# intelthreadlinqs-mcp

Wires the Threadlinqs threat-intelligence database into your agent: IOCs, detection rules, actors, C2 beacons and MITRE chains. A Purple or Gold API key is required.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI
- Author: threadlinqs-cmd
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/threadlinqs-cmd/intelthreadlinqs-mcp
- Updated: 2026-08-23
- HTML: https://affpapa.org/en/nevibecode/mcp/intelthreadlinqs-mcp

## What it does

The server exposes a catalog of investigation tools. You can pull a threat dossier by ID, break down an indicator found in a log, read up on an actor, or export firewall-ready C2 addresses with country and ASN. Detection content comes in Splunk SPL, Microsoft KQL and Sigma YAML.

Composite calls cut down the number of round trips. `get_threat_hunting_bundle` returns metadata, IOCs, detection queries, similar threats and infrastructure pivots for a single threat in one go; `get_mitre_gap_analysis` answers which techniques still lack coverage.

Start it with `npx -y intelthreadlinqs-mcp`, no install step. The key sits in `THREADLINQS_API_KEY`. Tool calls only return data on Purple or Gold — the tier is checked on the service side for every request, and a lower-tier key gets an access error even though the server starts and lists its tools. Signing up alone lands you on a lower plan; the trial is granted during checkout on the pricing page, not at registration.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `THREADLINQS_API_KEY`, `THREADLINQS_API_URL` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env THREADLINQS_API_KEY=<THREADLINQS_API_KEY> --env THREADLINQS_API_URL=<THREADLINQS_API_URL> --transport stdio intelthreadlinqs-mcp -- npx -y intelthreadlinqs-mcp
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add intelthreadlinqs-mcp --env THREADLINQS_API_KEY=<THREADLINQS_API_KEY> --env THREADLINQS_API_URL=<THREADLINQS_API_URL> -- npx -y intelthreadlinqs-mcp
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "intelthreadlinqs-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "intelthreadlinqs-mcp"
            ],
            "env": {
                "THREADLINQS_API_KEY": "<THREADLINQS_API_KEY>",
                "THREADLINQS_API_URL": "<THREADLINQS_API_URL>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "intelthreadlinqs-mcp": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "intelthreadlinqs-mcp"
            ],
            "env": {
                "THREADLINQS_API_KEY": "<THREADLINQS_API_KEY>",
                "THREADLINQS_API_URL": "<THREADLINQS_API_URL>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e THREADLINQS_API_KEY=<THREADLINQS_API_KEY> -e THREADLINQS_API_URL=<THREADLINQS_API_URL> intelthreadlinqs-mcp npx -y intelthreadlinqs-mcp
```
Replace <…> with your own values

## When to use it
- pull a full threat dossier in one call
- trace an indicator from a log to the threats behind it
- get detection queries in SPL, KQL and Sigma
- list MITRE techniques that have no detection coverage
- export active C2 IPs for a firewall blocklist

## Example prompts
- Pull the dossier for threat `TL-2026-0599` and list its IOCs with detection queries
- Check this domain from yesterday's log — which threats and actors touch it?
- Show MITRE techniques without detection coverage, highest priority first

## Similar
- [analyzing-indicators-of-compromise](https://affpapa.org/en/nevibecode/skills/analyzing-indicators-of-compromise.md) — skill · 466 installs
- [analyzing-campaign-attribution-evidence](https://affpapa.org/en/nevibecode/skills/analyzing-campaign-attribution-evidence.md) — skill · 464 installs
- [Cyberbro MCP Server](https://affpapa.org/en/nevibecode/mcp/cyberbro-mcp-server.md) — MCP server · ★ 19
- [security-investigator-automation](https://affpapa.org/en/nevibecode/skills/security-investigator-automation.md) — skill · 322 installs
- [dt-sec-ioc-hunting](https://affpapa.org/en/nevibecode/skills/dt-sec-ioc-hunting.md) — skill · 1100 installs
- [incident-triage](https://affpapa.org/en/nevibecode/skills/incident-triage.md) — skill · 361 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md