ORKL Threat Intelligence MCP Server

SecurityPython

Access and analyze threat intelligence reports and actor information via the ORKL API

Available Tools

fetch_latest_threat_reports

Fetch recent threat reports with their titles and IDs

fetch_threat_report_details

Retrieve detailed information for a specific threat report by ID

report_id

fetch_threat_actors

Fetch a list of known threat actors with their IDs and names

fetch_threat_actor_details

Retrieve detailed information for a specific threat actor by ID

actor_id

fetch_sources

Fetch a list of sources used in threat intelligence

fetch_source_details

Retrieve detailed metadata for a specific source by ID

source_id

ORKL Threat Intelligence provides security professionals with tools to access and analyze cybersecurity threat intelligence through the ORKL API. This MCP enables you to fetch detailed information about the latest threat reports, threat actors, and intelligence sources directly within your AI assistant. With this integration, you can quickly retrieve comprehensive threat intelligence data to enhance your security analysis, threat hunting, and incident response capabilities. The MCP offers a streamlined way to access ORKL's extensive database of threat intelligence without leaving your AI assistant workflow.

ORKL Threat Intelligence MCP

ORKL Threat Intelligence MCP provides a seamless way to access and analyze cybersecurity threat intelligence data through the ORKL API. This integration allows security professionals to retrieve detailed information about threat reports, threat actors, and intelligence sources directly within their AI assistant.

Installation

To install the ORKL Threat Intelligence MCP, you need to edit or create your Claude configuration file. The file is typically located at:

/Users/user/Library/Application Support/Claude/claude_desktop_config.json

Add the following configuration to your file:

{
  "mcpServers": {
    "orkl": {
      "command": "uv",
      "args": [
        "--directory",
        "/path/to/your/directory/orkl",
        "run",
        "orkl"
      ]
    }
  }
}

Make sure to replace /path/to/your/directory/ with the actual path where you've cloned or downloaded the MCP repository.

Usage

Once installed, you can use the ORKL Threat Intelligence MCP to:

Retrieve Latest Threat Reports: Get a list of the most recent threat intelligence reports available in the ORKL database.
Analyze Specific Threat Reports: Fetch detailed information about a particular threat report by providing its ID.
Explore Threat Actors: Access information about known threat actors, including their tactics, techniques, and procedures.
Research Intelligence Sources: Examine the sources used for threat intelligence gathering and their reliability.

Example Queries

Here are some example queries you can use with this MCP:

"Show me the latest threat reports available in ORKL"
"Get detailed information about threat report with ID [specific_id]"
"List all known threat actors in the database"
"Provide details about the threat actor [actor_name]"
"What sources are used for threat intelligence in ORKL?"
"Give me information about source [source_name]"

Additional Resources

For more information about using this MCP, you can refer to the detailed write-up available at: Building a Threat Intelligence GenAI Reporter with ORKL and Claude