# Truss Threat Intelligence

Connects Truss threat intelligence to coding agents via hosted MCP or local CLI. Useful for hunting threats and generating SIEM detection rules.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI
- Author: truss-security
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/truss-security/truss-agent-mcp
- Updated: 2026-10-18
- HTML: https://affpapa.org/en/nevibecode/mcp/truss-threat-intelligence

## What it does

This integration exposes Truss cyber threat data directly to your agent. In the recommended remote mode, it connects to `https://api.truss-security.com/mcp` using browser OAuth and five security tools. An optional local stdio mode is available for air-gapped setups using `TRUSS_API_KEY`.

The repository provides the `truss-mcp` binary running on Node.js 18+. It includes a guided terminal REPL, automated FilterQL filter builders, and query validation. You can export fetched intelligence as STIX or structured JSON, as well as generate hunt queries for Splunk, Falcon, or Cortex.

Check your account tier before connecting. Hosted OAuth access requires a Truss Growth or higher subscription. Community tier accounts cannot grant consent to the hosted MCP endpoint.

## Requirements
- Remote server: `https://api.truss-security.com/mcp`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http truss-mcp https://api.truss-security.com/mcp
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add truss-threat-intelligence --url https://api.truss-security.com/mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "truss-threat-intelligence": {
            "url": "https://api.truss-security.com/mcp"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "truss-threat-intelligence": {
            "type": "http",
            "url": "https://api.truss-security.com/mcp"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http truss-threat-intelligence https://api.truss-security.com/mcp
```

## When to use it
- query threat intelligence indicators using FilterQL
- generate detection and hunting queries for Splunk, Falcon, or Cortex
- export threat findings into STIX or JSON structures
- verify OAuth connection health using truss-mcp doctor

## Example prompts
- Search for active threats from the last 7 days and draft a detection rule for Splunk.
- Build a FilterQL query for these indicators and export the results in STIX format.
- Query the Truss threat database and summarize matches as a JSON table.

## Similar
- [analyzing-threat-actor-ttps-with-mitre-attack](https://affpapa.org/en/nevibecode/skills/analyzing-threat-actor-ttps-with-mitre-attack.md) — skill · 312 installs
- [analyzing-threat-intelligence-feeds](https://affpapa.org/en/nevibecode/skills/analyzing-threat-intelligence-feeds.md) — skill · 316 installs
- [RTK Motion — Motion Capture, Biomechanics, Threat & Fleet Intelligence](https://affpapa.org/en/nevibecode/mcp/rtk-motion-motion-capture-biomechanics-threat-fleet-intelligence.md) — MCP server · ★ 1
- [ZettelForge](https://affpapa.org/en/nevibecode/mcp/zettelforge.md) — MCP server · ★ 66
- [threat-detection](https://affpapa.org/en/nevibecode/skills/threat-detection.md) — skill · 637 installs
- [threat-hunting](https://affpapa.org/en/nevibecode/skills/threat-hunting.md) — skill · 333 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md