by CooperCyberCoffee
Enables analysts to converse with OpenCTI using natural language through Claude Desktop, turning plain‑English questions into instant, context‑rich threat‑intelligence answers.
What is it about?
The server acts as a bridge that lets Claude Desktop query an OpenCTI 6.x instance. By exposing 13 purpose‑built MCP tools, analysts can ask questions such as “What techniques does APT28 use?” or “Search for 192.168.1.1” and receive structured, AI‑augmented responses without writing GraphQL or database queries.
How to use it?
requirements.txt, and add a .env file with OPENCTI_URL, OPENCTI_TOKEN and optional OPENCTI_SSL_VERIFY.python main.py (or run via a process manager). The server binds to localhost by default.claude_desktop_config.json pointing to the Python executable, the module (opencti_mcp) and the same environment variables.Key features
search_observable recognises IPv4/IPv6, domains, URLs, emails and MD5/SHA‑1/SHA‑256 hashes.config/tlp_policy.yaml.Use cases
FAQ
Q: Can I run this with confidential (CUI/TLP AMBER) data?
A: Yes, but only with a locally hosted LLM and an updated tlp_policy.yaml that permits the higher classifications. Cloud‑based Claude Pro/Enterprise must be limited to TLP:CLEAR.
Q: Do I need an Anthropic subscription? A: Claude Pro ($20/mo) is the default cloud option. Enterprise accounts are optional and require separate licensing.
Q: What OpenCTI version is supported? A: Only OpenCTI 6.x series; earlier versions are not compatible.
Q: How is data protected in transit? A: All calls to OpenCTI use HTTPS; communication with Claude (cloud) occurs over TLS. When using a local LLM, no external traffic leaves the host.
Q: Can I customize the output format?
A: Yes. Define custom analysis templates in config/templates/ and select them in prompts (e.g., "use the executive brief template").
Q: How do I integrate audit logs with Splunk or Elastic?
A: The log file logs/opencti_mcp_audit.log emits JSON lines; ingest them as a file or via a forwarder for centralized SIEM correlation.
Connect Claude Desktop to OpenCTI for AI-augmented threat intelligence analysis
🎉 What's New in v0.4.2 Expanded IOC Enrichment: The
search_observabletool now auto-detects and searches 6 observable types - IPv4, IPv6, domains, URLs, emails, and file hashes (MD5, SHA1, SHA256). No more guessing which tool to use! Quick Links | Release Notes
⚡ Getting Started (First Time Users):
🎯 Core Functionality:
🔧 Configuration & Customization:
🔒 Security & Compliance (CRITICAL):
🏢 Enterprise & Air-Gapped Deployment:
📋 Reference & Support:
🎯 By Use Case:
This tool sends threat intelligence queries to an AI service for analysis.
Default Configuration: Claude Desktop → Anthropic API (cloud) Current TLP Policy: Only TLP:CLEAR data allowed by default
Claude Pro (Default):
config/tlp_policy.yaml to customizeClaude Enterprise (Organizational Accounts):
📋 Review: Data Governance & Security Considerations section before production use
You are responsible for ensuring queries comply with your organization's data handling policies.
An open-source educational project demonstrating how to bridge Claude Desktop with OpenCTI's threat intelligence platform using the Model Context Protocol (MCP). Ask questions about threats in natural language and get instant, contextualized answers from your threat intelligence database.
Latest release: Expanded IOC enrichment with automatic observable type detection
search_observable replaces hash-only searchExample queries:
"Search for 192.168.1.1" → Auto-detects IPv4
"Search for evil.com" → Auto-detects domain
"Search for 44d88612fea8a8f36..." → Auto-detects MD5 hash
"Search for http://malicious.com" → Auto-detects URL
"Search for attacker@evil.com" → Auto-detects email
📊 Progress Reporting - Real-time status updates for long operations ⛔ Operation Cancellation - User can abort at any time with clean cleanup ⚡ Server-Side TLP Filtering - Filters data before sending to LLM context window (v0.4.0) 🛡️ Rate Limiting - DoS protection (60 calls/minute default, v0.4.0) 📊 Audit Logging - ISO 8601 timestamps, SIEM-compatible JSON format (v0.4.0)
📖 Configuration Guide: config/README.md - Quick start in 15 minutes 🔄 Migration Guide: MIGRATION.md - Upgrade from v0.1.0 in 30 seconds 📋 Changelog: CHANGELOG.md - See what's new
This MCP server connects Claude Desktop to your OpenCTI threat intelligence platform, enabling you to:
Think of it as giving Claude direct access to your threat intelligence database, so you can have natural conversations about threats instead of hunting through data.
The Problem: Traditional threat intelligence platforms require:
The Solution: With this MCP server, you can:
You: "What TTPs does APT28 use?"
Claude: *Instantly shows 47 MITRE ATT&CK techniques with descriptions*
You: "Which ones target email?"
Claude: *Filters to spearphishing techniques with kill chain phases*
You: "Show me recent indicators for those campaigns"
Claude: *Retrieves IOCs with context and analysis templates*
Organizations below the cyber poverty line:
Requirements:
What you get:
What you trade off:
Threat Actor TTP Analysis:
Incident Response Playbook:
Strategic Comparison (APT28 vs APT29):
Note: Times include human validation - critical for accuracy
Before (Traditional OpenCTI Workflow):
After (With OpenCTI MCP Server):
You: "What are APT28's main techniques?"
Claude: *Shows comprehensive TTP list with MITRE IDs and descriptions in seconds*
The MCP server provides 13 tools organized by function:
What it does: Checks if OpenCTI is reachable, validates credentials, and verifies version compatibility.
Example query: "Check my OpenCTI connection"
What you get:
What it does: Retrieves recent Indicators of Compromise (IOCs) with professional analysis templates.
Example query: "Show me IOCs from the last 7 days"
What you get:
What it does: Searches for threat intelligence indicators by observable value with automatic type detection. Supports IPv4/IPv6 addresses, domain names, URLs, email addresses, and file hashes (MD5, SHA1, SHA256).
