ppcvote/misp-mcp-server

Overview

A TypeScript-based MCP server that connects to MISP (Malware Information Sharing Platform) for threat intelligence operations. It includes built-in prompt injection defense via the prompt-defense-audit library.

Best for

Best for
Developers building AI agents that need to query MISP threat intelligence with added security against prompt injection

Use cases

• Query MISP events and attributes from an MCP client
• Automate threat intelligence workflows with MISP data
• Integrate MISP into AI agent pipelines with injection protection

How to use

Install

npm install -g @ultralab/misp-mcp-server

Tools exposed

• misp_version
• misp_list_events
• misp_get_event
• misp_search_events
• misp_search_attributes
• misp_list_tags
• misp_list_feeds
• misp_list_galaxies
• MISP_URL
• MISP_API_KEY
• MISP_INSECURE_TLS
• PROMPT_DEFENSE_DISABLED

Tested with

Claude Desktop, Cursor, Cline, Continue

Notes

A TypeScript-based MCP server that connects to MISP (Malware Information Sharing Platform) for threat intelligence operations. It includes built-in prompt injection defense via the prompt-defense-audit library.

1 stars on GitHub. Last updated 2026-05-29. Licensed MIT.

Use cases

• Query MISP events and attributes from an MCP client
• Automate threat intelligence workflows with MISP data
• Integrate MISP into AI agent pipelines with injection protection

Pros

• Provides direct MISP access through the MCP protocol
• Includes prompt injection defense for safer AI interactions
• Written in TypeScript for type safety and maintainability

Cons

• Very early stage with only 1 GitHub star
• Limited community adoption and documentation
• Requires a running MISP instance to be useful

Indexed from awesome-mcp-servers-punkpeye and enriched against its public facts.