Mcp Server Misp

Name: Mcp Server Misp
Author: gbrigandi

by gbrigandi

MCP Server for MISP

9 tools GitHub

No known CVEs

No license

Maintained

Last commit 174d ago

Works with most clients

Transport: stdio, http

9 tools · ~405 tok

Grade A · 0.2% of 200K ctx

Edit this pageView history

Security

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "misp": {
      "env": {
        "MISP_URL": "https://misp.example.com",
        "MISP_API_KEY": "your-api-key"
      },
      "command": "/path/to/mcp-server-misp"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/mcp-server-misp)](https://mcppedia.org/s/mcp-server-misp)

Read me

What Mcp Server Misp does

An MCP (Model Context Protocol) server that provides access to MISP threat intelligence platform.

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

63/100across 5 weighted dimensions

How we score →

0255075100

−37

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Inventory

Tools (9)

Click any tool to inspect its schema.

~405 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Mcp Server Misp safe to use?: Mcp Server Misp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install Mcp Server Misp?: Mcp Server Misp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can Mcp Server Misp do?: Mcp Server Misp provides 9 tools: search_misp_ioc, get_misp_event_context, check_misp_warninglist, get_misp_sightings, get_misp_iocs_by_type and 4 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with Mcp Server Misp?: Mcp Server Misp is compatible with claude-desktop, cursor, claude-code. It uses stdio and http transport.
Is Mcp Server Misp actively maintained?: Mcp Server Misp is less actively maintained — last commit was 174 days ago.

Similar servers

Others in security

View all →

Evil Mcp Server93

An evil MCP server used for redteam testing

30 1

Ida Pro Mcp92

AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

9.0k 3

io.github.jasonxkensei/xproof92

Proof primitive for AI agents on MultiversX. Anchor file hashes on-chain as verifiable proofs.

1 1

Nothumanallowed91

Security-first platform for AI agents. 38 specialized agents, 15 AI-powered extensions, zero-knowledge multi-agent orchestration. SENTINEL WAF, Ed25519 auth, 2.6M grounding facts.

97 5

MCP Security Weekly

Get CVE alerts and security updates for Mcp Server Misp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

{ "mcpServers": { "misp": { "env": { "MISP_URL": "https://misp.example.com", "MISP_API_KEY": "your-api-key" }, "command": "/path/to/mcp-server-misp" } } }

Tools

Tool

Description

search_misp_ioc

Search for an IOC (IP, domain, hash, URL, email)

get_misp_event_context

Get full event details including tags and galaxies

check_misp_warninglist

Check if a value is on warninglists (false positive detection)

get_misp_sightings

Get sighting history for an IOC

get_misp_iocs_by_type

Extract IOCs by attribute type (ip-dst, domain, sha256, etc.)

search_misp_by_tag

Search attributes by tag (tlp:red, malware:emotet, etc.)

get_misp_recent_iocs

Get IOCs added within a time window

get_misp_threat_actor_iocs

Get IOCs attributed to a threat actor

list_misp_galaxies

List available MISP galaxies

Variable

Description

Default

MISP_URL

MISP API base URL

required

MISP_API_KEY

MISP API key

required

MISP_VERIFY_SSL

Verify SSL certificates

true

RUST_LOG

Logging level

info

Usage

stdio transport (default)

./mcp-server-misp

HTTP transport

./mcp-server-misp --transport http --host 127.0.0.1 --port 8080

MCP Client Configuration

{ "mcpServers": { "misp": { "command": "/path/to/mcp-server-misp", "env": { "MISP_URL": "https://misp.example.com", "MISP_API_KEY": "your-api-key" } } } }

Frequently Asked Questions

Is Mcp Server Misp safe to use?

Mcp Server Misp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install Mcp Server Misp?

Mcp Server Misp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can Mcp Server Misp do?

Mcp Server Misp provides 9 tools: search_misp_ioc, get_misp_event_context, check_misp_warninglist, get_misp_sightings, get_misp_iocs_by_type and 4 more. See the full tools list on the server page for descriptions and parameters.

What AI clients work with Mcp Server Misp?

Mcp Server Misp is compatible with claude-desktop, cursor, claude-code. It uses stdio and http transport.

Is Mcp Server Misp actively maintained?

Mcp Server Misp is less actively maintained — last commit was 174 days ago.

MCP Server for MISP

An MCP (Model Context Protocol) server that provides access to MISP threat intelligence platform.

Overview

This server bridges MCP clients and MISP, enabling:

IOC lookups and enrichment
Threat actor intelligence
Event context retrieval
Warninglist validation
Tag and galaxy exploration

Tools

Tool	Description
`search_misp_ioc`	Search for an IOC (IP, domain, hash, URL, email)
`get_misp_event_context`	Get full event details including tags and galaxies
`check_misp_warninglist`	Check if a value is on warninglists (false positive detection)
`get_misp_sightings`	Get sighting history for an IOC
`get_misp_iocs_by_type`	Extract IOCs by attribute type (ip-dst, domain, sha256, etc.)
`search_misp_by_tag`	Search attributes by tag (tlp:red, malware:emotet, etc.)
`get_misp_recent_iocs`	Get IOCs added within a time window
`get_misp_threat_actor_iocs`	Get IOCs attributed to a threat actor
`list_misp_galaxies`	List available MISP galaxies

Installation

Pre-compiled Binaries

Download from GitHub Releases.

Building from Source

git clone https://github.com/gbrigandi/mcp-server-misp
cd mcp-server-misp
cargo build --release

For HTTP transport support:

cargo build --release --features http

Configuration

Environment variables:

Variable	Description	Default
`MISP_URL`	MISP API base URL	required
`MISP_API_KEY`	MISP API key	required
`MISP_VERIFY_SSL`	Verify SSL certificates	`true`
`RUST_LOG`	Logging level	`info`

Example .env:

MISP_URL=https://misp.example.com
MISP_API_KEY=your-api-key
MISP_VERIFY_SSL=true

Usage

stdio transport (default)

./mcp-server-misp

HTTP transport

./mcp-server-misp --transport http --host 127.0.0.1 --port 8080

MCP Client Configuration

{
  "mcpServers": {
    "misp": {
      "command": "/path/to/mcp-server-misp",
      "env": {
        "MISP_URL": "https://misp.example.com",
        "MISP_API_KEY": "your-api-key"
      }
    }
  }
}

Testing

cargo test
cargo test --features http --test mcp_http_test

License

MIT