Example queries:
What you get:
What it does: Universal search across all OpenCTI entities (threat actors, malware, campaigns, vulnerabilities, etc.)
Example query: "Search for entities related to ransomware"
What you get:
What it does: Gets all inbound and outbound relationships for any entity in your threat database.
Example query: "Show me all relationships for APT28"
What you get:
What it does: Gets all MITRE ATT&CK techniques (TTPs) used by a specific threat actor.
Example query: "What techniques does APT28 use?"
What you get:
Accepts: Threat actor name, alias, MITRE ID (G0007), or entity ID
What it does: Searches for malware entities in your threat database.
Example query: "Find information about Emotet"
What you get:
What it does: Gets all MITRE ATT&CK techniques used by specific malware.
Example query: "What techniques does Emotet use?"
What you get:
Accepts: Malware name, alias, or entity ID
What it does: Gets comprehensive information about a threat campaign including attributed threat actors, malware used, and TTPs.
Example query: "Tell me about the SolarWinds compromise"
What you get:
Accepts: Campaign name, alias, or entity ID
What it does: Searches for MITRE ATT&CK techniques and tactics.
Example query: "Show me attack patterns for spearphishing"
What you get:
What it does: Searches for CVEs and vulnerability information.
Example query: "Search for Log4j vulnerabilities"
What you get:
What it does: Generates a strategic overview of the current threat landscape based on recent activity.
Example query: "Give me a threat landscape summary for the last 30 days"
What you get:
What it does: Searches and retrieves analytical threat intelligence reports from OpenCTI with filtering capabilities.
Example queries:
What you get:
Filters:
Use cases:
Before you begin, make sure you have:
Check your version:
python --version
# or
python3 --version
Expected output: Python 3.9.x or higher
Don't have Python? Download from python.org
What it is: A desktop application that runs Claude AI locally and supports MCP servers.
Download: claude.ai/download
Supported platforms: macOS, Windows
Note: You'll need a Claude Pro subscription ($20/month) to use MCP servers.
What it is: An open-source threat intelligence platform for storing and managing threat data.
You have two options:
Option A: Use Existing OpenCTI Instance
Option B: Set Up Your Own OpenCTI
Quick OpenCTI setup with Docker:
git clone https://github.com/OpenCTI-Platform/docker.git opencti-docker
cd opencti-docker
docker-compose up -d
Wait 2-3 minutes for startup, then access OpenCTI at http://localhost:8080
Default credentials: admin@opencti.io / admin
Get your API token:
Check if installed:
git --version
Don't have Git? Download from git-scm.com
# Clone the repository
git clone https://github.com/CooperCyberCoffee/opencti_mcp_server.git
cd opencti_mcp_server
Expected output:
Cloning into 'opencti_mcp_server'...
remote: Counting objects: 100% ...
Resolving deltas: 100% ...
Create a virtual environment (recommended):
# Create virtual environment
python -m venv venv
# Activate it
# On macOS/Linux:
source venv/bin/activate
# On Windows:
venv\Scripts\activate
Your prompt should change to show (venv) at the beginning.
Install dependencies:
pip install -r requirements.txt
Expected output:
Successfully installed mcp pycti aiohttp python-dotenv ...
Troubleshooting:
python -m pip install -r requirements.txtCreate a .env file in the project root directory:
# Create .env file
touch .env
# Edit with your favorite text editor
nano .env # or vim, code, notepad, etc.
Add these variables:
# OpenCTI Configuration
OPENCTI_URL=http://localhost:8080
OPENCTI_TOKEN=your-api-token-here
OPENCTI_SSL_VERIFY=false
# Optional: Enable debug logging
# DEBUG=true
Replace these values:
OPENCTI_URL: Your OpenCTI instance URL (e.g., https://opencti.yourcompany.com)OPENCTI_TOKEN: Your API token from OpenCTI (from Prerequisites step 3)OPENCTI_SSL_VERIFY: Set to false for local dev, true for production with valid SSLSave and close the file.
Security note: Never commit .env to git (it's already in .gitignore)
Run the server directly to verify it works:
python main.py
Expected output:
╔═══════════════════════════════════════════════════════════════════════╗
║ ║
║ Cooper Cyber Coffee OpenCTI MCP Server ║
║ ║
║ Version: 0.4.2 ║
║ OpenCTI: 6.x ║
...
[INFO] Connected to OpenCTI at http://localhost:8080
[INFO] OpenCTI validation successful (version: 6.x.x, data: available, connectors: X active)
Press Ctrl+C to stop the test.
If you see errors:
.envpip install -r requirements.txt againLocate your Claude Desktop config file:
macOS:
~/Library/Application Support/Claude/claude_desktop_config.json
Windows:
%APPDATA%\Claude\claude_desktop_config.json
Linux:
~/.config/Claude/claude_desktop_config.json
Edit the config file (create if it doesn't exist):
{
"mcpServers": {
"opencti": {
"command": "/full/path/to/venv/bin/python",
"args": [
"-m",
"opencti_mcp"
],
"env": {
"OPENCTI_URL": "http://localhost:8080",
"OPENCTI_TOKEN": "your-api-token-here",
"OPENCTI_SSL_VERIFY": "false"
}
}
}
}
Important: Replace these values:
command path: Full path to Python in your virtual environment
# Find the full path:
# macOS/Linux:
which python
# Windows:
where python
Example paths:
/Users/yourname/opencti_mcp_server/venv/bin/pythonC:\\Users\\yourname\\opencti_mcp_server\\venv\\Scripts\\python.exe/home/yourname/opencti_mcp_server/venv/bin/pythonEnvironment variables: Use the same values from your .env file
Save the file.
Completely quit and restart Claude Desktop:
macOS:
Windows:
Linux:
Open Claude Desktop and look for the MCP indicator:
Test with a simple query:
You: "Check my OpenCTI connection"
Expected response:
Claude: I'll check your OpenCTI connection...
