misp-mcp

Item: misp-mcp
Rating: 71
Author: M8ven

Connects MISP to MCP clients, enabling threat indicator lookups and submissions in plain language.

→ indranilroy99/misp-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

21 tools verified — handlers match their declared behaviour

19 read-only tools verified — handlers contain no write/delete/exec

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 2 credentials: MISP_MCP_TLS_KEY, MISP_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configMCP_TRANSPORT— e =http -e MCP_HOST=0.0.0.0 \

configMCP_HOST— e MCP_TRANSPORT=http -e =0.0.0.0 \

configMCP_PORT— hosted 8080 port

configMISP_URL— e =https://misp.example.com \

configMISP_VERIFY_TLS— both true set false only for a self-signed lab

configMISP_SUBMISSION_EVENT_ID— both required for writes event that misp_submit_ioc writes to

configMISP_MCP_SHOW_RESTRICTED— both true false turns on server-side TLP hiding

configMISP_MCP_PROTECTED_DOMAINS— both empty your own domains that can never be submitted

configMISP_MCP_SUBMIT_RATE— both 20 max submissions per key per minute

configMISP_MCP_TLS_CERT— / MISP_MCP_TLS_KEY hosted none serve HTTPS directly

🔐 secretMISP_MCP_TLS_KEY— MISP_MCP_TLS_CERT / hosted none serve HTTPS directly

configMISP_MCP_ALLOW_INSECURE_BIND— hosted false allow a public plain-HTTP bind (TLS on a proxy)

🔐 secretMISP_API_KEY— local required your key (local mode)

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/indranilroy99-misp-mcp-13kc0r)](https://m8ven.ai/mcp/indranilroy99-misp-mcp-13kc0r)

commit: 6126322cf58dda9e57df9c468b71891d967663d0

code hash: 6e20ccd8aadc727dc9fbd773983e734d03d8d4b3aebdb8638ca085ce28571bd5

verified: 7/16/2026, 8:40:59 AM

view raw JSON →