MCP server CX Codex

Truss Threat Intelligence — Claude Code MCP server: how to install

Q: How do I install Truss Threat Intelligence in Claude Code?

Run `claude mcp add --transport http truss-mcp https://api.truss-security.com/mcp`. You will authenticate via your browser using Truss OAuth during connection setup.

Connects Truss threat intelligence to coding agents via hosted MCP or local CLI. Useful for hunting threats and generating SIEM detection rules.

Install into Claude Code · Platform CLI: remote server All methods and platforms ↓

claude mcp add --transport http truss-mcp https://api.truss-security.com/mcp

Open on GitHub

What Truss Threat Intelligence does

This integration exposes Truss cyber threat data directly to your agent. In the recommended remote mode, it connects to https://api.truss-security.com/mcp using browser OAuth and five security tools. An optional local stdio mode is available for air-gapped setups using TRUSS_API_KEY.

The repository provides the truss-mcp binary running on Node.js 18+. It includes a guided terminal REPL, automated FilterQL filter builders, and query validation. You can export fetched intelligence as STIX or structured JSON, as well as generate hunt queries for Splunk, Falcon, or Cortex.

Check your account tier before connecting. Hosted OAuth access requires a Truss Growth or higher subscription. Community tier accounts cannot grant consent to the hosted MCP endpoint.

What it helps with

query threat intelligence indicators using FilterQL
generate detection and hunting queries for Splunk, Falcon, or Cortex
export threat findings into STIX or JSON structures
verify OAuth connection health using truss-mcp doctor

Example prompts for the agent

Search for active threats from the last 7 days and draft a detection rule for Splunk.
Build a FilterQL query for these indicators and export the results in STIX format.
Query the Truss threat database and summarize matches as a JSON table.

How to install Truss Threat Intelligence

Platform CLI: remote server

claude mcp add --transport http truss-mcp https://api.truss-security.com/mcp

Platform CLI: remote server

codex mcp add truss-threat-intelligence --url https://api.truss-security.com/mcp

Config file

{
    "mcpServers": {
        "truss-threat-intelligence": {
            "url": "https://api.truss-security.com/mcp"
        }
    }
}

Config file

{
    "servers": {
        "truss-threat-intelligence": {
            "type": "http",
            "url": "https://api.truss-security.com/mcp"
        }
    }
}

Platform CLI: remote server

gemini mcp add -t http truss-threat-intelligence https://api.truss-security.com/mcp

Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more

Questions about Truss Threat Intelligence

How do I install Truss Threat Intelligence in Claude Code?

Run claude mcp add --transport http truss-mcp https://api.truss-security.com/mcp. You will authenticate via your browser using Truss OAuth during connection setup.

What does Truss Threat Intelligence do?

It equips your AI assistant with live threat intelligence from the Truss platform. The agent can construct FilterQL queries, retrieve threat data, and produce rules for SIEM and EDR platforms.

Can I run this server with a free Truss Community plan?

No, the hosted OAuth endpoint is gated behind Growth and higher tiers. Free Community accounts cannot authorize access to the hosted MCP server.

Similar MCP servers

All MCP servers for Security →

analyzing-threat-actor-ttps-with-mitre-attack mahipal Maps threat actor behavior and observed IOCs to MITRE ATT&CK, creates ATT&CK Navigator layers, and helps assess detection gaps. CX Codex +1 312installs analyzing-threat-intelligence-feeds mahipal Turns commercial and open-source threat intel feeds into actionable indicators, adversary tactics and campaign context, normalized to STIX 2.1. CX Codex +1 316installs RTK Motion — Motion Capture, Biomechanics, Threat & Fleet Intelligence RTKMotion Connect an agent to motion capture, rehabilitation biomechanics, threat assessments, and commercial-vehicle data. Useful for robotics work, movement analysis, and location or carrier research. CX Codex +1 ★ 1repo stars ZettelForge ThreatRecall ZettelForge turns analyst notes and threat reports into linked CTI records, then lets an agent search past investigations through MCP. Use it for questions about CVEs, IOCs, threat actors, and ATT&CK techniques. CX Codex +1 ★ 66repo stars threat-detection Alireza Rezvani Supports proactive threat hunting with hypotheses, IOC sweeps and telemetry anomaly checks. Use it to investigate activity that automated alerts may miss. 637installs threat-hunting briiirussell Proactively hunts for adversaries in SIEM, EDR, and logs before alerts fire. Guides hypothesis-driven investigations using the PEAK framework and MITRE ATT&CK. CX Codex +1 333installs