✅ Connected to OpenCTI
Version: 6.x.x
Status: Ready
Database: Contains threat intelligence data
Active connectors: X
If the server doesn't appear:
Once connected, you can ask Claude questions about your threat intelligence in natural language:
Threat Actor Information:
You: "What is APT28?"
Claude: *Shows threat actor details, aliases (Fancy Bear, Sofacy),
country of origin, and summary of activities*
Malware Details:
You: "Tell me about Emotet"
Claude: *Provides malware family information, capabilities,
distribution methods, and associated threat actors*
CVE Lookup:
You: "Search for CVE-2021-44228"
Claude: *Shows Log4Shell vulnerability details, CVSS score,
affected systems, and related threats*
TTP Analysis:
You: "What techniques does Akira ransomware use?"
Claude: *Lists MITRE ATT&CK techniques with IDs, descriptions,
and kill chain phases*
Observable Search (Multi-Type Auto-Detection):
You: "Search for 192.168.1.100"
Claude: *Auto-detects IPv4, shows threat intel + firewall blocking rules*
You: "Search for evil-domain.com"
Claude: *Auto-detects domain, shows threat intel + DNS blocking recommendations*
You: "Search for 44d88612fea8a8f36de82e1278abb02f"
Claude: *Auto-detects MD5 hash, shows associated malware and threat context*
You: "Search for http://malicious-site.com/payload.exe"
Claude: *Auto-detects URL, shows threat intel + web filtering guidance*
You: "Search for attacker@phishing.com"
Claude: *Auto-detects email, shows threat intel + email security recommendations*
You: "Search for 2001:0db8:85a3::8a2e:0370:7334"
Claude: *Auto-detects IPv6, shows threat intel + network blocking rules*
Relationship Mapping:
You: "Show me relationships for APT29"
Claude: *Displays all connections: used malware, targeted sectors,
associated campaigns, and TTPs*
Campaign Analysis:
You: "Analyze the SolarWinds compromise campaign"
Claude: *Provides comprehensive campaign details: timeline,
attributed actors, malware used, TTPs, and impact*
Threat Landscape:
You: "Give me a threat landscape summary for retail organizations"
Claude: *Generates strategic overview: active threats to retail,
common attack patterns, and defensive recommendations*
IOC Retrieval:
You: "Show me recent indicators from the last 7 days with high confidence"
Claude: *Lists recent IOCs with analysis templates,
confidence scores, and investigation guidance*
Report Research:
You: "Find reports about ransomware published in the last 90 days with high confidence"
Claude: *Returns analytical reports with summaries, confidence scores,
referenced entities, and direct links to full reports*
Multi-Step Investigation:
You: "Find APT28, show me their TTPs, then search for recent
indicators related to those techniques"
Claude: *Chains multiple tool calls:*
1. Resolves APT28 entity
2. Gets their TTPs
3. Searches for related IOCs
4. Correlates findings
Comparative Analysis:
You: "Compare the techniques used by Emotet and TrickBot"
Claude: *Retrieves TTPs for both malware families and
highlights similarities and differences*
┌─────────────────┐
│ Claude Desktop │
│ │
│ "What TTPs │
│ does APT28 │
│ use?" │
└────────┬────────┘
│
│ MCP Protocol
│ (JSON-RPC)
▼
┌─────────────────┐
│ OpenCTI MCP │
│ Server │
│ │
│ • Entity │
│ Resolution │
│ • Caching │
│ • Tool Routing │
└────────┬────────┘
│
│ pycti Library
│ (Python API)
▼
┌─────────────────┐
│ OpenCTI 6.x │
│ Platform │
│ │
│ • PostgreSQL │
│ • Elasticsearch│
│ • Redis │
└─────────────────┘
Key Components:
What happens when you ask a question:
This MCP server becomes organizationally aware through three key configuration files in the config/ directory. These files encode your organization's security priorities, environment, and analysis preferences - transforming generic AI responses into tailored intelligence.
File: config/pirs.md
What it is: A structured document defining what threat intelligence questions matter most to YOUR organization.
Why it matters:
Example PIR structure:
# Priority Intelligence Requirements
## Organizational Context
- Industry: Healthcare / Regional hospital system
- Geography: Southeast United States
- Revenue: $500M annually
- Critical assets: Patient records (EHR), medical devices, pharmacy systems
## Priority Questions
### PIR 1: Ransomware Targeting Healthcare
**Question:** What ransomware groups are actively targeting healthcare organizations?
**Why it matters:** Primary threat to operations and patient safety
**Decision supported:** Ransomware defense investment prioritization
### PIR 2: Medical Device Vulnerabilities
**Question:** What vulnerabilities affect our deployed medical devices?
**Why it matters:** Patient safety risk, regulatory compliance (FDA)
**Decision supported:** Device patching and replacement priorities
### PIR 3: State-Sponsored Threats to Healthcare Data
**Question:** Are nation-state actors targeting healthcare research or patient data?
**Why it matters:** Intellectual property protection, HIPAA compliance
**Decision supported:** Enhanced monitoring for APT activity
How Claude uses this: When you query threat intelligence, Claude references your PIRs to:
Customization:
Edit config/pirs.md to reflect your organization's:
File: config/security_stack.md
What it is: A description of your security environment, tools, and defensive posture.
Why it matters:
Example Security Stack:
# Security Stack Profile
## Detection & Response
- SIEM: Splunk Enterprise (version 9.x)
- EDR: CrowdStrike Falcon (deployed on 1,200 endpoints)
- Network: Palo Alto NGFWs, no IDS/IPS
- Email Security: Proofpoint (TAP module enabled)
## Threat Intelligence
- OpenCTI (this MCP server)
- MISP feeds: AlienVault OTX, abuse.ch
- Commercial feeds: None (budget constraints)
## Identity & Access
- Active Directory (on-premises)
- Azure AD for cloud services
- MFA: Duo (deployed for VPN, not yet for all apps)
## Gaps & Limitations
- No DLP solution deployed
- Limited cloud visibility (AWS, no CSPM)
- SOC team: 2 analysts (8am-6pm coverage, no 24/7)
- No dedicated threat hunting program
How Claude uses this:
Customization: Document your:
Location: config/templates/
What they are: Structured frameworks that guide Claude to produce consistent, professional threat intelligence output.
