Enables interaction with OpenCTI threat intelligence platform through the Model Context Protocol, providing tools for indicators, observables, reports, cases, investigations, and more.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
process.env. You'll be asked to provide them before it can run.OPENCTI_CLIENT_PYTHON_PATHOPENCTI_URL— Yes Base URL of the OpenCTI instance, for example http://localhost:4000OPENCTI_TOKEN— Yes OpenCTI API bearer tokenOPENCTI_SSL_VERIFY— No true true, false, or a CA bundle pathMCP_TRANSPORT— No stdio stdio or sseMCP_SSE_PORT— No 8000 Bind port for SSE transportMCP_IDENTITY_MODE— opencti_bearer \MCP_API_KEY— Required for SSE unless explicitly disabled Bearer token required for SSE HTTP requestsLOG_LEVEL— No info Python log levelMCP_SSE_HOST— No 127.0.0.1 Bind host for SSE transportMCP_DOTENV_PATH— you may load one explicitly trusted dotenv file by setting toMCP_TENANTS_JSON— No unset JSON object of additional routable tenants keyed by tenant id. Each entry must define opencti_url, opencti_token, and may override ssl_verify. Multi-tenant routing is SSE-only.MCP_COORDINATION_BACKEND_FACTORY— No unset Optional module:callable import path that returns a CoordinationBackends bundle for externally managed audit, quota, and idempotency storage.MCP_TRUSTED_PROXY_SOURCES— No 127.0.0.1,::1 Comma-separated proxy source IPs or CIDR ranges allowed to supply forwarded client headers when MCP_TRUST_PROXY_HEADERS=true. At least one source is required when enabled.MCP_IDEMPOTENCY_BACKEND— No memory memory for process-local replay protection or sqlite for restart-safe durable replay protection.MCP_IDEMPOTENCY_SQLITE_PATH— Required when MCP_IDEMPOTENCY_BACKEND=sqlite Absolute path to the SQLite idempotency database file.MCP_OBSERVABILITY_BACKEND— No memory memory for process-local audit and quota state or sqlite for restart-safe, cross-process observability state.MCP_OBSERVABILITY_SQLITE_PATH— Required when MCP_OBSERVABILITY_BACKEND=sqlite Absolute path to the SQLite observability database file.[](https://m8ven.ai/mcp/blauwers-opencti-mcp-server-54j9fc)