opencti-mcp
opencti-mcp is an MCP server, listed under security. It reaches opencti. It needs OPENCTI_TOKEN to authenticate. Its repository has 40 GitHub stars and is licensed under MIT; we last read it on 2026-10-25.
Serves as a server for querying threat intelligence, indicators, reports, malware, and threat actors from OpenCTI.
Install
MCP servers are packaged differently from each other -- some run via npx, some as a Docker image, some as a plain script you clone and run. opencti-mcp’s own README did not state one plainly enough for this page to quote it rather than guess, so it will not guess. The repository below states it.
What it reaches, and what it needs
Maintenance
MCP server for querying OpenCTI threat intelligence, indicators, reports, malware, and threat actors.
What opencti-mcp can do
16 tools documented in its README. An AI client calls these by name.
get_latest_reports- Retrieves the most recent threat intelligence reports.
get_report_by_id- Retrieves a specific report by its ID.
search_malware- Searches for malware information in the OpenCTI database.
search_indicators- Searches for indicators of compromise.
search_threat_actors- Searches for threat actor information.
get_user_by_id- Retrieves user information by ID.
list_users- Lists all users in the system.
list_groups- Lists all groups with their members.
list_attack_patterns- Lists all attack patterns in the system.
get_campaign_by_name- Retrieves campaign information by name.
list_connectors- Lists all system connectors.
list_status_templates- Lists all status templates.
get_file_by_id- Retrieves file information by ID.
list_files- Lists all files in the system.
list_marking_definitions- Lists all marking definitions.
list_labels- Lists all available labels.
Read from the README; names are kept only if the README contains them.
opencti-mcp compared with similar servers
| Server | Reaches | Needs | Stars | Last update | Licence |
|---|---|---|---|---|---|
| opencti-mcp (this page) | opencti | OPENCTI_TOKEN | 40 | 2026-08-03 | MIT |
| ida-pro-mcp | — | None listed | 13,080 | 2026-09-26 | MIT |
| mcp-shodan | shodan | SHODAN_API_KEY | 178 | 2026-10-19 | MIT |
| mcp-server-idapro | — | None listed | 103 | 2025-03-26 | MIT |
| search-solodit-mcp | — | None listed | 42 | 2025-06-30 | — |
| MalwareBazaar_MCP | malwarebazaar | MALWAREBAZAAR_API_KEY | 30 | 2025-11-26 | Apache-2.0 |
Ranked by services in common with opencti-mcp, then by stars. Figures are from each repository when we last read it.
Common questions about opencti-mcp
- What does opencti-mcp do?
- Serves as a server for querying threat intelligence, indicators, reports, malware, and threat actors from OpenCTI.
- How do I install opencti-mcp?
- Its README did not state an install command plainly enough for us to quote one, so we do not guess. The repository has the instructions: https://github.com/zxzinn/opencti-mcp
- What does opencti-mcp connect to, and what does it need?
- It reaches opencti. The credentials we found in its source are OPENCTI_TOKEN.
- Is opencti-mcp official and is it maintained?
- We found nothing naming it as a vendor’s official server. Its repository has 40 GitHub stars and its state in our directory is listed. Its last commit we recorded was on 2026-08-03.
- What licence does opencti-mcp use?
- The repository declares the MIT licence.
More MCP servers for security
- ida-pro-mcp13,080 stars
- mcp-shodan178 stars
- mcp-server-idapro103 stars
- search-solodit-mcp42 stars
- MalwareBazaar_MCP30 stars
- kali-mcp26 stars