Available templates:
executive_briefing.md)Use case: Board presentations, CISO updates, business stakeholder communication
Structure:
Output example:
EXECUTIVE SUMMARY
Threat Level: HIGH
Key Finding: APT28 actively targeting defense contractors with spearphishing campaigns
Business Impact: Risk to CUI data, potential CMMC compliance violation
Immediate Actions Required:
1. Enhanced email filtering for Russian infrastructure
2. User awareness training on spearphishing
3. Review access controls for CUI systems
technical_analysis.md)Use case: SOC analysts, detection engineers, threat researchers
Structure:
Output example:
THREAT ACTOR ANALYSIS
Primary Attribution: APT28 (Fancy Bear, Sofacy, G0007)
Confidence: HIGH (TTPs match known campaigns, infrastructure patterns consistent)
Known TTPs (MITRE ATT&CK):
- T1566.001: Spearphishing Attachment (primary initial access)
- T1053.005: Scheduled Task/Job (persistence)
- T1003.001: LSASS Memory (credential access)
Detection Opportunities:
[Splunk Query] index=windows EventCode=4698 | search Task_Name="*Update*"
[CrowdStrike] ProcessRollup2 event with ImageFileName=*schtasks.exe AND CommandLine=*create*
incident_response.md)Use case: Active incident response, tabletop exercises
Structure:
Output example:
IMMEDIATE RESPONSE ACTIONS (First 30 Minutes)
Containment:
✓ Isolate affected systems from network (DO NOT power off - preserves memory)
✓ Block known APT28 C2 IPs at perimeter firewall
✓ Revoke compromised credentials in Active Directory
Evidence Preservation:
✓ Capture memory dump from affected endpoints (priority: domain controllers)
✓ Preserve email headers and attachments from spearphishing attempts
✓ Export relevant logs (last 90 days): authentication, process execution, network
strategic_assessment.md)Use case: Quarterly reviews, strategic planning, risk assessments
Structure:
Query: "Analyze APT28 and provide recommendations"
Without customization (generic):
APT28 is a Russian threat actor that uses spearphishing and credential theft.
Recommendations: Implement MFA, train users, monitor for suspicious activity.
With PIRs + Security Stack + Templates:
[Executive Briefing Template Applied]
EXECUTIVE SUMMARY
Threat Level: HIGH for defense contractors in Southeast US
Key Finding: APT28 actively targeting your sector (aerospace/defense) with
spearphishing campaigns against CMMC-covered CUI systems
Business Impact:
- CMMC compliance violation risk (AC.L2-3.1.13 threat-informed defense)
- Potential loss of defense contracts
- CUI exfiltration could compromise proprietary research
IMMEDIATE ACTIONS (Next 24-48 Hours):
1. Enhanced Proofpoint TAP rules for Russian infrastructure (config provided below)
2. CrowdStrike Falcon hunt for LSASS access (query provided)
3. Emergency user awareness: Spearphishing from .ru domains targeting proposals
[Technical Analysis Template Applied]
DETECTION OPPORTUNITIES - YOUR ENVIRONMENT
Splunk Search (for your v9.x deployment):
index=windows sourcetype=WinEventLog:Security EventCode=4688
| search (CommandLine="*lsass*" OR CommandLine="*mimikatz*")
| stats count by Computer, User, CommandLine
CrowdStrike Falcon Hunt (tested on your deployment):
event_simpleName=ProcessRollup2* ImageFileName IN ("*procdump*","*mimikatz*")
| table ComputerName, UserName, CommandLine, ImageFileName
COMPENSATING CONTROLS FOR YOUR GAPS:
You have no DLP deployed. For CUI protection:
- Enable Windows Defender Application Guard on CUI workstations
- Implement PowerShell Constrained Language Mode
- Deploy CrowdStrike USB device control module
[Incident Response Template Applied]
RESPONSE PROCEDURES - YOUR 2-PERSON SOC TEAM:
Given your 8am-6pm coverage:
1. Set CrowdStrike Falcon detections to "Block" (not just Alert) for high-confidence IOCs
2. Configure Splunk alerts to page on-call person for LSASS access events
3. Pre-stage EDR memory capture commands for after-hours automated response
See the difference? Same threat actor, but analysis is:
Step 1: Define Your PIRs
Edit config/pirs.md:
Step 2: Document Your Security Stack
Edit config/security_stack.md:
Step 3: Choose Analysis Templates
Templates are automatically available. Claude will:
You can also request specific templates:
"Analyze APT28 using the incident response template"
"Give me an executive briefing on ransomware threats"
"Provide technical analysis of Emotet's TTPs"
Step 4: Test and Refine
Scenario: Small regional hospital asking about ransomware threats
Query: "What ransomware threats should we worry about?"
Response:
Ransomware is a significant threat to all organizations. Common groups include:
- LockBit
- ALPHV/BlackCat
- Royal
Recommendations:
- Implement backups
- Train users
- Keep systems patched
- Deploy EDR
Problem: Generic, not actionable, doesn't consider hospital context
PIRs defined:
Security Stack documented:
Query: "What ransomware threats should we worry about?"
