OpenCTI MCP Server
MCP server for OpenCTI — an open-source threat intelligence platform for storing, analyzing, and sharing cyber threat intelligence. Enables AI agents to query threat indicators, retrieve threat actor profiles, search IOCs (Indicators of Compromise), and interact with OpenCTI's knowledge graph for AI-assisted threat analysis and SOC workflows.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Sensitive CTI data. API token. HTTPS. Least-privilege roles. CTI includes attribution data.
⚡ Reliability
Best When
A security team using OpenCTI for threat intelligence management wants AI agents to query CTI data, retrieve threat indicators, and assist with automated threat analysis during SOC investigations.
Avoid When
You use other TI platforms (MISP, ThreatConnect, Recorded Future). Community tool — not official Filigran integration. Also: CTI data sensitivity — implement proper access controls.
Use Cases
- • Querying threat intelligence indicators from AI SOC analysis agents
- • Retrieving threat actor TTPs from threat hunting agents
- • Searching IOCs and malware signatures from incident response agents
- • Integrating OpenCTI CTI data into AI-driven security operations workflows
Not For
- • Teams without OpenCTI deployed
- • Non-security use cases (CTI-specific platform)
- • Real-time threat blocking (CTI is for intelligence, not prevention)
Interface
Authentication
OpenCTI API token required. Generate in OpenCTI user profile. Use least-privilege roles for agent access.
Pricing
OpenCTI Community Edition is free open source. MCP server is community tool. Enterprise Filigran has support.
Agent Metadata
Known Gotchas
- ⚠ OpenCTI uses GraphQL API — ensure MCP handles GraphQL query construction correctly
- ⚠ CTI data sensitivity: threat indicators are security-sensitive — restrict agent access carefully
- ⚠ Community tool (CooperCyberCoffee) — not official Filigran integration
- ⚠ OpenCTI data quality depends on your TI feeds and team curation — garbage in, garbage out
Alternatives
Full Evaluation Report
Comprehensive deep-dive: security analysis, reliability audit, agent experience review, cost modeling, competitive positioning, and improvement roadmap for OpenCTI MCP Server.
AI-powered analysis · PDF + markdown · Delivered within 30 minutes
Package Brief
Quick verdict, integration guide, cost projections, gotchas with workarounds, and alternatives comparison.
Delivered within 10 minutes
Score Monitoring
Get alerted when this package's AF, security, or reliability scores change significantly. Stay ahead of regressions.
Continuous monitoring
Scores are editorial opinions as of 2026-03-07.