intelthreadlinqs-mcp — Claude Code MCP server: threats, IOCs, MITRE
Wires the Threadlinqs threat-intelligence database into your agent: IOCs, detection rules, actors, C2 beacons and MITRE chains. A Purple or Gold API key is required.
claude mcp add --env THREADLINQS_API_KEY=<THREADLINQS_API_KEY> --env THREADLINQS_API_URL=<THREADLINQS_API_URL> --transport stdio intelthreadlinqs-mcp -- npx -y intelthreadlinqs-mcpWhat intelthreadlinqs-mcp does
The server exposes a catalog of investigation tools. You can pull a threat dossier by ID, break down an indicator found in a log, read up on an actor, or export firewall-ready C2 addresses with country and ASN. Detection content comes in Splunk SPL, Microsoft KQL and Sigma YAML.
Composite calls cut down the number of round trips. get_threat_hunting_bundle returns metadata, IOCs, detection queries, similar threats and infrastructure pivots for a single threat in one go; get_mitre_gap_analysis answers which techniques still lack coverage.
Start it with npx -y intelthreadlinqs-mcp, no install step. The key sits in THREADLINQS_API_KEY. Tool calls only return data on Purple or Gold — the tier is checked on the service side for every request, and a lower-tier key gets an access error even though the server starts and lists its tools. Signing up alone lands you on a lower plan; the trial is granted during checkout on the pricing page, not at registration.
What it helps with
- pull a full threat dossier in one call
- trace an indicator from a log to the threats behind it
- get detection queries in SPL, KQL and Sigma
- list MITRE techniques that have no detection coverage
- export active C2 IPs for a firewall blocklist
Example prompts for the agent
- Pull the dossier for threat
TL-2026-0599and list its IOCs with detection queries - Check this domain from yesterday's log — which threats and actors touch it?
- Show MITRE techniques without detection coverage, highest priority first
How to install intelthreadlinqs-mcp
Platform CLI
claude mcp add --env THREADLINQS_API_KEY=<THREADLINQS_API_KEY> --env THREADLINQS_API_URL=<THREADLINQS_API_URL> --transport stdio intelthreadlinqs-mcp -- npx -y intelthreadlinqs-mcpReplace <…> with your own values
Platform CLI
codex mcp add intelthreadlinqs-mcp --env THREADLINQS_API_KEY=<THREADLINQS_API_KEY> --env THREADLINQS_API_URL=<THREADLINQS_API_URL> -- npx -y intelthreadlinqs-mcpReplace <…> with your own values
Config file
{
"mcpServers": {
"intelthreadlinqs-mcp": {
"command": "npx",
"args": [
"-y",
"intelthreadlinqs-mcp"
],
"env": {
"THREADLINQS_API_KEY": "<THREADLINQS_API_KEY>",
"THREADLINQS_API_URL": "<THREADLINQS_API_URL>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"intelthreadlinqs-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"intelthreadlinqs-mcp"
],
"env": {
"THREADLINQS_API_KEY": "<THREADLINQS_API_KEY>",
"THREADLINQS_API_URL": "<THREADLINQS_API_URL>"
}
}
}
}Replace <…> with your own values
Platform CLI
gemini mcp add -e THREADLINQS_API_KEY=<THREADLINQS_API_KEY> -e THREADLINQS_API_URL=<THREADLINQS_API_URL> intelthreadlinqs-mcp npx -y intelthreadlinqs-mcpReplace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about intelthreadlinqs-mcp
How do I install intelthreadlinqs-mcp in Claude Code?
Run claude mcp add intelthreadlinqs-mcp -e THREADLINQS_API_KEY=<THREADLINQS_API_KEY> -- npx -y intelthreadlinqs-mcp, replacing the placeholder with your own key.
What does intelthreadlinqs-mcp do?
It gives your agent a path into the Threadlinqs corpus: threats, IOCs, detection rules, actor profiles, C2 infrastructure and MITRE analytics.
Which subscription unlocks the tools?
Calls work on Purple or Gold, meaning tier three and above. On a lower tier the server still launches but returns an access-denied error instead of data.