Response:
[Executive Briefing - Healthcare Context]
THREAT LEVEL: CRITICAL
KEY FINDING: Three ransomware groups actively targeting regional hospitals
in your revenue bracket ($500M):
1. LockBit 3.0 - 12 confirmed healthcare attacks (last 90 days)
Risk: Known to target Veeam backups (you use Veeam)
2. Royal Ransomware - Targeting Epic EHR systems specifically
Risk: Your EHR vendor is Epic (per security_stack.md)
3. Hive - Focuses on medical device networks
Risk: Your medical devices lack EDR coverage
BUSINESS IMPACT - HIPAA PERSPECTIVE:
- OCR breach notification required within 60 days
- Average hospital downtime: 2-3 weeks (EHR offline)
- Average ransomware payment demand for your size: $2-5M
- Regulatory fines: $100-250K+ for inadequate safeguards
IMMEDIATE ACTIONS (Next 7 Days):
1. VEEAM BACKUP PROTECTION (Addresses LockBit risk):
- Enable immutable backups in Veeam
- Store recovery key offline (not on domain)
- Test bare metal restore of EHR server THIS WEEK
2. EPIC EHR HARDENING (Addresses Royal risk):
Your Splunk Search (Ready to Deploy):
index=epic_logs (EventCode=4624 OR EventCode=4625)
| stats count by Account_Name, Workstation_Name
| where count > 100
Alert on abnormal Epic authentication patterns
3. MEDICAL DEVICE NETWORK SEGMENTATION (Addresses Hive risk):
Since you can't deploy EDR on medical devices:
- Isolate medical device VLAN from corporate network
- Deploy Palo Alto firewall rules blocking device-to-internet
- Monitor device VLAN for anomalies in Splunk
RESOURCE CONSTRAINTS ACKNOWLEDGED:
Your 5-person IT team can't do everything. Priority order:
1. Veeam immutability (2 hours, maximum ROI)
2. Medical device segmentation (1 day, prevents lateral movement)
3. Epic monitoring (4 hours, early warning system)
COMPLIANCE NOTE:
These actions satisfy HIPAA Security Rule 164.312(a)(1) - Access Controls
and 164.308(a)(7) - Contingency Planning
See the transformation?
1. Start Simple
2. Keep PIRs Current
3. Be Honest in Security Stack
4. Template Selection
5. Iterate Based on Feedback
Want to create organization-specific templates?
Example: Defense Contractor Template
# Defense Contractor Incident Response Template
## CMMC Compliance Actions
- AC.L2-3.1.13: Document threat-informed defense measures taken
- IR.L2-3.6.1: Report to DoD within 72 hours if CUI affected
- AU.L2-3.3.1: Preserve audit logs for incident investigation
## DFARS 252.204-7012 Reporting
If CUI potentially affected:
- [ ] Notify DoD CIO at: https://dibnet.dod.mil within 72 hours
- [ ] Provide information required by DFARS clause
- [ ] Preserve evidence per DoD guidance
## Stakeholder Notifications
- Program Security Officer (PSO): [name]
- Government Contracting Officer: [name]
- DCSA Field Office: [contact]
- Legal: [firm name]
[Continue with standard incident response sections...]
Save as config/templates/defense_contractor_ir.md and request:
"Analyze this incident using the defense contractor IR template"
All MCP tool calls are logged to logs/opencti_mcp_audit.log for compliance requirements.
Compliance Standards Supported:
Log Format:
{
"timestamp": "2025-11-19T02:00:01.646Z",
"event_type": "mcp_tool_call",
"user": "analyst@company.com",
"tool_name": "get_threat_actor_ttps",
"parameters": {"actor": "APT28"},
"data_classification": "TLP:CLEAR",
"results_count": 91,
"execution_time_ms": 342,
"session_id": "abc123-uuid",
"success": true
}
SIEM Integration: Parse JSON logs and ingest into Splunk, Sentinel, or Elastic for centralized monitoring.
What's Logged:
Security features include:
Status: ✅ RESOLVED - Default changed to localhost binding
Previous behavior (v0.4.1 and earlier):
0.0.0.0 (all network interfaces) by defaultCurrent behavior (v0.4.2+):
127.0.0.1 (localhost only) by defaultFor network access (advanced use case):
export MCP_SERVER_HOST=0.0.0.0 # ⚠️ Exposes server to network
Security considerations:
Configuration:
Set MCP_SERVER_HOST in your .env file or environment variables to customize binding address.
Cryptography CVE Fixes:
cryptography dependency to 43.0.1+ to fix 4 CVEsImpact: pycti uses TLS for OpenCTI connections - these CVEs posed MITM/DoS risk
Action required: Run pip install -r requirements.txt --upgrade after pulling v0.4.2
Version 0.3.0+ Security Review:
Full audit report: SECURITY_AUDIT.md
Version: 0.4.2 (Active Development) Stability: Beta - suitable for production use with appropriate risk assessment What's tested: Security features, TLP filtering, core functionality What's not: Long-term stability, edge cases, all OpenCTI 6.x variations
Recommendation: Test thoroughly in your environment before production deployment
Please do not report security vulnerabilities through public GitHub issues.
Email: matt@coopercybercoffee.com
Response timeline:
Full security policy: SECURITY.md
This project supports technical requirements for:
See SECURITY.md for detailed compliance information.
This MCP server sends threat intelligence queries to Anthropic's cloud infrastructure by default.
What gets sent to Claude:
What stays local:
Data flow:
Anthropic's data handling:
⚠️ IMPORTANT: You are sending threat intelligence data to a third-party cloud service. This may violate your organization's data handling policies, NDAs, or compliance requirements.
This server implements TLP filtering to prevent sensitive data from being sent to Claude.
CISA TLP Levels (from most to least restrictive):
| TLP Level | Definition | Allowed by Default? |
|---|---|---|
| TLP:RED | For eyes and ears of individual recipients only, no further disclosure | ❌ Blocked |
| TLP:AMBER+STRICT | Limited disclosure, restricted to organization and its clients | ❌ Blocked |
| TLP:AMBER | Limited disclosure, restricted to participants' organizations | ❌ Blocked |
| TLP:GREEN | Limited disclosure, community wide | ❌ Blocked |
| TLP:CLEAR (formerly TLP:WHITE) | May be distributed without restriction | ✅ Allowed |
Default Policy: Only TLP:CLEAR objects are sent to Claude. All other TLP levels and unmarked objects are filtered out.
