{"id":26937575,"url":"https://github.com/Spathodea-Network/opencti-mcp","last_synced_at":"2025-04-02T13:15:43.013Z","repository":{"id":270287130,"uuid":"909539706","full_name":"Spathodea-Network/opencti-mcp","owner":"Spathodea-Network","description":null,"archived":false,"fork":false,"pushed_at":"2025-01-30T15:28:18.000Z","size":54,"stargazers_count":1,"open_issues_count":0,"forks_count":2,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-01-30T16:33:47.129Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Spathodea-Network.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-12-29T02:32:19.000Z","updated_at":"2025-01-30T15:28:21.000Z","dependencies_parsed_at":null,"dependency_job_id":"abf19ca7-c53f-42e8-8045-e9b927f35d74","html_url":"https://github.com/Spathodea-Network/opencti-mcp","commit_stats":null,"previous_names":["spathodea-network/opencti-mcp"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Spathodea-Network%2Fopencti-mcp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Spathodea-Network%2Fopencti-mcp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Spathodea-Network%2Fopencti-mcp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Spathodea-Network%2Fopencti-mcp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Spathodea-Network","download_url":"https://codeload.github.com/Spathodea-Network/opencti-mcp/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246819781,"owners_count":20839095,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-04-02T13:15:22.411Z","updated_at":"2025-04-02T13:15:43.007Z","avatar_url":"https://github.com/Spathodea-Network.png","language":"TypeScript","funding_links":[],"categories":["Security","Community Servers","MCP 服务器精选列表","Table of Contents","Mcp Server Directories \u0026 Lists","🌐 Web Development","🗂️ Extensions by Category"],"sub_categories":["SIEM \u0026 SecOps","🔒 安全与分析","Security","🧠 Knowledge Base"],"readme":"# OpenCTI MCP Server\n\n[![smithery badge](https://smithery.ai/badge/opencti-server)](https://smithery.ai/server/opencti-server)\n[Traditional Chinese (繁體中文)](README.zh-TW.md)\n\n\u003ca href=\"https://glama.ai/mcp/servers/ml61kiz1gm\"\u003e\u003cimg width=\"380\" height=\"200\" src=\"https://glama.ai/mcp/servers/ml61kiz1gm/badge\" alt=\"OpenCTI Server MCP server\" /\u003e\u003c/a\u003e\n\n## Overview\nOpenCTI MCP Server is a Model Context Protocol (MCP) server that provides seamless integration with OpenCTI (Open Cyber Threat Intelligence) platform. It enables querying and retrieving threat intelligence data through a standardized interface.\n\n## Features\n- Fetch and search threat intelligence data\n  - Get latest reports and search by ID\n  - Search for malware information\n  - Query indicators of compromise\n  - Search for threat actors\n- User and group management\n  - List all users and groups\n  - Get user details by ID\n- STIX object operations\n  - List attack patterns\n  - Get campaign information by name\n- System management\n  - List connectors\n  - View status templates\n- File operations\n  - List all files\n  - Get file details by ID\n- Reference data access\n  - List marking definitions\n  - View available labels\n- Customizable query limits\n- Full GraphQL query support\n\n## Prerequisites\n- Node.js 16 or higher\n- Access to an OpenCTI instance\n- OpenCTI API token\n\n## Installation\n\n### Installing via Smithery\n\nTo install OpenCTI Server for Claude Desktop automatically via [Smithery](https://smithery.ai/server/opencti-server):\n\n```bash\nnpx -y @smithery/cli install opencti-server --client claude\n```\n\n### Manual Installation\n```bash\n# Clone the repository\ngit clone https://github.com/yourusername/opencti-mcp-server.git\n\n# Install dependencies\ncd opencti-mcp-server\nnpm install\n\n# Build the project\nnpm run build\n```\n\n## Configuration\n\n### Environment Variables\nCopy `.env.example` to `.env` and update with your OpenCTI credentials:\n```bash\ncp .env.example .env\n```\n\nRequired environment variables:\n- `OPENCTI_URL`: Your OpenCTI instance URL\n- `OPENCTI_TOKEN`: Your OpenCTI API