{"type":"mcp_server","name":"opencti-mcp","description":"The OpenCTI MCP Server provides a standardized interface for querying and retrieving threat intelligence data from the OpenCTI platform, offering features like searching for malware and managing users and groups.","category":"System Tools","language":"TypeScript","stars":39,"forks":5,"owner":"Spathodea-Network","github_url":"https://github.com/Spathodea-Network/opencti-mcp","homepage":null,"setup":"## Setup\n\n### Installing via Smithery\nTo install OpenCTI Server for Claude Desktop automatically via [Smithery](https://smithery.ai/server/opencti-server):\n\n```bash\nnpx -y @smithery/cli install opencti-server --client claude\n```\n\n### Manual Installation\n```bash\n# Clone the repository\ngit clone https://github.com/yourusername/opencti-mcp-server.git\n\n# Install dependencies\ncd opencti-mcp-server\nnpm install\n\n# Build the project\nnpm run build\n```\n\n## Configuration\n\n### Environment Variables\nCopy `.env.example` to `.env` and update with your OpenCTI credentials:\n```bash\ncp .env.example .env\n```\n\nRequired environment variables:\n- `OPENCTI_URL`: Your OpenCTI instance URL\n- `OPENCTI_TOKEN`: Your OpenCTI API token\n\n### MCP Settings\nCreate a configuration file in your MCP settings location:\n```json\n{\n  \"mcpServers\": {\n    \"opencti\": {\n      \"command\": \"node\",\n      \"args\": [\"path/to/opencti-server/build/index.js\"],\n      \"env\": {\n        \"OPENCTI_URL\": \"${OPENCTI_URL}\",  // Will be loaded from .env\n        \"OPENCTI_TOKEN\": \"${OPENCTI_TOKEN}\"  // Will be loaded from .env\n      }\n    }\n  }\n}\n```\n\n### Security Notes\n- Never commit `.env` file or API tokens to version control\n- Keep your OpenCTI credentials secure\n- The `.gitignore` file is configured to exclude sensitive files","tools":"## Available Tools\n\n1.  Fetch and search threat intelligence data (Get latest reports and search by ID, Search for malware information, Query indicators of compromise, Search for threat actors)\n2.  User and group management (List all users and groups, Get user details by ID)\n3.  STIX object operations (List attack patterns, Get campaign information by name)\n4.  System management (List connectors, View status templates)\n5.  File operations (List all files, Get file details by ID)\n6.  Reference data access (List marking definitions, View available labels)\n7.  Customizable query limits (Allows setting limits on queries)\n8.  Full GraphQL query support (Supports full GraphQL queries)","faq":null,"created_at":"2024-12-29T02:32:19+00:00","updated_at":"2025-03-22T07:17:34+00:00","source_url":"https://model-context-protocol.com/servers/opencti-threat-intelligence-query-management","related_articles":[]}