Truss Threat Intelligence MCP Server

Truss Threat Intelligence MCP server is a hosted integration for AI assistants that speak the Model Context Protocol. Query Truss threat intelligence via hosted MCP (OAuth). Growth+ plans.

What you get

Truss threat intelligence via Model Context Protocol and a terminal assistant — one binary: truss-mcp.

Setting it up

Being a remote server, there is no local install. You register the endpoint with your client, authorise it once, and the tools appear.

What the assistant can call

Once Truss Threat Intelligence is connected, these are the calls the assistant has available:

• Context — only follow-ups (IOC dedupe, reformat) use thread history without re-querying
• You — your message
• MCP — live tool trace (→ search_threats on remote, or → search_products on stdio)
• Results — structured product table before the assistant summary
• Truss — assistant reply (cyan), guided offers (yellow), FilterQL blocks (magenta)
• Surface — Use for
• Variable — Required for
• TRUSS_API_KEY — local mcp / stdio search
• TRUSS_MCP_URL — remote search / doctor
• TRUSS_MCP_OAUTH_TOKEN_FILE — remote search
• LLM_PROVIDER — search
• LLM_MODEL — search

Configuration and credentials

You will need 5 environment variables: TRUSS_API_KEY, YOUR_KEY, TRUSS_MCP_URL, ANTHROPIC_API_KEY, OPENAI_API_KEY. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.

Before you rely on it

• Your data travels to the provider's service, so the usual questions apply about what you send and what they retain.
• With 12 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Truss Threat Intelligence.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the truss threat intelligence mcp server does with a few real requests.

Choosing this one

Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Truss Threat Intelligence's toolset — Context, You, MCP and 9 more — is a fair guide to whether it matches your workflow. It is maintained by com.truss-security; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.