token\n\n### MCP Settings\nCreate a configuration file in your MCP settings location:\n```json\n{\n  \"mcpServers\": {\n    \"opencti\": {\n      \"command\": \"node\",\n      \"args\": [\"path/to/opencti-server/build/index.js\"],\n      \"env\": {\n        \"OPENCTI_URL\": \"${OPENCTI_URL}\",  // Will be loaded from .env\n        \"OPENCTI_TOKEN\": \"${OPENCTI_TOKEN}\"  // Will be loaded from .env\n      }\n    }\n  }\n}\n```\n\n### Security Notes\n- Never commit `.env` file or API tokens to version control\n- Keep your OpenCTI credentials secure\n- The `.gitignore` file is configured to exclude sensitive files\n\n## Available Tools\n\n## Available Tools\n\n### Reports\n#### get_latest_reports\nRetrieves the most recent threat intelligence reports.\n```typescript\n{\n  \"name\": \"get_latest_reports\",\n  \"arguments\": {\n    \"first\": 10  // Optional, defaults to 10\n  }\n}\n```\n\n#### get_report_by_id\nRetrieves a specific report by its ID.\n```typescript\n{\n  \"name\": \"get_report_by_id\",\n  \"arguments\": {\n    \"id\": \"report-uuid\"  // Required\n  }\n}\n```\n\n### Search Operations\n#### search_malware\nSearches for malware information in the OpenCTI database.\n```typescript\n{\n  \"name\": \"search_malware\",\n  \"arguments\": {\n    \"query\": \"ransomware\",\n    \"first\": 10  // Optional, defaults to 10\n  }\n}\n```\n\n#### search_indicators\nSearches for indicators of compromise.\n```typescript\n{\n  \"name\": \"search_indicators\",\n  \"arguments\": {\n    \"query\": \"domain\",\n    \"first\": 10  // Optional, defaults to 10\n  }\n}\n```\n\n#### search_threat_actors\nSearches for threat actor information.\n```typescript\n{\n  \"name\": \"search_threat_actors\",\n  \"arguments\": {\n    \"query\": \"APT\",\n    \"first\": 10  // Optional, defaults to 10\n  }\n}\n```\n\n### User Management\n#### get_user_by_id\nRetrieves user information by ID.\n```typescript\n{\n  \"name\": \"get_user_by_id\",\n  \"arguments\": {\n    \"id\": \"user-uuid\"  // Required\n  }\n}\n```\n\n#### list_users\nLists all users in the system.\n```typescript\n{\n  \"name\": \"list_users\",\n  \"arguments\": {}\n}\n```\n\n#### list_groups\nLists all groups with their members.\n```typescript\n{\n  \"name\": \"list_groups\",\n  \"arguments\": {\n    \"first\": 10  // Optional, defaults to 10\n  }\n}\n```\n\n### STIX Objects\n#### list_attack_patterns\nLists all attack patterns in the system.\n```typescript\n{\n  \"name\": \"list_attack_patterns\",\n  \"arguments\": {\n    \"first\": 10  // Optional, defaults to 10\n  }\n}\n```\n\n#### get_campaign_by_name\nRetrieves campaign information by name.\n```typescript\n{\n  \"name\": \"get_campaign_by_name\",\n  \"arguments\": {\n    \"name\": \"campaign-name\"  // Required\n  }\n}\n```\n\n### System Management\n#### list_connectors\nLists all system connectors.\n```typescript\n{\n  \"name\": \"list_connectors\",\n  \"arguments\": {}\n}\n```\n\n#### list_status_templates\nLists all status templates.\n```typescript\n{\n  \"name\": \"list_status_templates\",\n  \"arguments\": {}\n}\n```\n\n### File Operations\n#### get_file_by_id\nRetrieves file information by ID.\n```typescript\n{\n  \"name\": \"get_file_by_id\",\n  \"arguments\": {\n    \"id\": \"file-uuid\"  // Required\n  }\n}\n```\n\n#### list_files\nLists all files in the system.\n```typescript\n{\n  \"name\": \"list_files\",\n  \"arguments\": {}\n}\n```\n\n### Reference Data\n#### list_marking_definitions\nLists all marking definitions.\n```typescript\n{\n  \"name\": \"list_marking_definitions\",\n  \"arguments\": {}\n}\n```\n\n#### list_labels\nLists all available labels.\n```typescript\n{\n  \"name\": \"list_labels\",\n  \"arguments\": {}\n}\n```\n\n## Contributing\nContributions are welcome! Please feel free to submit pull requests.\n\n## License\nMIT License\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FSpathodea-Network%2Fopencti-mcp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FSpathodea-Network%2Fopencti-mcp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FSpathodea-Network%2Fopencti-mcp/lists"}