ThreatBook Threat Analysis

by naxg

274 downloads

Not rated

GitHub

About

Provides threat intelligence queries for IPs, domains, files, URLs, and vulnerabilities using the ThreatBook API.

Details

Author: naxg
Downloads: 274
Categories: Search, Knowledge Base, Security, Other
Tags: #web-research

- Complete 15‑tool interface to Threatbook threat intelligence API.
- IP reputation, analysis, and advanced queries.
- Domain analysis, context, subdomain, and advanced queries.
- File analysis, multi‑engine detection, and upload.
- URL scanning, reputation reports, and vulnerability intelligence.
- IOC detection for IPs and domains.

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name ThreatBook Threat Analysis

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "threatbook threat analysis": {
            "threatbook": {
                "command": "python",
                "args": [
                    "/path/to/your/ThreatMCP/run_server.py"
                ],
                "env": {
                    "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "threatbook threat analysis": {
            "threatbook": {
                "command": "python",
                "args": [
                    "/path/to/your/ThreatMCP/run_server.py"
                ],
                "env": {
                    "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "threatbook threat analysis": {
            "threatbook": {
                "command": "python",
                "args": [
                    "/path/to/your/ThreatMCP/run_server.py"
                ],
                "env": {
                    "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
                }
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "threatbook threat analysis": {
            "threatbook": {
                "command": "python",
                "args": [
                    "/path/to/your/ThreatMCP/run_server.py"
                ],
                "env": {
                    "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "threatbook threat analysis": {
            "threatbook": {
                "command": "python",
                "args": [
                    "/path/to/your/ThreatMCP/run_server.py"
                ],
                "env": {
                    "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "threatbook threat analysis": {
            "threatbook": {
                "command": "python",
                "args": [
                    "/path/to/your/ThreatMCP/run_server.py"
                ],
                "env": {
                    "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
                }
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "threatbook threat analysis": {
            "threatbook": {
                "command": "python",
                "args": [
                    "/path/to/your/ThreatMCP/run_server.py"
                ],
                "env": {
                    "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "threatbook threat analysis": {
            "threatbook": {
                "command": "python",
                "args": [
                    "/path/to/your/ThreatMCP/run_server.py"
                ],
                "env": {
                    "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "threatbook threat analysis": {
            "threatbook": {
                "command": "python",
                "args": [
                    "/path/to/your/ThreatMCP/run_server.py"
                ],
                "env": {
                    "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
                }
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "threatbook threat analysis": {
            "threatbook": {
                "command": "python",
                "args": [
                    "/path/to/your/ThreatMCP/run_server.py"
                ],
                "env": {
                    "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "threatbook threat analysis": {
            "threatbook": {
                "command": "python",
                "args": [
                    "/path/to/your/ThreatMCP/run_server.py"
                ],
                "env": {
                    "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "threatbook threat analysis": {
            "threatbook": {
                "command": "python",
                "args": [
                    "/path/to/your/ThreatMCP/run_server.py"
                ],
                "env": {
                    "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
                }
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "threatbook threat analysis": {
            "threatbook": {
                "command": "python",
                "args": [
                    "/path/to/your/ThreatMCP/run_server.py"
                ],
                "env": {
                    "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "threatbook threat analysis": {
            "threatbook": {
                "command": "python",
                "args": [
                    "/path/to/your/ThreatMCP/run_server.py"
                ],
                "env": {
                    "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "threatbook threat analysis": {
            "threatbook": {
                "command": "python",
                "args": [
                    "/path/to/your/ThreatMCP/run_server.py"
                ],
                "env": {
                    "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
                }
            }
        }
    }
}

From the repository

Install dependencies with pip install -r requirements.txt, set the THREATBOOK_API_KEY environment variable with your Threatbook API key, and run the server via run_server.py. Configuration is provided for Claude Desktop and it is compatible with any MCP client.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "threatbook threat analysis": {
            "threatbook": {
                "command": "python",
                "args": [
                    "/path/to/your/ThreatMCP/run_server.py"
                ],
                "env": {
                    "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
                }
            }
        }
    }
}

