IntelThreadlinqs MCP Server

Model Context Protocol server for Threadlinqs Intelligence Platform

Access threat intelligence, detections (SPL/KQL/Sigma), IOCs, and MITRE ATT&CK mappings directly from your AI assistant.

Features

Resources

• threadlinqs://threats - All threats in the platform
• threadlinqs://detections - All detection rules
• threadlinqs://iocs - All indicators of compromise
• threadlinqs://stats - Platform statistics

Tools

| Tool | Description | |------|-------------| | search_threats | Search by keyword, CVE, or MITRE technique | | get_threat | Get detailed threat information by ID | | get_detections | Get detections filtered by type/threat/technique | | search_iocs | Search indicators of compromise | | get_mitre_coverage | View MITRE ATT&CK coverage | | get_recent_threats | Get recently added threats | | export_detection | Export detection in SPL/KQL/Sigma/JSON format |

Installation

npm install intelthreadlinqs-mcp

Or clone and build:

git clone https://github.com/threadlinqs-cmd/threadlinqs-Intelligence.git
cd threadlinqs-Intelligence/mcp-server
npm install
npm run build

Configuration

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "intelthreadlinqs": {
      "command": "npx",
      "args": ["intelthreadlinqs-mcp"],
      "env": {
        "THREADLINQS_DATA_DIR": "/path/to/threadlinqs-Intelligence"
      }
    }
  }
}

OpenClaw / mcporter

# Add to mcporter config
mcporter config add intelthreadlinqs --command "npx intelthreadlinqs-mcp" --env THREADLINQS_DATA_DIR=/path/to/data

# Or run ad-hoc
mcporter call --stdio "npx intelthreadlinqs-mcp" search_threats query="ransomware"

Cursor / VS Code

Add to .cursor/mcp.json or .vscode/mcp.json:

{
  "servers": {
    "intelthreadlinqs": {
      "command": "npx",
      "args": ["intelthreadlinqs-mcp"],
      "env": {
        "THREADLINQS_DATA_DIR": "${workspaceFolder}"
      }
    }
  }
}

Usage Examples

Search for Threats

Use the search_threats tool to find threats related to "ransomware"

Get Detection Rules

Get all Sigma rules for threat TL-2026-0073

Export Detection

Export detection TL-2026-0073-DET-001 in Sigma format

Check MITRE Coverage

Show me the MITRE ATT&CK coverage for execution techniques

Recent Threats

What threats were added in the last 3 days?

Environment Variables

| Variable | Description | Default | |----------|-------------|---------| | THREADLINQS_DATA_DIR | Path to threats.json directory | Current directory parent |

Development

# Install dependencies
npm install

# Run in development mode
npm run dev

# Build for production
npm run build

# Run production build
npm start

API Reference

search_threats

Search threats by keyword, CVE ID, or MITRE technique.

Parameters:

• query (required): Search string
• severity: Filter by level (critical/high/medium/low)
• limit: Max results (default: 10)

get_threat

Get full details for a specific threat.

Parameters:

• threat_id (required): Threat ID (e.g., TL-2026-0001)

get_detections

Retrieve detections with optional filters.

Parameters:

• threat_id: Filter by threat
• type: Detection type (spl/kql/sigma/all)
• mitre_technique: Filter by technique ID (e.g., T1059)

search_iocs

Search for indicators of compromise.

Parameters:

• query (required): IOC value to search
• type: IOC type filter (ip/domain/hash/url/all)

get_mitre_coverage

View MITRE ATT&CK technique coverage.

Parameters:

• tactic: Filter by tactic name

get_recent_threats

Get recently added threats.

Parameters:

• days: Lookback period (default: 7)
• limit: Max results (default: 10)

export_detection

Export a detection in a specific format.

Parameters:

• detection_id (required): Detection ID
• format (required): Output format (spl/kql/sigma/json)

License

MIT

Built with 🦞 by ThreatClawer