How filtering works:
config/tlp_policy.yamlVerify what's being filtered:
# Check audit logs for filtered objects
tail -f logs/opencti_mcp_audit.log | grep "filtered"
CISA TLP Guidance: https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage
Before deploying this tool in a production environment, consider:
⚠️ Recommendation: Consult your organization's security, compliance, and legal teams before deploying in production.
These use cases are generally safe for TLP:CLEAR data:
✅ Public OSINT (Open Source Intelligence)
✅ MITRE ATT&CK Framework
✅ Public CVEs (Vulnerabilities)
✅ Non-Attributed Research
✅ Training and Education
Best practice: Mark all public data as TLP:CLEAR in OpenCTI to enable safe AI-assisted analysis.
Do NOT use this tool for:
❌ TLP:AMBER or TLP:RED Intelligence
❌ Classified Information
❌ Proprietary Threat Intelligence
❌ Company-Specific Incidents
❌ Active Investigations
❌ CUI (Controlled Unclassified Information)
⚠️ If in doubt, DON'T send it. Err on the side of caution.
TLP policy is controlled by config/tlp_policy.yaml
Default configuration (safest):
# Only allow TLP:CLEAR and legacy TLP:WHITE
allowed_markings:
- "TLP:CLEAR"
- "TLP:WHITE"
# Block objects with no TLP marking (potentially sensitive)
allow_unmarked: false
# Reject queries if ANY object violates policy
strict_mode: true
Example: Allow TLP:GREEN for community sharing
allowed_markings:
- "TLP:CLEAR"
- "TLP:WHITE"
- "TLP:GREEN" # Community-wide sharing acceptable
allow_unmarked: false
strict_mode: true
Example: Allow unmarked objects (RISKY)
allowed_markings:
- "TLP:CLEAR"
- "TLP:WHITE"
# WARNING: This allows objects with NO TLP marking to be sent to Claude
# Only use this if you trust ALL data in your OpenCTI instance
allow_unmarked: true
strict_mode: true
Example: Custom organizational markings
allowed_markings:
- "TLP:CLEAR"
- "TLP:WHITE"
# Your organization's custom markings
custom_allowed_markings:
- "INTERNAL:PUBLIC"
- "UNCLASSIFIED"
- "OPEN SOURCE"
allow_unmarked: false
strict_mode: true
Configuration parameters:
| Parameter | Default | Description |
|---|---|---|
allowed_markings |
["TLP:CLEAR", "TLP:WHITE"] |
List of TLP markings allowed to be sent to Claude |
allow_unmarked |
false |
Allow objects with NO TLP marking? (dangerous) |
strict_mode |
true |
Reject query if ANY object violates policy? |
custom_allowed_markings |
[] |
Additional organization-specific markings |
log_filtered_objects |
true |
Log filtered objects to audit log? |
After changing policy:
# Restart MCP server to reload configuration
# (Close and reopen Claude Desktop)
Before deploying this tool:
Review your data classification policy
Assess your OpenCTI data
Get organizational approval
Configure TLP policy appropriately
allow_unmarked: false (safest)Configure monitoring
Train users
Document everything
Additional security measures to consider:
Network Segmentation:
# Run MCP server on isolated network segment
# Restrict access to OpenCTI instance
# Monitor network traffic to Anthropic endpoints
Access Controls:
# Limit who can run MCP server
# Separate Claude Desktop accounts for different roles
# Use principle of least privilege
Data Sanitization:
# Pre-process OpenCTI data to remove sensitive fields
# Redact PII from incident descriptions
# Strip internal asset names from reports
Monitoring and Alerting:
# Alert on TLP policy violations
# Monitor for unusual query patterns
# Track data exfiltration volumes
# Log all Claude Desktop sessions
Alternative Architectures:
Option 1: Public OSINT Only
- Deploy separate OpenCTI instance
- Only ingest TLP:CLEAR feeds
- No risk of sensitive data leakage
Option 2: Air-Gapped Deployment
- Use local LLM instead of Claude API
- Deploy entirely on-premises
- No data leaves your network
Option 3: Data Sanitization Layer
- Proxy/filter all OpenCTI responses
- Strip sensitive fields automatically
- Anonymize entity names
- Redact internal references
This is a complex security decision. When in doubt:
Contact for project questions:
Compliance resources:
Key Insight: This MCP server is LLM-agnostic by design - it works with ANY MCP-compatible client and model, not just Claude and Anthropic.
What this means:
This makes it suitable for:
┌─────────────┐ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐
│ OpenCTI │───▶│ MCP Server │───▶│ Claude │───▶│ Anthropic │
│ │ │ (local) │ │ Desktop │ │ API │
│ (local) │ │ │ │ (local) │ │ (cloud) │
└─────────────┘ └─────────────┘ └─────────────┘ └─────────────┘
Pros:
Cons:
Use for:
For organizations with enhanced security requirements:
┌─────────────┐ ┌─────────────┐ ┌────────────────┐ ┌─────────────┐
│ OpenCTI │───▶│ MCP Server │───▶│ Claude │───▶│ Anthropic │
│ │ │ (local) │ │ Enterprise │ │ Enterprise │
│ (local) │ │ │ │ (local) │ │ (cloud) │
└─────────────┘ └─────────────┘ └────────────────┘ └─────────────┘
Advantages over Claude Pro:
Still NOT suitable for:
Requires organizational approval for:
The conservative recommendation: If you're asking "Can I use Claude Enterprise for this data?" - the answer is probably use local LLM instead. It's not worth the compliance risk.
