ZettelForge — Claude Code MCP server: features and setup
ZettelForge turns analyst notes and threat reports into linked CTI records, then lets an agent search past investigations through MCP. Use it for questions about CVEs, IOCs, threat actors, and ATT&CK techniques.
claude mcp add zettelforge -- uvx zettelforgeWhat ZettelForge does
The server extracts CVEs, indicators, actor names, and MITRE ATT&CK techniques from analyst notes and reports. It reconciles actor aliases and connects the extracted entities in a STIX 2.1 graph. An agent can then retrieve related details from stored investigations using natural-language queries.
Retrieval combines vector similarity with graph traversal and weighs results according to the query’s intent, such as temporal or causal. SQLite and LanceDB store the data; fastembed with ONNX handles embeddings. External API keys are not required. Models may download on the first run, but once preloaded, the server can operate offline, including on air-gapped hosts. Prepare the models first if the host cannot reach the network.
What it helps with
- extract CVEs and IOCs from threat reports
- connect aliases for the same threat actor
- retrieve investigations related to an ATT&CK technique
- compare new intelligence with stored records
Example prompts for the agent
- Find earlier investigations connected to the CVE in this note.
- Check whether these actor aliases resolve to one entity, then show its related IOCs.
- What links this ATT&CK technique to the investigations already stored?
How to install ZettelForge
Platform CLI
claude mcp add zettelforge -- uvx zettelforgeuvx runs the command named after the package; if the README names another one, use uvx --from zettelforge <command>
Platform CLI
codex mcp add zettelforge -- uvx zettelforgeuvx runs the command named after the package; if the README names another one, use uvx --from zettelforge <command>
Config file
{
"mcpServers": {
"zettelforge": {
"command": "uvx",
"args": [
"zettelforge"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from zettelforge <command>
Config file
{
"servers": {
"zettelforge": {
"type": "stdio",
"command": "uvx",
"args": [
"zettelforge"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from zettelforge <command>
Platform CLI
gemini mcp add zettelforge uvx zettelforgeuvx runs the command named after the package; if the README names another one, use uvx --from zettelforge <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about ZettelForge
How do I install ZettelForge in Claude Code?
Run claude mcp add zettelforge -- uvx zettelforge to add the MCP server under the name zettelforge.
What does ZettelForge do?
It extracts threat intelligence from notes and reports, connects entities in a STIX 2.1 graph, and makes stored investigations searchable through MCP.
Can ZettelForge run offline?
Yes. After its models are downloaded and preloaded, it can run offline, including on air-gapped hosts. Model downloads may happen on the first run.
