ThreatCluster
Rank #160,033smithery/james-pib8/threatcluster
Live threat intelligence for agents: incident clusters, threat actor and malware profiles, CVEs with KEV/EPSS/exploit status, and ransomware leak-site victims. ThreatCluster clusters every public security report into one deduplicated story per incident, scores it, extracts the entities (actors, malware, tools, vendors, CVEs, countries, industries) and tracks ransomware leak sites with its own collectors. This server exposes that corpus as ten read-only tools: `search_threats`, `search_everything`, `newest_threats`, `get_threat` (with IOCs), `leak_site_victims`, `lookup_entity`, `get_vulnerability`, `exploited_vulnerabilities`, `trending_entities` and `api_budget`. Every result carries citation URLs and the credits it cost. **Key:** free on every account, 100 credits a day, 7 days of history. Get one at https://threatcluster.io/api and send it as the `x-api-key` header. Starter ($7.99/month) lifts that to 1,000 credits and 90 days. Also runs locally: `npx -y threatcluster-mcp` or `uvx threatcluster-mcp`. Source: https://github.com/Jam0k/Threat-Intelligence-MCP
What you can do with ThreatCluster
ThreatCluster is a Model Context Protocol (MCP) server. It ranks #160,033 of 166,807 active servers on MCP Toplist. ThreatCluster is listed on Smithery; no version information is available from the registries that list it or from its repository. It was first listed on Sep 26, 2026.
Not verifiedMCP Toplist has not yet written a checked profile for this server, so the paragraph above is assembled from registry data only. Its registry listings below are the authority on what it does.
What ThreatCluster can and cannot do
Not verifiedMCP Toplist has not catalogued this server's tools or limitations. Check its registry listings below.
What you need before using ThreatCluster
The hosted endpoint is declared as gated by authentication — connect via its URL and authenticate with the provider (OAuth flow or an API key/header, per its docs).
Declared by Smithery, last synced Nov 2, 2026. Not independently verified by MCP Toplist.
Hosted endpoint declared as requiring authentication.
Connect ThreatCluster and confirm it works
claude mcp add --transport http threatcluster https://server.smithery.ai/james-pib8/threatcluster/mcpThis endpoint requires authentication — see the server’s docs for credentials.
[mcp_servers.threatcluster]
url = "https://server.smithery.ai/james-pib8/threatcluster/mcp"Add to ~/.codex/config.toml. This endpoint requires authentication — see the server’s docs for credentials.
https://server.smithery.ai/james-pib8/threatcluster/mcpSettings → Connectors → “Add custom connector”, then paste this URL. This endpoint requires authentication — see the server’s docs for credentials.
{
"mcpServers": {
"threatcluster": {
"url": "https://server.smithery.ai/james-pib8/threatcluster/mcp"
}
}
}Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project). This endpoint requires authentication — see the server’s docs for credentials.
{
"servers": {
"threatcluster": {
"type": "http",
"url": "https://server.smithery.ai/james-pib8/threatcluster/mcp"
}
}
}Save as .vscode/mcp.json in your workspace. This endpoint requires authentication — see the server’s docs for credentials.
{
"mcpServers": {
"threatcluster": {
"serverUrl": "https://server.smithery.ai/james-pib8/threatcluster/mcp"
}
}
}Add to ~/.codeium/windsurf/mcp_config.json. This endpoint requires authentication — see the server’s docs for credentials.
{
"mcpServers": {
"threatcluster": {
"url": "https://server.smithery.ai/james-pib8/threatcluster/mcp"
}
}
}This endpoint requires authentication — see the server’s docs for credentials.
After adding the config, ask your client to list this server's tools. A tool list confirms the connection; an empty list or an error means the server did not start or needs credentials.
What changed, and when this was checked
- First listed
- Sep 26, 2026
- Version history
- Unavailable — no registry exposes versions and no release tags were found
- Requirements evidence
- Declared by Smithery, last synced Nov 2, 2026. Not independently verified by MCP Toplist.
- Profile checked
- Not yet — purpose, capabilities and requirements above come from registry data only
- Ranking data as of
- Nov 2, 2026
- Smithery ↗listed since Oct 28, 2026 · still listed
Do you maintain ThreatCluster? to correct or enrich this profile.
Version information unavailable
The registry that lists this server does not expose version metadata, and no release tags were found on the linked repository. MCP Toplist cannot say how, or whether, this server is versioned.
Ranks ahead of 6,774 of 166,807 servers on MCP Toplist.
Show your rank
Maintain this server? Add the live rank badge to your README — it updates automatically as the leaderboard changes.
[](https://mcptoplist.com/server/smithery%2Fjames-pib8%2Fthreatcluster)<a href="https://mcptoplist.com/server/smithery%2Fjames-pib8%2Fthreatcluster"><img src="https://mcptoplist.com/badge/smithery%2Fjames-pib8%2Fthreatcluster.svg" alt="MCP Toplist: #160,033 of 166,807" /></a>Variants: append ?metric=score or ?metric=stars to the image URL.
Frequently asked questions
- Is ThreatCluster listed on the Official MCP Registry?
- ThreatCluster is not on the Official MCP Registry. It is listed on Smithery.
- How many versions does ThreatCluster have?
- Version information is unavailable for ThreatCluster: no registry that lists it exposes version metadata, and no release tags were found on its repository.
Do you run this server?
Community projects list the MCP servers behind real agents and apps. Publish yours and this page will link to it.