Overview

OpenCTI MCP Server exposes OpenCTI (Open Cyber Threat Intelligence) data through a Model Context Protocol (MCP) server so downstream LLMs and tools can query threat intelligence using a consistent, extensible interface. It bridges OpenCTI’s GraphQL API and MCP-capable clients, normalizing common operations (search, fetch, list) into callable tools that are easy to integrate into automated pipelines, chat assistants, and other orchestration layers.

For developers, this server simplifies authentication, paging, and object mapping so you can focus on use cases such as enrichment, alert triage, or analyst-facing assistants. The server supports the full OpenCTI GraphQL surface while also providing higher-level, purposeful endpoints (reports, indicators, malware, actors, files, users, STIX objects) that match typical threat intelligence workflows.

Features

Standardized MCP tool endpoints for OpenCTI objects: reports, malware, indicators, threat actors, campaigns, attack patterns.
Search and retrieval with pagination and configurable limits.
User and group management endpoints for identity-aware workflows.
File and artifact access (list and get by ID).
STIX object convenience operations (attack patterns, campaigns).
System and connector introspection (connectors, status templates).
Reference data listing (marking definitions, labels).
Direct passthrough for arbitrary GraphQL queries when advanced access is required.
Configurable via environment variables and MCP server settings; safe-by-default .gitignore.

Installation / Configuration

Prerequisites:

Node.js 16+
Access to an OpenCTI instance
Valid OpenCTI API token

Install via Smithery (recommended for quick deploys):

npx -y @smithery/cli install opencti-server --client claude

Manual install from source:

# Clone repository
git clone https://github.com/Spathodea-Network/opencti-mcp.git
cd opencti-mcp

# Install dependencies and build
npm install
npm run build

Environment variables:

OPENCTI_URL — OpenCTI instance base URL (e.g. https://opencti.example.com)
OPENCTI_TOKEN — API token with appropriate read permissions

Copy and update the example environment file:

cp .env.example .env
# edit .env to add OPENCTI_URL and OPENCTI_TOKEN

Sample MCP server configuration (JSON) for use with an MCP runtime:

{
  "mcpServers": {
    "opencti": {
      "command": "node",
      "args": ["./build/index.js"],
      "env": {
        "OPENCTI_URL": "${OPENCTI_URL}",
        "OPENCTI_TOKEN": "${OPENCTI_TOKEN}"
      }
    }
  }
}

Security notes:

Do not commit .env or tokens to version control.
Limit token permissions to only the scopes required for your workflows.
Use network controls to restrict access to the MCP server where appropriate.

Available Tools

The server exposes a set of MCP tools (name + arguments) that map to common OpenCTI operations. The table below lists representative tools and their purpose.

Tool name	Purpose
get_latest_reports	Fetch recent intelligence reports (paged)
get_report_by_id	Retrieve a report by UUID
search_malware	Search malware objects by text query
search_indicators	Search indicators of compromise
search_threat_actors	Search threat actor profiles
list_attack_patterns	List ATT&CK-style attack patterns
get_campaign_by_name	Retrieve a campaign by name
list_connectors	List configured OpenCTI connectors
list_files / get_file_by_id	List or fetch files/artifacts
list_marking_definitions / list_labels	Reference data endpoints
list_users / get_user_by_id / list_groups	User and group management

Example MCP call payload (get latest reports):

{
  "name": "get_latest_reports",
  "arguments": { "first": 10 }
}

Advanced option: send raw GraphQL via the server to leverage OpenCTI’s full schema when you need custom fields or complex queries.

Use Cases

SIEM enrichment: On incoming alerts, call search_indicators or get_report_by_id to attach related OpenCTI context (malware family, actor attribution, TTPs) before alerting analysts.
Analyst assistant: Integrate into a chat agent that answers natural-language questions like “Show the latest reports mentioning Conti,” using get_latest_reports + search_malware and returning summaries and links.
Automated playbooks: A SOAR workflow can list_connectors and list_status_templates to determine integration points and then call search_threat_actors to prioritize response paths.
Threat hunting: Bulk export of indicators via search_indicators to feed into detection content development or IOC ingestion pipelines.
Research pipelines: Use list_attack_patterns and get_campaign_by_name to programmatically assemble STIX-derived threat models for red-team planning or mapping to MITRE ATT&CK.

Examples

Fetch a malware search (MCP payload):

{
  "name": "search_malware",
  "arguments": {
    "query": "ransomware",
    "first": 25
  }
}

Retrieve a file by UUID:

{
  "name": "get_file_by_id",
  "arguments": { "id": "file-uuid" }
}

Execute a custom GraphQL query (example CLI wrapper or via the MCP passthrough):

query GetReport($id: ID!) {
  report(id: $id) {
    id
    name
    published
    createdBy {
      name
    }
    objectRefs {
      id
      entity_type
    }
  }
}

Resources

Source code / issues: https://github.com/Spathodea-Network/opencti-mcp
OpenCTI documentation: https://www.opencti.io
MCP specification: consult your MCP runtime or Smithery docs for server integration details

Contributions and pull requests are welcome; follow the repository’s contributing guidelines and ensure secrets are never committed.

OpenCTI MCP Server: Standardized Threat Data Access