# opencti-mcp

> MCP Server

The OpenCTI MCP Server provides a standardized interface for querying and retrieving threat intelligence data from the OpenCTI platform, offering features like searching for malware and managing users and groups.

## Overview

- **Category:** System Tools
- **Language:** TypeScript
- **Stars:** 40
- **Forks:** 5
- **Owner:** Spathodea-Network
- **GitHub:** https://github.com/Spathodea-Network/opencti-mcp
- **Created:** 2024-12-29T02:32:19+00:00
- **Updated:** 2025-03-22T07:17:34+00:00
- **Source:** https://model-context-protocol.com/servers/opencti-threat-intelligence-query-management

## Setup

## Setup

### Installing via Smithery
To install OpenCTI Server for Claude Desktop automatically via [Smithery](https://smithery.ai/server/opencti-server):

```bash
npx -y @smithery/cli install opencti-server --client claude
```

### Manual Installation
```bash
# Clone the repository
git clone https://github.com/yourusername/opencti-mcp-server.git

# Install dependencies
cd opencti-mcp-server
npm install

# Build the project
npm run build
```

## Configuration

### Environment Variables
Copy `.env.example` to `.env` and update with your OpenCTI credentials:
```bash
cp .env.example .env
```

Required environment variables:
- `OPENCTI_URL`: Your OpenCTI instance URL
- `OPENCTI_TOKEN`: Your OpenCTI API token

### MCP Settings
Create a configuration file in your MCP settings location:
```json
{
  "mcpServers": {
    "opencti": {
      "command": "node",
      "args": ["path/to/opencti-server/build/index.js"],
      "env": {
        "OPENCTI_URL": "${OPENCTI_URL}",  // Will be loaded from .env
        "OPENCTI_TOKEN": "${OPENCTI_TOKEN}"  // Will be loaded from .env
      }
    }
  }
}
```

### Security Notes
- Never commit `.env` file or API tokens to version control
- Keep your OpenCTI credentials secure
- The `.gitignore` file is configured to exclude sensitive files

## Tools

## Available Tools

1.  Fetch and search threat intelligence data (Get latest reports and search by ID, Search for malware information, Query indicators of compromise, Search for threat actors)
2.  User and group management (List all users and groups, Get user details by ID)
3.  STIX object operations (List attack patterns, Get campaign information by name)
4.  System management (List connectors, View status templates)
5.  File operations (List all files, Get file details by ID)
6.  Reference data access (List marking definitions, View available labels)
7.  Customizable query limits (Allows setting limits on queries)
8.  Full GraphQL query support (Supports full GraphQL queries)