# ZettelForge

ZettelForge turns analyst notes and threat reports into linked CTI records, then lets an agent search past investigations through MCP. Use it for questions about CVEs, IOCs, threat actors, and ATT&CK techniques.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 66
- Author: ThreatRecall
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/ThreatRecall/zettelforge
- Updated: 2026-10-22
- HTML: https://affpapa.org/en/nevibecode/mcp/zettelforge

## What it does

The server extracts CVEs, indicators, actor names, and MITRE ATT&CK techniques from analyst notes and reports. It reconciles actor aliases and connects the extracted entities in a STIX 2.1 graph. An agent can then retrieve related details from stored investigations using natural-language queries.

Retrieval combines vector similarity with graph traversal and weighs results according to the query’s intent, such as temporal or causal. SQLite and LanceDB store the data; fastembed with ONNX handles embeddings. External API keys are not required. Models may download on the first run, but once preloaded, the server can operate offline, including on air-gapped hosts. Prepare the models first if the host cannot reach the network.

## Requirements
- Needs: Python and uv (commands run via uvx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add zettelforge -- uvx zettelforge
```
uvx runs the command named after the package; if the README names another one, use uvx --from zettelforge <command>

### Codex

**Platform CLI**
```bash
codex mcp add zettelforge -- uvx zettelforge
```
uvx runs the command named after the package; if the README names another one, use uvx --from zettelforge <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "zettelforge": {
            "command": "uvx",
            "args": [
                "zettelforge"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from zettelforge <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "zettelforge": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "zettelforge"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from zettelforge <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add zettelforge uvx zettelforge
```
uvx runs the command named after the package; if the README names another one, use uvx --from zettelforge <command>

## When to use it
- extract CVEs and IOCs from threat reports
- connect aliases for the same threat actor
- retrieve investigations related to an ATT&CK technique
- compare new intelligence with stored records

## Example prompts
- Find earlier investigations connected to the CVE in this note.
- Check whether these actor aliases resolve to one entity, then show its related IOCs.
- What links this ATT&CK technique to the investigations already stored?

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md