Otx

MCP server for AlienVault OTX threat intelligence: indicators, pulses, search, and users.

Connector by w0h1v · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)★ 1

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/w0h1v-otx

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

MCP server for AlienVault OTX threat intelligence: indicators, pulses, search, and users.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools: 19 read · 9 write · 0 delete · 1 not yet classified
Secrets: 1 (API keys, tokens or passwords)
Install scripts: Not scanned yet
Runs as: Python package

Tools by what they do 29

Read from the source code; the running server may list different tools.

Read 19 · Look things up without changing anything.

get_current_user
get_indicator_details
get_pulse_details
get_pulse_events
get_pulse_indicators
get_related_pulses
get_subscribed_pulse_ids
get_user
list_indicator_types
list_my_pulses
list_pulse_activity
list_submitted_files

Show 7 more tools

list_submitted_urls
list_subscribed_pulses
list_user_pulses
search_pulses
search_related_pulses
search_users
validate_indicator

Write 9 · Create, change, send or run things.

create_pulse
follow_user
submit_url
submit_urls
subscribe_pulse
subscribe_user
unfollow_user
unsubscribe_pulse
unsubscribe_user

Not yet classified 1 · We could not tell from the name and description.

export_indicators

Secrets and settings it asks for

Secrets: values you paste in that let it act as you.

OTX_API_KEY

Other settings (environment variables or headers).

OTX_MCP_READ_WRITE

Tools (29)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

create_pulse
Create a new OTX pulse owned by the authenticated user. Validate indicators with validate_indicator first. Each indicator is {"type": <indicator type name>, "indicator": <value>, "description": "..."}. Args: name: Pulse title. description: Markdown description of the threat. public: Whether the pulse is publicly visible. tlp: TLP marking: white, green, amber or red. tags: Threat tags (e.g. ["malware", "rat"]). references: Reference URLs. indicators: Indicators to include; see validate_indicator. Returns: The created pulse (with its new ID).
export_indicators
Bulk export indicators across all subscribed pulses (feed sync). Args: types: Indicator type names to include (e.g. ["domain", "IPv4", "FileHash-SHA256"]); omit for all types. limit: Results per page (1-500). page: 1-based page number. modified_since: ISO 8601 timestamp; only return indicators from pulses modified after this time. Returns: Paginated indicator export from OTX.
follow_user
Follow a user (their activity shows in your OTX dashboard).
get_current_user
Get the authenticated user's own OTX profile (whoami). Handy to confirm which account the API key belongs to.
get_indicator_details
Get threat intelligence details for an indicator from AlienVault OTX. This is the primary indicator lookup tool. It covers every OTX indicator type and detail section in one call. Args: indicator_type: URL path type. One of: IPv4, IPv6, domain, hostname, file (any hash: MD5/SHA1/SHA256/PEHASH/IMPHASH), url, cve, nids, correlation-rule. indicator_value: The indicator itself (IP address, domain, file hash, URL, CVE id...). section: Detail section to retrieve. Availability depends on type: IPv4/IPv6: general, geo, reputation, url_list, passive_dns, …
get_pulse_details
Get full details of an OTX pulse by ID. Includes name, author, description, TLP, tags, references, threat categories (Adversary, Malware, TTPs) and the pulse's indicators. Args: pulse_id: 24-character hex pulse ID (from search results, activity feeds, or OTX URLs). Returns: Pulse metadata with its indicator list (capped at 50 shown).
get_pulse_events
List events from your subscription stream (pulse lifecycle changes). Useful for incremental sync: each event carries an `action` field (e.g. remove_pulse) naming what happened to which pulse. Args: limit: Results per page (1-500). page: 1-based page number. modified_since: ISO 8601 timestamp cutoff. Returns: Paginated subscription-stream events.
get_pulse_indicators
List the indicators contained in a pulse (paginated). Args: pulse_id: 24-character hex pulse ID. limit: Results per page (1-1000). page: 1-based page number. include_inactive: Include indicators the pulse author deactivated. Returns: Paginated indicator list for the pulse.
get_related_pulses
Get pulses that share indicators (IOCs) with the given pulse. Args: pulse_id: 24-character hex pulse ID. limit: Results per page (1-500). page: 1-based page number. Returns: Paginated related pulses.
get_subscribed_pulse_ids
Get just the IDs of your subscribed pulses (lightweight sync). Args: limit: Results per page (1-500). page: 1-based page number. Returns: Paginated pulse-ID list.
get_user
Get an OTX user's profile. Args: username: OTX username. detailed: Include the user's recent pulses in the response. Returns: User profile (subscriber/follower counts, bio, avatar, pulses).
list_indicator_types
List every indicator type usable in OTX pulses, with descriptions. Use this to discover valid indicator_type values for validate_indicator and create_pulse.
list_my_pulses
List pulses authored by the authenticated user (your own pulses). Args: limit: Results per page (1-500). page: 1-based page number. Returns: Paginated list of your pulses.
list_pulse_activity
List the latest pulses across the whole OTX community. Args: limit: Results per page (1-500). page: 1-based page number. modified_since: ISO 8601 timestamp cutoff. Returns: Paginated activity-stream pulses.
list_submitted_files
List files previously submitted for analysis by your account. Args: limit: Results per page (1-500). page: 1-based page number. Returns: Paginated submitted-file status list.