Cost: Typically $30+/user/month (contact Anthropic for pricing)
┌─────────────┐ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐
│ OpenCTI │───▶│ MCP Server │───▶│ MCP Client │───▶│ Local LLM │
│ │ │ (local) │ │ │ │ (Llama, │
│ (local) │ │ │ │ (local) │ │ Mistral) │
└─────────────┘ └─────────────┘ └─────────────┘ └─────────────┘
(local GPU/CPU)
Pros:
Cons:
Use for:
Deploy separate instances by classification level:
Public OpenCTI ───▶ MCP Server ───▶ Claude Pro ───▶ Anthropic (TLP:CLEAR)
Sensitive OpenCTI ───▶ MCP Server ───▶ MCP Client ───▶ Local LLM (TLP:AMBER+)
Pros:
Cons:
| Solution | Data Location | Suitable For | NOT Suitable For | Cost |
|---|---|---|---|---|
| Claude Pro | Anthropic cloud | TLP:CLEAR public intel | Everything else | $20/mo |
| Claude Enterprise | Anthropic cloud | TLP:AMBER (with approval) | CUI, Classified, HIPAA (unless BAA verified) | $30+/user/mo |
| Local LLM | Your infrastructure | Everything including classified | - | Hardware cost |
Key Decision Point: If your data requires a risk assessment before using cloud AI, use local LLM. Claude Enterprise reduces some risks but doesn't eliminate third-party processing.
Minimum (13B models):
Recommended (70B models):
Budget Option (7B models):
1. Install Local LLM Server
Option A: Ollama (Easiest)
# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh
# Pull a model (choose based on your hardware)
ollama pull llama3:70b # Best quality (requires 40GB+ VRAM)
ollama pull llama3:13b # Balanced (16GB VRAM)
ollama pull llama3:7b # Fastest (8GB VRAM or CPU)
# Start Ollama server
ollama serve
Option B: LM Studio (GUI)
Option C: vLLM (Production)
# For production deployments requiring high throughput
pip install vllm
# Start vLLM server
python -m vllm.entrypoints.openai.api_server \
--model meta-llama/Llama-3-70b-chat-hf \
--host 0.0.0.0 \
--port 8000
2. Install OpenCTI MCP Server
# Same as cloud setup - no changes needed
git clone https://github.com/CooperCyberCoffee/opencti_mcp_server.git
cd opencti_mcp_server
python -m venv venv
source venv/bin/activate # Windows: venv\Scripts\activate
pip install -r requirements.txt
3. Configure Claude Desktop for Local Model
Edit claude_desktop_config.json:
{
"mcpServers": {
"opencti": {
"command": "/full/path/to/venv/bin/python",
"args": ["-m", "opencti_mcp"],
"env": {
"OPENCTI_URL": "http://localhost:8080",
"OPENCTI_TOKEN": "your-api-token-here",
"OPENCTI_SSL_VERIFY": "false"
}
}
},
"llm": {
"provider": "ollama",
"model": "llama3:70b",
"endpoint": "http://localhost:11434"
}
}
Note: Claude Desktop configuration for local models varies. Check Anthropic's documentation for latest guidance, or use alternative MCP clients that support local models.
4. Configure TLP Policy for Classified Data
Edit config/tlp_policy.yaml:
# For classified/CUI environments
allowed_markings:
- "TLP:RED"
- "TLP:AMBER+STRICT"
- "TLP:AMBER"
- "TLP:GREEN"
- "TLP:CLEAR"
- "SECRET" # Add your classifications
- "TOP SECRET"
- "CONFIDENTIAL"
- "UNCLASSIFIED"
- "CUI"
allow_unmarked: false # Still filter unmarked data
strict_mode: true
# Document your policy
policy_version: "1.0"
last_reviewed: "2025-01-19"
reviewed_by: "security_team@yourorg.gov"
5. Test the Deployment
# Start Ollama (if not already running)
ollama serve
# In another terminal, test MCP server
cd opencti_mcp_server
source venv/bin/activate
python main.py
# Should see: "Connected to OpenCTI" and "TLP filtering enabled"
# Press Ctrl+C when verified
In Claude Desktop:
You: "Check my OpenCTI connection"
Claude: ✅ Connected to OpenCTI
Version: 6.x.x
TLP Policy: Active (7 markings allowed)
Model: llama3:70b (local)
| Model | Size | Hardware | Quality | Speed | Use Case |
|---|---|---|---|---|---|
| Llama 3 70B | 70B | GPU 40GB+ | ⭐⭐⭐⭐⭐ Excellent | Moderate | Best for complex analysis, attribution |
| Mistral Large | 123B | GPU 80GB+ | ⭐⭐⭐⭐⭐ Excellent | Slow | Technical deep dives, malware analysis |
| Codestral | 22B | GPU 24GB | ⭐⭐⭐⭐ Very Good | Fast | Code analysis, malware TTPs |
| Llama 3 13B | 13B | GPU 16GB | ⭐⭐⭐⭐ Very Good | Fast | Balanced performance |
| Mistral 7B | 7B | GPU 8GB | ⭐⭐⭐ Good | Very Fast | Resource-constrained |
| Llama 3 7B | 7B | CPU/8GB GPU | ⭐⭐⭐ Good | Very Fast | Budget deployments |
| Phi-3 | 3.8B | CPU | ⭐⭐ Acceptable | Fastest | Minimal hardware |
Recommendation: Start with Llama 3 13B - best balance of quality and hardware requirements.
| Aspect | Claude Pro | Claude Enterprise | Local (70B) | Local (13B) | Local (7B) |
|---|---|---|---|---|---|
| Analysis Quality | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐ | ⭐⭐⭐ |
| Speed | 1-3 sec | 1-3 sec | 5-15 sec | 2-5 sec | 1-3 sec |
| Cost | $20/mo | $30+/user/mo | Hardware only | Hardware only | Hardware only |
| Data Privacy | Anthropic policy | Enhanced controls | Complete control | Complete control | Complete control |
| Internet | Required | Required | Not required | Not required | Not required |
| CUI/Classified | ❌ No | ❌ No | ✅ Yes | ✅ Yes | ✅ Yes |
| CMMC Support | ❌ No | ❌ No | ✅ Yes | ✅ Yes | ✅ Yes |
| Initial Investment | $0 | $0 | $5k-15k | $2k-5k | $500-1k |
Speed estimates based on typical queries. Actual performance varies by hardware, query complexity, and data volume.
