{
  "schema_version": "2025-06-18",
  "name": "threadlinqs-intelligence",
  "version": "8.2.0",
  "description": "Threadlinqs Intelligence threat-intel MCP server: 81 read-only tools and 25 analyst-playbook prompts over threats, detections (SPL/KQL/Sigma), IOCs, CVEs/CWEs, MITRE ATT&CK coverage and techniques, threat-actor attribution, C2 infrastructure, correlations, and STIX 2.1 / ATT&CK Navigator export. Search tools return compact summary rows with composable structured filters; full detail is fetched on demand. Available as a remote Streamable-HTTP endpoint and a local stdio npm package. Purple-tier feature — every tool requires authentication and tier >= 3.",
  "documentation": "https://intel.threadlinqs.com/mcp",
  "transport": [
    "streamable-http",
    "stdio"
  ],
  "remotes": [
    {
      "url": "https://intel.threadlinqs.com/mcp",
      "transport": "streamable-http"
    }
  ],
  "package": {
    "registry": "npm",
    "name": "intelthreadlinqs-mcp",
    "transport": "stdio"
  },
  "authentication": {
    "tier_required": "purple",
    "note": "Purple or Gold subscription (tier >= 3) required for every tool on both transports.",
    "stdio": {
      "type": "bearer",
      "scheme": "tl_",
      "env": "THREADLINQS_API_KEY",
      "note": "Create a Purple/Gold API key (tl_...) in your Threadlinqs profile."
    },
    "remote": {
      "type": "oauth2",
      "note": "OAuth 2.1 (authorization code + PKCE S256) for Claude.ai and other MCP hosts; code/CLI hosts may instead pass a Purple/Gold Bearer tl_ API key. Authorization requires Purple/Gold (tier >= 3).",
      "protected_resource_metadata": "https://intel.threadlinqs.com/.well-known/oauth-protected-resource",
      "authorization_servers": [
        "https://intel.threadlinqs.com"
      ],
      "authorization_server_metadata": "https://intel.threadlinqs.com/.well-known/oauth-authorization-server",
      "authorization_endpoint": "https://intel.threadlinqs.com/oauth/authorize",
      "token_endpoint": "https://intel.threadlinqs.com/oauth/token",
      "scopes_supported": [
        "mcp"
      ],
      "code_challenge_methods_supported": [
        "S256"
      ]
    }
  },
  "access": {
    "tier_required": 3,
    "tier_name": "purple",
    "note": "The MCP server (both transports) is a Purple/Gold-only feature — every tool and resource requires authentication and tier >= 3. Public SEO pages and the REST API keep their own tiering.",
    "upgrade_url": "https://threadlinqs.com/#pricing"
  },
  "website": "https://intel.threadlinqs.com"
}