MISP
by MISP
The official MISP MCP server, giving an agent read-only search access to your MISP instance's events, indicators, tags, galaxies, and threat feeds.
About
misp-mcp is MISP's own bridge to the Model Context Protocol, letting an agent search a threat-intelligence instance the same way an analyst would in the UI (by IOC value, tag, date range, or organization) without giving it write access to the platform. It covers the core object model: events, individual attributes (the actual indicators), and objects (grouped attributes like a file object bundling a hash, filename, and size), each with both a search variant and a get-by-ID variant for pulling full detail.
It also exposes MISP's context layers beyond raw indicators: tag search and full taxonomy browsing, galaxy search (threat actors, malware families, MITRE ATT&CK techniques) with cluster-level detail, and feed search for the external threat-intel sources a MISP instance is configured to pull from. Everything is read-only, and the server authenticates against your instance with a standard MISP API key rather than any special MCP-specific credential.
Key features
- Read-only search across events, attributes, and grouped objects
- Tag and taxonomy browsing for classification context
- Galaxy and galaxy-cluster search for threat actors, malware, and ATT&CK techniques
- Feed search for configured external threat-intelligence sources
- Lightweight event-index browsing separate from full event retrieval
- Standard MISP API key authentication, no separate credential system
Use cases
- Letting an agent triage an incoming IOC by checking whether MISP already has matching events or attributes
- Answering analyst questions like "what galaxies/clusters are tagged to this actor" without manual MISP navigation
- Summarizing a threat feed's recent contributions during a briefing
- Feeding MISP context into a SOC copilot without exposing write access to shared threat-intel data
Available tools
search_events
Searches events by IOC values, tags, date range, or organization.
search_attributes
Searches individual indicators (attributes) across all events.
get_event
Retrieves the full detail of a single event by ID.
search_galaxies
Searches galaxies for threat actors, malware families, and ATT&CK techniques.
search_tags
Finds tags by name for classification lookups.
search_feeds
Browses the threat-intelligence feeds configured on the instance.
Frequently asked questions
Can the agent create or modify MISP events through this server?
No. Every tool in misp-mcp is read-only; it can search and retrieve, but it has no create, update, or delete operations against your MISP instance.
What do I need to connect it to my MISP instance?
A MISP_URL and MISP_API_KEY set as environment variables (plus an optional MISP_VERIFYCERT flag), pointing at your existing MISP deployment.