misp-mcp

Active

An IOC lands in your queue and MISP makes you click through events, correlations, and warninglists to decide if it matters. misp-mcp hands the whole threat-intel platform to your agent: search events, correlate indicators across the graph, check false positives, and export detections, answered in plain language over stdio.

GitHub repo → npm: misp-mcp →
36 tools3 resources3 promptswrite-gatedNode 20+MIT

See it work

one question, the tools it calls, the answer

representative session · claude + misp-mcp
We're seeing beacons to 203.0.113.50. Is it already in MISP, and is it a known false positive?
misp_correlate{ value: "203.0.113.50" }
2 events, 4 attributes 1187 APT-29 infra staging ip-dst tlp:amber published 1042 cobalt-strike c2 sweep ip-dst tlp:red published
misp_check_warninglists{ value: "203.0.113.50" }
no match on 0 of 84 lists (not a known benign indicator)
misp_export_iocs{ event: 1187, format: "suricata" }
alert ip any any -> 203.0.113.50 any (msg:"MISP e1187 ip-dst"; sid:5001187;)
203.0.113.50 is real, not a false positive. It's tied to two published events including APT-29 staging infra, and clean across all 84 warninglists. Here's a Suricata rule from event 1187 to deploy now.

Representative session. Illustrative values, RFC 5737 addresses. Your MISP data never leaves the box.

What it does

Point any MCP client at misp-mcp and your MISP threat-intelligence instance becomes tools the agent can call: search events and attributes, correlate a value across every event, attach MITRE ATT&CK galaxy clusters, check warninglists for false positives, and export indicators as Suricata, Snort, STIX, CSV, RPZ, or hash lists. It talks to MISP's own REST API and speaks stdio, so there is no new listening service. Unlike a generic HTTP wrapper it ships 36 purpose-built tools plus MISP-aware resources and prompts, and read paths are safe by default while destructive writes (delete, publish, tag-removal) refuse to run without an explicit confirmation flag.

Capabilities

36 tools across the platform

Events6 tools
Search, read, create, update, publish, and tag threat-intel events.
Attributes & correlation7 tools
Search IOCs, add one or many, and correlate a value across the whole event graph.
Exports & sightings4 tools
Export IOCs as Suricata/Snort/STIX/CSV/RPZ or hashes; report sightings and check warninglists.
Tags, objects & galaxies10 tools
Manage tags and structured objects; search and attach MITRE ATT&CK clusters and threat actors.
Feeds, orgs & server9 tools
Manage threat-intel feeds, list sharing partners and groups, read server status and diagnostics.
Full reference on GitHub →

Set it up

npm i -g misp-mcp (or npx -y misp-mcp)

Configure with MISP_URL and MISP_API_KEY. Set MISP_VERIFY_SSL=false for self-signed certs.

MCP client config 
{ "mcpServers": { "misp": { "command": "npx", "args": ["-y", "misp-mcp"], "env": { "MISP_URL": "https://misp.example.com", "MISP_API_KEY": "your-api-key-here", "MISP_VERIFY_SSL": "false" } } } }
[ shield ]

Read paths are safe by default. State-changing and destructive tools (delete, publish, tag-removal) refuse to run without confirm: true, and permanent hard deletes require a second confirmHard: true that the MISP_ALLOW_DESTRUCTIVE opt-in cannot bypass. A guarded call returns a Refused error and performs no MISP request.

36
MCP tools
3
resources
3
prompts
MIT
license