✅ Best for:
❌ Not suitable for:
✅ Potentially suitable for (with organizational approval):
❌ Still NOT suitable for:
⚠️ Requires written approval from:
✅ Best for:
❌ Not suitable for:
Question: "If I'm using a local LLM, do I still need TLP filtering?"
Answer: YES - recommended for multiple reasons:
Organizational Governance:
Multi-User Environments:
Defense in Depth:
Example Scenario:
Analyst (SECRET clearance) queries OpenCTI
OpenCTI contains mix of UNCLASSIFIED and TOP SECRET intel
MCP server filters: Only returns UNCLASSIFIED and SECRET
Analyst never sees TOP SECRET (even with local LLM)
Audit log proves policy compliance
Cloud LLM:
Local LLM:
Technical requirements:
Cloud LLM:
Local LLM:
Requirement 3.13.11: "Employ cryptographic mechanisms to protect the confidentiality of CUI during transmission."
Cloud LLM:
Local LLM:
Cloud LLM:
Local LLM:
"Model is too slow"
"Out of memory errors"
"MCP client can't connect to local model"
curl http://localhost:11434/api/tags"Model quality seems poor"
Technical support:
This project:
For Claude Enterprise inquiries:
For classified/CUI deployments: This project is MIT licensed - deploy however needed for your mission. No restrictions, no vendor lock-in, no licensing fees.
Causes:
Solutions:
Check OpenCTI is running:
# If using Docker:
docker ps | grep opencti
# Should see opencti containers running
Verify URL is correct:
# Test with curl:
curl http://localhost:8080/graphql
# Should return GraphQL schema or "Unauthorized"
Check .env file has correct OPENCTI_URL
Causes:
Solutions:
Verify token in OpenCTI web interface:
Copy token exactly (no extra spaces):
# In .env file:
OPENCTI_TOKEN=abc123-your-token-here
# No quotes, no spaces
Regenerate token if necessary
Causes:
Solutions:
Activate virtual environment:
source venv/bin/activate # macOS/Linux
venv\Scripts\activate # Windows
Reinstall dependencies:
pip install -r requirements.txt
Verify installation:
pip list | grep pycti
# Should show: pycti 6.x.x
Causes:
Solutions:
Validate JSON syntax:
# Use a JSON validator:
cat ~/Library/Application\ Support/Claude/claude_desktop_config.json | python -m json.tool
# Should show formatted JSON with no errors
Check Python path is absolute:
# Get full path:
which python # macOS/Linux
where python # Windows
# Use this EXACT path in config
Fully quit and restart Claude Desktop (don't just close window)
Check Claude Desktop logs:
Causes:
Solutions:
Check if OpenCTI has data:
You: "Check my OpenCTI connection"
# Should show "Database: Contains threat intelligence data"
Import threat intelligence:
Try alternative search terms:
# Instead of: "APT 28"
# Try: "APT28" or "Fancy Bear" (alias)
Use search_entities to explore:
You: "Search for entities related to russia"
Causes:
Solutions:
For development/testing, disable SSL verification:
# In .env file:
OPENCTI_SSL_VERIFY=false
For production, use valid SSL certificates
This is an educational open-source project and contributions are welcome!
Fork the repository
Create a feature branch
git checkout -b feature/your-feature-name
Make your changes
Test your changes
# Test the MCP server
python main.py
# Test in Claude Desktop
Commit with clear messages
git add .
git commit -m "Add feature: brief description"
Push and create pull request
git push origin feature/your-feature-name
Mission: Making enterprise-grade cybersecurity capabilities accessible to organizations that can't afford traditional solutions.
The Cooper Cyber Coffee methodology demonstrates how to build professional security capabilities using:
Target: Crossing the "cyber poverty line" - providing supply chain partners with threat intelligence capabilities they couldn't otherwise afford.
Philosophy:
This project is part of that mission - demonstrating that effective threat intelligence analysis doesn't require expensive enterprise platforms.
MIT License - Free for all use, including commercial projects.
Copyright (c) 2025 Matthew Hopkins / Cooper Cyber Coffee
See LICENSE.md for full license text.
What this means:
Matthew Hopkins - Senior Staff Cyber Intelligence Analyst with 8+ years in Fortune 500 threat intelligence, and creator of the Cooper Cyber Coffee methodology.
Questions or feedback?
Email: matt@coopercybercoffee.com
Project updates: Follow on LinkedIn
Found a bug? Open a GitHub issue
Want to contribute? See Contributing section above
Built with ☕ by the Cooper Cyber Coffee community
Crossing the cyber poverty line, one open-source project at a time.
Please log in to share your review and rating for this MCP.
Explore related MCPs that share similar capabilities and solve comparable challenges
by chaitin
A self‑hosted web application firewall and reverse proxy that protects web applications from attacks and exploits by filtering, monitoring, and blocking malicious HTTP/S traffic.
by safedep
Provides enterprise‑grade open source software supply chain security by scanning source code, dependencies, containers and SBOMs, detecting vulnerabilities and malicious packages, and enforcing policy as code.
by semgrep
Offers an MCP server that lets LLMs, agents, and IDEs run Semgrep scans to detect security vulnerabilities in source code.
by PortSwigger
Enables Burp Suite to communicate with AI clients via the Model Context Protocol, providing an MCP server and bundled stdio proxy.
by cycodehq
Boost security in the development lifecycle via SAST, SCA, secrets, and IaC scanning.
by mobb-dev
Provides automatic security vulnerability remediation for code via a command‑line interface and an MCP server, leveraging findings from popular SAST tools such as Checkmarx, CodeQL, Fortify, and Snyk.
by ChristophEnglisch
Provides AI‑powered administration of Keycloak users and realms through the Model Context Protocol, enabling automated creation, deletion, and listing of users and realms from MCP clients such as Claude Desktop.
by Spathodea-Network
Provides a Model Context Protocol server that enables querying and retrieving threat intelligence data from OpenCTI through a standardized interface.
by firstorderai
Provides seamless access to two‑factor authentication codes and passwords for AI agents, enabling automated login while maintaining security.