ThreatMCP MCP Server

Threatmcp mcp server connects ThreatMCP to AI assistants that speak the Model Context Protocol. 这是一个基于微步在线威胁分析API的MCP（Model Context Protocol）服务器，提供完整的情报查询功能。支持微步在线威胁分析API的全部15个工具，包括IP分析、域名分析、文件检测、URL扫描、漏洞情报等。.

What ThreatMCP does

这是一个基于微步在线威胁分析API的MCP（Model Context Protocol）服务器，提供完整的情报查询功能。支持微步在线威胁分析API的全部15个工具，包括IP分析、域名分析、文件检测、URL扫描、漏洞情报等。

Installing the threatmcp mcp server

Setup follows the standard MCP pattern: clone or install the server, then register it in your client's configuration file and restart the client. The configuration snippets on this page cover Claude Desktop, Claude Code and Cursor.

Configuration

Before the server will start you need to supply one environment variable: THREATBOOK_API_KEY. Keep credentials in your client's env block or a secrets manager rather than committing them.

Where it fits

Developer-tool servers are usually the first ones people connect, because they turn "help me with this code" into an assistant that can actually read the repo and act on it. ThreatMCP sits in that group. Worth comparing against the other developer tools servers in this directory before you commit to one, since several overlap in scope but differ sharply in setup cost and permissions.

Practical notes

• This server runs locally, so it operates with whatever access your machine and its credentials already have. Scope that deliberately rather than by default.
• It will not start until its required credentials are present, so set those before wondering why the tools never appear.
• Maintained by NAXG, written in Python.
• MCP clients ask for confirmation before each tool call by default. Keep that on while you learn what the threatmcp mcp server actually does with your data.
• Every entry in this directory is reviewed by hand before it goes live, and details are checked against the project's own documentation.