Polarity MCP Connector

Connect Claude to your self-hosted Polarity instance via the Model Context Protocol.

Enables Claude to:

• Discover all running integrations on your Polarity server
• Parse indicators of compromise (IPs, domains, hashes, URLs) from any text
• Query integrations and return enriched threat intelligence results — in real time, inside a conversation

Prerequisites

• A running Polarity server (v5.7 or later)
• A Polarity user account with API key access
• Node.js ≥ 18

Setup

1. Generate a Polarity API Key

In the Polarity web interface: Settings → API Keys → Create API Key

2. Configure Claude Desktop

Add the following to your claude_desktop_config.json:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "polarity": {
      "command": "npx",
      "args": ["-y", "@polarityio/mcp-connector"],
      "env": {
        "POLARITY_SERVER_URL": "https://polarity.yourcompany.com",
        "POLARITY_TOKEN": "your-api-key-here"
      }
    }
  }
}

Restart Claude Desktop. You should see the Polarity tools appear in the tools panel.

Available Tools

| Tool | Description | |------|-------------| | list_available_integrations | Discover all running integrations and their supported entity types | | do_integration_lookup | Look up a query string against a specific integration | | parse_entities | Extract typed IOCs (IP, domain, hash, URL, email) from text |

Example Prompts

"What Polarity integrations are available?"

"Look up 8.8.8.8 using the VirusTotal integration."

"Parse all the IP addresses and domains from this log line: [2025-01-15] src=192.168.1.5 dst=185.220.101.42 host=evil.example.com"

"Check if malware.bazaar.abuse.ch is in any of my threat intel integrations."

License

MIT