Queries ThreatCluster threat intelligence: incident clusters, IOCs, CVE/KEV/EPSS data, ransomware leak-site victims and entity profiles.
Setup
Choose your client, copy the config, then fill in any required environment variables.
Local
claude mcp add threatcluster --env THREATCLUSTER_API_KEY='<THREATCLUSTER_API_KEY>' -- npx -y threatcluster-mcp~/.codex/config.toml
[mcp_servers.threatcluster]
command = "npx"
args = ["-y", "threatcluster-mcp"]
env = { THREATCLUSTER_API_KEY = "<THREATCLUSTER_API_KEY>" }
# codex mcp add threatcluster --env THREATCLUSTER_API_KEY='<THREATCLUSTER_API_KEY>' -- npx -y threatcluster-mcp~/.cursor/mcp.json
{
"mcpServers": {
"threatcluster": {
"command": "npx",
"args": [
"-y",
"threatcluster-mcp"
],
"env": {
"THREATCLUSTER_API_KEY": "<THREATCLUSTER_API_KEY>"
}
}
}
}.vscode/mcp.json
{
"servers": {
"threatcluster": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"threatcluster-mcp"
],
"env": {
"THREATCLUSTER_API_KEY": "<THREATCLUSTER_API_KEY>"
}
}
}
}~/.gemini/settings.json
{
"mcpServers": {
"threatcluster": {
"command": "npx",
"args": [
"-y",
"threatcluster-mcp"
],
"env": {
"THREATCLUSTER_API_KEY": "<THREATCLUSTER_API_KEY>"
}
}
}
}claude_desktop_config.json
{
"mcpServers": {
"threatcluster": {
"command": "npx",
"args": [
"-y",
"threatcluster-mcp"
],
"env": {
"THREATCLUSTER_API_KEY": "<THREATCLUSTER_API_KEY>"
}
}
}
}.trae/mcp.json
{
"mcpServers": {
"threatcluster": {
"command": "npx",
"args": [
"-y",
"threatcluster-mcp"
],
"env": {
"THREATCLUSTER_API_KEY": "<THREATCLUSTER_API_KEY>"
}
}
}
}Remote
claude mcp add --transport http threatcluster https://threatcluster.io/mcp --header 'X-API-Key: <X_API_KEY>'~/.codex/config.toml
[mcp_servers.threatcluster]
url = "https://threatcluster.io/mcp"
http_headers = { X-API-Key = "<X_API_KEY>" }
# codex mcp add threatcluster --url https://threatcluster.io/mcp~/.cursor/mcp.json
{
"mcpServers": {
"threatcluster": {
"url": "https://threatcluster.io/mcp",
"headers": {
"X-API-Key": "<X_API_KEY>"
}
}
}
}.vscode/mcp.json
{
"servers": {
"threatcluster": {
"type": "http",
"url": "https://threatcluster.io/mcp",
"headers": {
"X-API-Key": "<X_API_KEY>"
}
}
}
}~/.gemini/settings.json
{
"mcpServers": {
"threatcluster": {
"httpUrl": "https://threatcluster.io/mcp",
"headers": {
"X-API-Key": "<X_API_KEY>"
}
}
}
}claude_desktop_config.json · Customize › Connectors › Add custom connector
{
"mcpServers": {
"threatcluster": {
"command": "npx",
"args": [
"-y",
"mcp-remote",
"https://threatcluster.io/mcp",
"--header",
"X-API-Key:<X_API_KEY>"
]
}
}
}.trae/mcp.json
{
"mcpServers": {
"threatcluster": {
"url": "https://threatcluster.io/mcp",
"headers": {
"X-API-Key": "<X_API_KEY>"
}
}
}
}Environment variables
THREATCLUSTER_API_KEY
Replace the placeholders with your own credentials and keep them out of version control.