McpServers

{
    "threatbook": {
        "command": "python",
        "args": [
            "/path/to/your/ThreatMCP/run_server.py"
        ],
        "env": {
            "THREATBOOK_API_KEY": "\u8bf7\u66ff\u6362\u4e3a\u60a8\u7684\u5fae\u6b65\u5728\u7ebf\u5a01\u80c1\u5206\u6790API\u5bc6\u94a5"
        }
    }
}

这是一个基于微步在线威胁分析API的MCP（Model Context Protocol）服务器，提供完整的情报查询功能。支持微步在线威胁分析API的全部15个工具，包括IP分析、域名分析、文件检测、URL扫描、漏洞情报等。

- 🔍IP信誉查询: 查询IP地址的安全信誉信息
- 🌍IP分析: 获取IP地理位置、ASN信息、威胁类型等
- 📈IP高级查询: 获取IP历史解析记录、端口信息等

- 🌐域名分析: 获取域名解析IP、Whois信息、威胁类型等
- 📊域名高级查询: 获取域名历史Whois、历史解析IP信息
- 🔍域名上下文查询: 针对恶意域名查询上下文信息
- 🌿子域名查询: 获取域名的子域名信息

- 📄文件信誉报告: 获取文件详细的静态和动态分析报告
- 🔬反病毒引擎检测: 获取文件经过22款反病毒扫描引擎检测结果
- 📤文件上传分析: 上传文件进行沙箱分析

- 🌐URL扫描: 对URL进行扫描分析
- 📋URL信誉报告: 获取URL扫描引擎检测结果

- 🛡️漏洞情报: 获取公开漏洞的基础信息、风险评估、PoC等
- 🎯产品漏洞匹配: 通过厂商产品匹配功能聚合相关漏洞

# 进入项目目录 cd ThreatMCP # 安装依赖（自动生成的精确依赖） pip install -r requirements.txt

- mcp- Model Context Protocol核心包
- pydantic- 数据验证库
- requests- HTTP请求库

export THREATBOOK_API_KEY="your_threatbook_api_key_here"

{ "mcpServers": { "threatbook": { "command": "python", "args": ["/path/to/your/ThreatMCP/run_server.py"], "env": { "THREATBOOK_API_KEY": "your_api_key_here" } } } }

- command: 使用python命令
- args: 使用完整绝对路径运行run_server.py脚本
- env: 设置微步在线威胁分析API密钥环境变量

注意: 请将路径/path/to/your/ThreatMCP/run_server.py替换为您实际的项目路径

结合 AI SSH 工具和威胁情报，可以实现智能化的 Linux 系统安全应急分析：

# AI 通过 SSH 连接到可疑系统 ssh user@suspicious-server # 检查系统基本状态 ps aux | grep -E "(bitcoin|mining|crypto)" netstat -tulpn | grep LISTEN

- 可疑 IP 分析: 使用ip_reputation和ip_analysis工具分析系统中发现的外部连接 IP
- 域名威胁检测: 通过domain_analysis检查系统 DNS 查询记录中的可疑域名
- 文件哈希验证: 使用file_analysis分析可疑文件的 MD5/SHA256 哈希值

# 发现可疑外连 IP: 192.168.1.100 # AI 自动调用威胁情报 API 进行分析

- 调用ip_reputation查询该 IP 的信誉信息
- 使用ip_analysis获取 IP 地理位置、ASN、历史威胁记录
- 通过ioc_detection检测是否为已知的失陷指标

- 🎯威胁等级评估: 基于多维度情报数据
- 📊攻击链分析: 关联分析攻击者的 TTPs
- 🛡️处置建议: 提供具体的安全加固措施

- 自动化分析: AI 自动执行系统检查和威胁情报查询
- 关联分析: 将系统日志与全球威胁情报进行关联
- 实时响应: 快速识别威胁并提供处置建议
- 知识积累: 基于历史案例不断优化分析策略
- 提升响应速度: 从小时级缩短到分钟级
- 降低误报率: 基于权威威胁情报源进行验证
- 标准化流程: 确保应急响应的一致性和完整性
- 知识传承: AI 助手可以传承专家经验

