MCP server

Threatcluster

io.github.Jam0k/threatcluster

Checked 25 Oct 2026, 20:29 UTC · It answered and asked for a sign-in

Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.

Source

At a glance

Type

MCP server

Publisher

Not verified

Status

Needs a sign-in or key

Sets up in

Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok

Last checked

25 Oct 2026, 20:29 UTC

Connect it to your agent

Add to CursorAdd to VS CodeVS Code Insiders

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http threatcluster https://threatcluster.io/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.threatcluster]
url = "https://threatcluster.io/mcp"

Gemini CLI

{"mcpServers":{"threatcluster":{"httpUrl":"https://threatcluster.io/mcp"}}}

Cursor

{"mcpServers":{"threatcluster":{"url":"https://threatcluster.io/mcp"}}}

VS Code

{"servers":{"threatcluster":{"type":"http","url":"https://threatcluster.io/mcp"}}}

Antigravity

agy mcp add threatcluster https://threatcluster.io/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"threatcluster","server_url":"https://threatcluster.io/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"threatcluster","server_url":"https://threatcluster.io/mcp"}

Needs a sign-in or an API key from its maker.

Browse

• GitHub tools
• GitHub and code hosting

Related MCP servers

• data-breach-detector
  Read-only breach intel, full history 2007-today: reports THAT an org was breached, never the data.
• Tooloracle Cybershield
  CyberShield - 12 cybersecurity tools: NIS2 mapping, MITRE ATT&CK, vulns, threat intel.
• Theaslangroupllc Pulsenetwork
  914 paid market-data & token-safety endpoints — keyless x402 USDC: Base, Solana, XRPL, +8 chains
• Dragons Eye Ransomware Claims
  Ransomware claim lookups, IOC and CVE intel, group intel, bulk checks and watch alerts (x402 USDC).
• Alienvault Otx
  AlienVault OTX MCP — Open Threat Exchange (free with key)
• OrionCMD Checks
  Domain threat checks, a 30-day domain watch, TLS/DNS/email-auth checks and a $2 site audit (x402).
• OT Intel API
  OT/ICS threat intel for AI agents: 40 tools, pay per call in USDC on Base via x402.
• PG1 Sovereign Threat Intelligence
  Preflight for AI agents, signed: one call; wallet, domain, IP abuse, package checks and CVEs.

Badge for your README

[![AptLynx](https://aptlynx.net/badge/io.github.Jam0k/threatcluster.svg)](https://aptlynx.net/servers/io.github.Jam0k/threatcluster)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents