# Threadlinqs Intelligence - pricing and access tiers

The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server.

Canonical HTML page: https://threadlinqs.com/pricing

## Tiers

### Blue - Analyst (tier 1)

- Price: free
- Unlocks: Full detection query text (Splunk SPL, Microsoft KQL, Sigma), the threat feed, MITRE ATT&CK coverage and daily debriefs.
- REST API quota: 50 requests/day

### Red - Professional (tier 2)

- Price: 4.99 USD/month
- Unlocks: Everything in Blue, plus raw indicator (IOC) values, IOC correlation and DNS lookups.
- REST API quota: 500 requests/day

### Purple - SME (tier 3)

- Price: 11.99 USD/month
- Unlocks: Everything in Red, plus the MCP server, attack simulations, advanced correlations and Wild C2 intelligence.
- REST API quota: 5000 requests/day

### Gold - Team (tier 4)

- Price: no published price - enterprise enquiry only (contact@threadlinqs.com)
- Unlocks: Everything in Purple, plus SecOS for Teams, tenant audit and offboarding, shared case files and SLA-backed support.
- REST API quota: 25000 requests/day

## Notes

- Tier 0 is an unverified account. The whole corpus is readable with no account at all.
- Every MCP tool call requires tier 3 or above (Purple or Gold). The tool catalog itself is public: https://intel.threadlinqs.com/mcp.md
- Purple includes a 7-day free trial. No contracts; cancel anytime.
- Gold is a tenant contract sized per organisation. There is no self-serve checkout and no published figure - email contact@threadlinqs.com.
- Subscribe or change plan: https://threadlinqs.com/#pricing