Show 14 more tools

list_submitted_urls
List URLs previously submitted for analysis by your account. Args: limit: Results per page (1-500). page: 1-based page number. Returns: Paginated submitted-URL status list.
list_subscribed_pulses
List pulses from your OTX subscriptions. Includes pulses you subscribed to, pulses from users and groups you follow, and pulses you created. Args: limit: Results per page (1-500). page: 1-based page number. modified_since: ISO 8601 timestamp; only pulses created or modified after this time. Returns: Paginated list of subscribed pulses.
list_user_pulses
List pulses authored by a specific OTX user. Args: username: OTX username. limit: Results per page (1-500). page: 1-based page number. Returns: Paginated pulse list authored by the user.
search_pulses
Full-text search across all public OTX pulses. The best starting point for threat research: search for a malware family, actor, campaign or technology and get matching pulses with their IDs, then pull details or indicators. Args: query: Search terms. limit: Results per page (1-500). page: 1-based page number. Returns: Paginated matching pulses.
search_related_pulses
Find pulses related to a pulse, malware family, or adversary. Pass exactly ONE of pulse_id, malware_family or adversary. For a pulse, returns other pulses sharing some of the same IOCs; for a malware family or adversary, returns pulses tagged with it. Args: pulse_id: Pulse to find related pulses for. malware_family: Malware family name. NOTE: OTX's malware_family filtering is currently unreliable (it returns no results regardless of value); use search_pulses with the family name instead. adversary: Adversary name (e.g. "Equation Group"). limit: Results…
search_users
Search OTX users by username. Args: query: Username (or fragment) to search for. limit: Results per page (1-500). page: 1-based page number. Returns: Paginated matching users.
submit_url
Submit a URL to OTX for analysis. OTX will visit the URL and analyze returned content. Results appear via get_indicator_details with indicator_type "url". Args: url: The URL to analyze. tlp: TLP marking for the submission: white, green, amber or red. Returns: Submission result from OTX.
submit_urls
Submit multiple URLs to OTX for bulk analysis. Args: urls: URLs to analyze. tlp: TLP marking for the submissions: white, green, amber or red. Returns: Bulk submission result from OTX.
subscribe_pulse
Subscribe to a pulse so its indicators enter your feeds.
subscribe_user
Subscribe to a user; their pulses enter your subscribed feed.
unfollow_user
Unfollow a user.
unsubscribe_pulse
Unsubscribe from a pulse.
unsubscribe_user
Unsubscribe from a user.
validate_indicator
Validate an indicator value/type pair before using it in a pulse. Args: indicator: The indicator value to validate. indicator_type: OTX indicator type name, e.g. IPv4, domain, FileHash-SHA256, URL, CVE, YARA, JA3, Mutex, CIDR, email. description: Optional description used during validation. Returns: Validation result from OTX (includes access_type and expiration).

Signals

Stars: 1
Forks: 0
Open issues: 0
Weekly downloads: 31
Last commit: Oct 12, 2026 (16 days ago)
Last release: Oct 12, 2026 (16 days ago)
Last package publish: Oct 12, 2026 (16 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name: io.github.w0h1v/otx
Version: 1.2.0
Auth: API key
Packages: pypi otx-mcp
License: MIT
Repository: github.com/w0h1v/mcp-otx
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: Official MCP Registry github-graphql

More from w0h1v

Cite this page

Otx MCP server. Agent Mart. https://agentmart.dev/connectors/w0h1v-otx (last updated 2026-10-24)