misp-mcp
ActiveAn IOC lands in your queue and MISP makes you click through events, correlations, and warninglists to decide if it matters. misp-mcp hands the whole threat-intel platform to your agent: search events, correlate indicators across the graph, check false positives, and export detections, answered in plain language over stdio.
See it workrepresentative session
Representative session. Illustrative values, RFC 5737 addresses. Your MISP data never leaves the box.
What it does
Point any MCP client at misp-mcp and your MISP threat-intelligence instance becomes tools the agent can call: search events and attributes, correlate a value across every event, attach MITRE ATT&CK galaxy clusters, check warninglists for false positives, and export indicators as Suricata, Snort, STIX, CSV, RPZ, or hash lists. It talks to MISP's own REST API and speaks stdio, so there is no new listening service. Unlike a generic HTTP wrapper it ships 36 purpose-built tools plus MISP-aware resources and prompts, and read paths are safe by default while destructive writes (delete, publish, tag-removal) refuse to run without an explicit confirmation flag.
Capabilities36 tools across the platform
Events
6 toolsSearch, read, create, update, publish, and tag threat-intel events.
Attributes & correlation
7 toolsSearch IOCs, add one or many, and correlate a value across the whole event graph.
Exports & sightings
4 toolsExport IOCs as Suricata/Snort/STIX/CSV/RPZ or hashes; report sightings and check warninglists.
Tags, objects & galaxies
10 toolsManage tags and structured objects; search and attach MITRE ATT&CK clusters and threat actors.
Feeds, orgs & server
9 toolsManage threat-intel feeds, list sharing partners and groups, read server status and diagnostics.
Setup
npm i -g misp-mcp (or npx -y misp-mcp)
Configure with MISP_URL and MISP_API_KEY. Set MISP_VERIFY_SSL=false for self-signed certs.
{ "mcpServers": { "misp": { "command": "npx", "args": ["-y", "misp-mcp"], "env": { "MISP_URL": "https://misp.example.com", "MISP_API_KEY": "your-api-key-here", "MISP_VERIFY_SSL": "false" } } } }