Skip to content
Agentmart
Submit a tool

Best MCP servers for threat intelligence

We found 147 MCP servers for threat intelligence in the catalog; these are the 15 that rank highest. The order comes from our rank, which weighs adoption, freshness, documentation and publisher identity. Nobody can pay for a place on this list. OpenOSINT, Robin: AI-Powered Dark Web OSINT and Reversecore MCP lead it. OneUptime and isMalicious threat intelligence for AI agents are published by the company that makes them. OneUptime has the most GitHub stars here (7,751). 15 of the 15 had activity in the last 30 days. Remote servers need no local install; local ones run on your machine and can reach local files. Each entry lists why it made the list and links to its install page.

Updated Oct 26, 2026 · Built from catalog data; how we rank and grade

Top 15 of 147

  1. 1
    OpenOSINT

    OpenOSINT

    AI-powered OSINT agent & MCP server.

    • 1.8K GitHub stars
    • Most weekly downloads here (1.1K)
    • Active in the last 30 days

    ★ 1.8K↓ 1.1K/wkLast active Oct 22, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  2. 2
    Robin: AI-Powered Dark Web OSINT

    apurvsinghgautam

    Dark web OSINT over Tor: search onion engines, scrape pages, report with your own model.

    • 7.7K GitHub stars
    • Active in the last 30 days
    • Open source (MIT)

    ★ 7.7KLast active Oct 3, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  3. 3
    Reversecore MCP

    sjkim1127

    Security-first MCP server for reverse engineering, malware analysis, forensics, and SAST.

    • Active in the last 30 days
    • Open source (MIT)

    ★ 212↓ 170/wkLast active Oct 17, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  4. 4
    OneUptime

    oneuptime.comOfficial

    Manage incidents, alerts, monitors, status pages, on-call and telemetry in OneUptime.

    • Published by the vendor
    • Most GitHub stars here (7,751)
    • Remote server, no local install

    ★ 7.8KLast active Oct 26, 2026Remote (HTTP)Claude Code, VS Code, Cursor, Windsurf

  5. 5
    Shodan

    w0h1v

    MCP server for Shodan API — device search, IP and domain recon, DNS, and CVE/CPE queries.

    • Active in the last 30 days
    • Open source (MIT)

    ★ 178↓ 313/wkLast active Oct 12, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  6. 6
    Virustotal

    w0h1v

    MCP server for querying VirusTotal API with comprehensive security analysis tools.

    • Active in the last 30 days
    • Open source (MIT)

    ★ 151↓ 333/wkLast active Oct 20, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  7. 7
    VirusTotal

    VirusTotal

    Official VirusTotal MCP server: threat reports, file and URL submissions, and analysis recovery.

    • Runs locally or as a remote server
    • Active in the last 30 days
    • Open source (Apache-2.0)

    ★ 21↓ 114/wkLast active Oct 14, 2026Local (stdio), Remote (HTTP)Claude Code, VS Code, Codex, Cursor +2

  8. 8
    Cyberbro MCP Server

    stanfrbd

    MCP server for Cyberbro IOC extraction, enrichment and reputation analysis.

    • Active in the last 30 days
    • Open source (MIT)

    ★ 19↓ 142/wkLast active Oct 18, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  9. 9
    Supply Chain Guard

    homeofe

    Supply-chain malware scanner and MCP server: vet packages in 15 ecosystems before install, offline.

    • Active in the last 30 days
    • Open source (Apache-2.0)

    ★ 7Last active Oct 24, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  10. 10
    OSINT Toolbox

    renkagod

    Run Sherlock, Maigret, Holehe, GHunt, theHarvester, SpiderFoot and more OSINT tools locally

    • Active in the last 30 days
    • Open source (MIT)

    ★ 2↓ 100/wkLast active Oct 23, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  11. 11
    DugganUSA CLI — Local STDIO MCP

    pduggusa

    Local STDIO MCP for DugganUSA threat intel.

    • Active in the last 30 days
    • Open source (MIT)

    ★ 2Last active Oct 23, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  12. 12
    Osint Agent Skills

    frangelbarrera

    OSINT MCP server — 23 tools: DNS, WHOIS, Shodan, breaches, GEOINT, crypto.

    • Active in the last 30 days
    • Open source (MIT)

    ★ 38↓ 24/wkLast active Oct 2, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  13. 13
    isMalicious threat intelligence for AI agents

    ismalicious.comOfficial

    Reputation for IPs, domains, URLs, hashes, emails, phones; CVEs; injection and email scans

    • Published by the vendor
    • Runs locally or as a remote server
    • Active in the last 30 days

    ↓ 248/wkLast active Oct 23, 2026Local (stdio), Remote (HTTP)Claude Code, VS Code, Codex, Cursor +2

  14. 14
    Flagrix

    flagrix-io

    Scan GitHub repos and profiles for malware before cloning — commit-pinned risk verdicts for agents

    • Active in the last 30 days
    • Open source (MIT)

    ★ 2Last active Oct 21, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  15. 15
    Proofpoint

    wyre-technology

    MCP server for Proofpoint TAP — threat intelligence, forensics, quarantine, and email security.

    • Active in the last 30 days
    • Open source (Apache-2.0)

    ★ 5Last active Oct 14, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

Related