: Threat Intelligence directly instead of describing what you should do. CVE intelligence, STRIDE, OWASP test cases via Ansvar Gateway. Cited, OAuth + paid.

What you get

Ansvar Gateway is a remote MCP server for compliance, legal, and security work. One OAuth connection gives your agent scoped search and get_provision across audited law corpora — Europe-led, with growing North American and APAC coverage; the live, licence-audited jurisdiction list is at ansvar.eu/coverage — plus the EU regulations corpus (GDPR, NIS2, DORA, AI Act, CRA, …), the security-frameworks corpus, and live CVE/KEV/EPSS intelligence.

This is the public home of the hosted Ansvar Gateway — documentation and listing anchor only; the gateway service itself is not developed in this repository. Open-source law-connector code lives across the Ansvar-Systems organization (Apache-2.0).

What the assistant can call

Once Ansvar: Threat Intelligence is connected, these are the calls the assistant has available:

• list_coverage — discover what corpora and jurisdictions are live, by domain
• Per — item attribution:** every served row carries source URL, publisher, and licence; content with unresolved licensing is withheld with an explicit
• Endpoint — https://gateway.ansvar.eu/mcp (streamable HTTP)
• Auth — OAuth 2.1 with Dynamic Client Registration — no API keys
• Registry — eu.ansvar/gateway in the official MCP registry
• Quickstart — https://ansvar.eu/docs/quickstart
• Pricing — Free tier (B2B signup, 100 searches/day) → https://ansvar.eu/pricing
• Coverage — https://ansvar.eu/coverage
• Terms — https://ansvar.eu/terms
• llms.txt — https://ansvar.eu/llms.txt

Setting it up

Being a remote server, there is no local install. You register the endpoint with your client, authorise it once, and the tools appear.

Choosing this one

Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Ansvar: Threat Intelligence's toolset — list_coverage, Per, Endpoint and 7 more — is a fair guide to whether it matches your workflow. It is maintained by eu.ansvar; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.

Before you rely on it

• Your data travels to the provider's service, so the usual questions apply about what you send and what they retain.
• With 10 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Ansvar: Threat Intelligence.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the ansvar: threat intelligence mcp server does with a few real requests.