ppcvote/misp-mcp-server

What it does

ppcvote/misp-mcp-server is an MCP (Model Context Protocol) server that integrates MISP (Malware Information Sharing Platform) with AI assistants. It provides secure access to threat intelligence data including events, attributes, tags, feeds, and galaxies through readonly tools, enabling security researchers and analysts to query malware information directly within AI conversations.

How to set up

This tool operates as an MCP server that connects to your MISP instance. Installation involves: 1) Cloning the repository from GitHub, 2) Configuring your MISP API credentials, 3) Running the MCP server, 4) Connecting it to your chosen AI platform (Claude, ChatGPT, or AI Studio). The server includes built-in prompt defense audit mechanisms to prevent injection attacks during setup.

Key features

• 8 readonly threat intelligence tools (events, attributes, search, tags, feeds, galaxies)
• Built-in prompt injection defense via promptdefenseaudit
• Compatible with multiple AI platforms (Claude, ChatGPT, AI Studio, Antigravity)
• Secure MISP data access without modification permissions
• Threat intelligence research and analysis capabilities