Threadlinqs Intelligence MCP Server for AI Agents

The Threadlinqs Intelligence MCP server gives an AI assistant read access to this cyber-threat-intelligence corpus over the Model Context Protocol. Version 8.2.0 publishes 81 read-only tools and 25 analyst-playbook prompts across two transports that share one catalog: a remote Streamable-HTTP endpoint at POST https://intel.threadlinqs.com/mcp (JSON-RPC 2.0, MCP protocol version 2025-11-25, OAuth 2.1) and a local stdio server published as the npm package intelthreadlinqs-mcp.

The corpus those tools read holds 3,219 profiled threats, 29,410 detection rules in Splunk SPL, Microsoft KQL and Sigma, 78,538 extracted indicators of compromise and 4,846 enriched CVE records, counted 2026-10-26. Data as of 2026-10-26.

The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. The tool catalog itself is public; every MCP tool CALL requires a Purple or Gold subscription (tier 3 or above).

Tools (81)

• Threats — search_threats, get_threat, get_threat_enrichment, get_recent_threats, get_similar_threats, get_threat_bundle, get_threat_hunting_bundle, bulk_get_threats, list_threat_categories, get_threat_transcripts
• Hunt — hunt, hunt_schema, search_corpus_semantic
• Pivots — get_malware_intelligence, get_tool_intelligence, get_campaign_intelligence, list_campaigns, resolve_entity, get_entity_aliases, get_entity_profile
• Detections — get_detections, search_detections, get_detection_detail, export_detection
• Simulations — get_threat_simulations, list_simulations
• Flows — get_attack_flow, get_flow_similar_threats, get_flow_coverage, get_d3fend_posture, get_atlas_intelligence
• IOCs — search_iocs, get_ioc_intelligence, get_ioc_dns
• OSINT — get_osint, search_xscan_indicators, get_osint_trends, get_community_campaigns
• Graph — get_ioc_blast_radius, get_infrastructure_pivots, explain_correlation, get_correlation_path, get_pivotal_entities, get_graph_campaigns, get_correlation_subgraph
• Attribution — get_attribution_evidence, get_attribution_coverage
• C2 infrastructure — get_c2, generate_c2_blocklist, get_c2_dns_intel
• Correlations — get_correlations, get_enrichment_overview, get_technique_rules, get_engine_status
• MITRE ATT&CK — get_mitre_coverage, get_mitre_technique, predict_mitre_transitions, get_mitre_gap_analysis
• Vulnerabilities — get_cve, get_cwe, search_vulnerabilities, get_cve_intelligence, bulk_get_cves
• Actors — get_actor, search_actors, get_actor_intelligence, get_actor_relationships
• Debriefs — list_debriefs, get_debrief, get_latest_debrief, get_daily_intel_bundle
• Landscape — get_landscape_briefing, get_daily_theme, get_threat_level, get_platform_stats
• Exports — export_stix, export_attack_navigator
• Platform — get_started, health, get_roadmap, get_changelog

Prompt playbooks (25)

triage_cve, profile_actor, hunt_ioc, map_detections_to_mitre, daily_brief, assess_exposure, build_c2_blocklist, hunt_corpus, explain_link, map_campaign, review_detection_gaps, write_detection, review_attribution, predict_next_move, malware_dossier, pivot_infrastructure, osint_sweep, export_for_tooling, plan_purple_team, sweep_vulnerabilities, period_review, platform_status, orient, research_question, bulk_enrich

Connect and discover

• Full documentation in Markdown: /mcp.md.
• Machine-readable catalog, no key required: /mcp/catalog.json.
• Discovery manifest: /.well-known/mcp.json.
• Portable agent skill: /mcp/skill.md.
• Source (MIT): github.com/threadlinqs-cmd/intelthreadlinqs-mcp.

The same corpus is readable in a browser without an account: daily debrief, live CVE feed, ATT&CK coverage map, platform statistics. Machine-readable overview: /llms.txt.