注意: 此功能需要配合支持 SSH 的 AI 工具使用，如 Claude Desktop 配合 SSH MCP 服务器等。

本MCP服务器提供微步在线威胁分析API的完整15个工具，覆盖所有威胁情报分析场景：
- ip_reputation- IP信誉查询
- ip_analysis- IP分析
- ip_advanced- IP高级查询
- ioc_detection- 失陷检测
- domain_analysis- 域名分析
- domain_advanced- 域名高级查询
- domain_context- 域名上下文查询
- subdomain- 子域名查询
- file_analysis- 文件信誉报告
- file_multiengines- 文件反病毒引擎检测
- file_upload- 提交文件分析
- vulnerability- 漏洞情报
- vuln_match- 产品漏洞匹配

ThreatMCP/ ├── threatbook_mcp/ # 核心包目录 │ ├── __init__.py # 包初始化 │ ├── server.py # MCP服务器核心 │ ├── response_handler.py # 统一响应处理 │ ├── ip_reputation.py # IP信誉查询 │ ├── ip_analysis.py # IP分析 │ ├── ip_advanced.py # IP高级查询 │ ├── ioc_detection.py # 失陷检测 │ ├── domain_analysis.py # 域名分析 │ ├── domain_advanced.py # 域名高级查询 │ ├── domain_context.py # 域名上下文查询 │ ├── subdomain.py # 子域名查询 │ ├── file_analysis.py # 文件信誉报告 │ ├── file_multiengines.py # 文件反病毒检测 │ ├── file_upload.py # 文件上传分析 │ ├── url_scan.py # URL扫描 │ ├── url_report.py # URL信誉报告 │ ├── vulnerability.py # 漏洞情报 │ └── vuln_match.py # 产品漏洞匹配 ├── run_server.py # 🚀 服务器启动脚本（主入口） ├── requirements.txt # 项目依赖 ├── README.md # 项目说明 └── config_example.json # Claude Desktop配置示例

Search global news using natural language. Webz.io News Search API returns the most relevant articles and content, with filters for source, country, language, date, sentiment, and category.

Search, audit, and install from 117K+ open-source AI agent skills & MCP servers — every result carries a security grade (SAFE/CAUTION/UNSAFE/UNAUDITED) and quality score checked BEFORE installing. Local cached index, works offline, no auth. Install: npx -y @agentskillshub/mcp

Search and compare 1,113 curated AI tools by pricing, rating, features and alternatives — hosted, no-auth Streamable HTTP.

BudgetFitter is a free UK deal discovery platform with a public MCP server. Search verified discount codes, look up brand intelligence, and navigate deals — no auth required.

Cinematography reference library. Search film stills from 5,489 films by lighting, lens character, shot size, colour and mood. Remote server, four tools, OAuth, free tier.

Read-only remote MCP server (no auth): live search of 100,000+ fine jewelry products with prices, availability, and store policies.

Search a curated board of customer-experience jobs where AI is part of the actual work. Filter by role pillar, region, and seniority; get featured roles, board stats, and CX+AI hiring Insights. Free, remote MCP, no auth — https://cx-jobs.lorikeet.tools/api/mcp

Find the meme, chart, or infographic that explains any topic — hosted, no auth, no signup, with paste-ready citations and directly embeddable image URLs.

Verified job search — every listing confirmed live and accepting applicants within the last 72 hours; read-only, no auth required.

Search your Plex media library. Supports OAuth and static token authentication.

Search jobs, companies, candidates, and salaries from Armenia's #1 job platform - 12 tools, no auth required.

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Jump to

Setting up with Highlight

From the repository

Claude Desktop / Cursor

McpServers

Install

More like this

Aws Kb Retrieval Server

Memory

Brave Search

Context 7

🔎 GPT Researcher

MaxKB