MCP Servers / database / OpenCTI MCP Server

OpenCTI MCP Server

JSON →
httpnone38database

Integrates with the OpenCTI platform to query and retrieve threat intelligence data.

Install
How to run this server
[ { "cmd": "npx -y @smithery/cli", "imports": [] } ]
server path: opencti-mcp-server
Tools
What this server exposes
search_threat_actors
Search for threat actors in OpenCTI
get_threat_actor
Get details of a specific threat actor
search_intrusion_sets
Search for intrusion sets in OpenCTI
get_intrusion_set
Get details of a specific intrusion set
search_campaigns
Search for campaigns in OpenCTI
get_campaign
Get details of a specific campaign
search_indicators
Search for indicators in OpenCTI
get_indicator
Get details of a specific indicator
search_observables
Search for observables in OpenCTI
get_observable
Get details of a specific observable
search_reports
Search for reports in OpenCTI
get_report
Get details of a specific report
search_vulnerabilities
Search for vulnerabilities in OpenCTI
get_vulnerability
Get details of a specific vulnerability
search_malware
Search for malware in OpenCTI
get_malware
Get details of a specific malware
search_tools
Search for tools in OpenCTI
get_tool
Get details of a specific tool
search_attack_patterns
Search for attack patterns in OpenCTI
get_attack_pattern
Get details of a specific attack pattern
search_courses_of_action
Search for courses of action in OpenCTI
get_course_of_action
Get details of a specific course of action
search_identities
Search for identities in OpenCTI
get_identity
Get details of a specific identity
search_locations
Search for locations in OpenCTI
get_location
Get details of a specific location
search_labels
Search for labels in OpenCTI
get_label
Get details of a specific label
search_kill_chain_phases
Search for kill chain phases in OpenCTI
get_kill_chain_phase
Get details of a specific kill chain phase
search_external_references
Search for external references in OpenCTI
get_external_reference
Get details of a specific external reference
search_notes
Search for notes in OpenCTI
get_note
Get details of a specific note
search_opinions
Search for opinions in OpenCTI
get_opinion
Get details of a specific opinion
search_relationships
Search for relationships in OpenCTI
get_relationship
Get details of a specific relationship
create_indicator
Create a new indicator in OpenCTI
create_observable
Create a new observable in OpenCTI
create_report
Create a new report in OpenCTI
create_threat_actor
Create a new threat actor in OpenCTI
create_intrusion_set
Create a new intrusion set in OpenCTI
create_campaign
Create a new campaign in OpenCTI
create_malware
Create a new malware in OpenCTI
create_tool
Create a new tool in OpenCTI
create_vulnerability
Create a new vulnerability in OpenCTI
create_attack_pattern
Create a new attack pattern in OpenCTI
create_course_of_action
Create a new course of action in OpenCTI
create_identity
Create a new identity in OpenCTI
create_location
Create a new location in OpenCTI
create_note
Create a new note in OpenCTI
create_opinion
Create a new opinion in OpenCTI
create_relationship
Create a new relationship in OpenCTI
update_indicator
Update an existing indicator in OpenCTI
update_observable
Update an existing observable in OpenCTI
update_report
Update an existing report in OpenCTI
update_threat_actor
Update an existing threat actor in OpenCTI
update_intrusion_set
Update an existing intrusion set in OpenCTI
update_campaign
Update an existing campaign in OpenCTI
update_malware
Update an existing malware in OpenCTI
update_tool
Update an existing tool in OpenCTI
update_vulnerability
Update an existing vulnerability in OpenCTI
update_attack_pattern
Update an existing attack pattern in OpenCTI
update_course_of_action
Update an existing course of action in OpenCTI
update_identity
Update an existing identity in OpenCTI
update_location
Update an existing location in OpenCTI
update_note
Update an existing note in OpenCTI
update_opinion
Update an existing opinion in OpenCTI
delete_indicator
Delete an indicator from OpenCTI
delete_observable
Delete an observable from OpenCTI
delete_report
Delete a report from OpenCTI
delete_threat_actor
Delete a threat actor from OpenCTI
delete_intrusion_set
Delete an intrusion set from OpenCTI
delete_campaign
Delete a campaign from OpenCTI
delete_malware
Delete a malware from OpenCTI
delete_tool
Delete a tool from OpenCTI
delete_vulnerability
Delete a vulnerability from OpenCTI
delete_attack_pattern
Delete an attack pattern from OpenCTI
delete_course_of_action
Delete a course of action from OpenCTI
delete_identity
Delete an identity from OpenCTI
delete_location
Delete a location from OpenCTI
delete_note
Delete a note from OpenCTI
delete_opinion
Delete an opinion from OpenCTI
delete_relationship
Delete a relationship from OpenCTI
Configuration
Environment & auth
authnone
envOPENCTI_URL
envOPENCTI_TOKEN
Resources
OpenCTI MCP Server — MCP Server · libregistry