OpenCTI MCP Server

Overview

OpenCTI MCP Server connects to your OpenCTI instance, allowing you to query threat intelligence data directly through AI assistants. This integration enables security teams to quickly access critical threat information, search for indicators of compromise, and retrieve detailed reports on threat actors and malware.

Prerequisites

Before installing the OpenCTI MCP Server, ensure you have:

• Node.js 16 or higher installed
• Access to an OpenCTI instance
• A valid OpenCTI API token

Installation

Step 1: Clone the Repository

git clone https://github.com/Spathodea-Network/opencti-mcp.git
cd opencti-mcp

Step 2: Install Dependencies

npm install

Step 3: Build the Project

npm run build

Step 4: Configure Environment Variables

Create a .env file based on the provided example:

cp .env.example .env

Edit the .env file and add your OpenCTI credentials:

OPENCTI_URL=https://your-opencti-instance.com
OPENCTI_TOKEN=your-api-token

Step 5: Configure MCP Client

Add the OpenCTI MCP Server to your MCP client configuration. The exact location depends on your client, but the configuration should look similar to:

{
  "mcpServers": {
    "opencti": {
      "command": "node",
      "args": ["path/to/opencti-mcp/build/index.js"],
      "env": {
        "OPENCTI_URL": "${OPENCTI_URL}",
        "OPENCTI_TOKEN": "${OPENCTI_TOKEN}"
      }
    }
  }
}

Replace path/to/opencti-mcp with the actual path to your installation.

Usage

Once installed, you can use the OpenCTI MCP Server to query threat intelligence data. The server provides various tools for different types of queries:

1. Reports: Retrieve the latest threat intelligence reports or search for specific reports by ID.
2. Search Operations: Search for malware information, indicators of compromise, or threat actors.
3. User Management: List users and groups or get details about specific users.
4. STIX Objects: List attack patterns or get campaign information.
5. System Management: List connectors and status templates.
6. File Operations: List files or get details about specific files.
7. Reference Data: Access marking definitions and labels.

Security Considerations

• Never commit your .env file or API tokens to version control
• Keep your OpenCTI credentials secure
• Ensure your OpenCTI instance is properly secured
• Review access permissions regularly

Troubleshooting

If you encounter issues:

1. Verify your OpenCTI URL and token are correct
2. Check that your OpenCTI instance is accessible
3. Ensure Node.js is properly installed
4. Review the server logs for error messages

For additional help, refer to the GitHub repository or open an issue.