Metadata-Version: 2.5
Name: threatcluster-mcp
Version: 0.2.4
Summary: MCP server for the ThreatCluster threat-intelligence API: incident clusters, entity profiles, CVEs and ransomware leak-site victims as tools for Claude, Cursor, VS Code and any MCP client
Project-URL: Homepage, https://threatcluster.io/integrations/mcp
Project-URL: Documentation, https://threatcluster.io/integrations/mcp
Project-URL: Source, https://github.com/Jam0k/Threat-Intelligence-MCP
Project-URL: Changelog, https://github.com/Jam0k/Threat-Intelligence-MCP/blob/main/CHANGELOG.md
Author: ThreatCluster
License-Expression: GPL-3.0-or-later
License-File: LICENSE
Keywords: claude,cti,mcp,model-context-protocol,security,threat-intelligence,threatcluster
Classifier: Intended Audience :: Information Technology
Classifier: License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.10
Requires-Dist: httpx<1.0,>=0.27
Requires-Dist: mcp<2.0,>=1.2
Provides-Extra: test
Requires-Dist: pytest-asyncio>=0.23; extra == 'test'
Requires-Dist: pytest>=8.0; extra == 'test'
Description-Content-Type: text/markdown

# threatcluster-mcp (Python)

MCP server (stdio) for the ThreatCluster [threat-intelligence API](https://threatcluster.io/api): incident clusters, entity profiles, CVE records and ransomware leak-site victims as ten read-only tools for Claude, Cursor, VS Code, Windsurf, Zed and any MCP client.

```bash
uvx threatcluster-mcp            # or: pipx run threatcluster-mcp
```

Configure `THREATCLUSTER_API_KEY` (free keys: <https://threatcluster.io/get-started>). If the [`tc` CLI](https://threatcluster.io/cli) is installed and you have run `tc auth login`, the credential is picked up from its store (keyring or the 0600 file) with no configuration.

Claude Code:

```bash
claude mcp add threatcluster -e THREATCLUSTER_API_KEY=tc_live_... -- uvx threatcluster-mcp
```

Claude Desktop / Cursor / Windsurf (`mcpServers` block):

```json
{ "threatcluster": { "command": "uvx", "args": ["threatcluster-mcp"], "env": { "THREATCLUSTER_API_KEY": "tc_live_..." } } }
```

`threatcluster-mcp --check` prints where the key came from and where it will be sent (never the key).

Tools: `search_threats`, `search_everything`, `newest_threats`, `get_threat`, `leak_site_victims`, `lookup_entity`, `get_vulnerability`, `exploited_vulnerabilities`, `trending_entities`, `api_budget`. Prompt: `threatcluster_analyst`. Every result carries `cost` (credits), `budget` (remaining today) and `url` fields for citation.

The key leaves the process only as the `X-API-Key` header to `THREATCLUSTER_API_BASE`; it is never logged and is scrubbed from every error. No telemetry. Identical to the npm package `threatcluster-mcp` (`npx -y threatcluster-mcp`): both are generated from one tool spec and replay the same recorded fixtures byte-for-byte.

Full documentation, the tool table with credits per call and all client configs: <https://github.com/Jam0k/Threat-Intelligence-MCP> and <https://threatcluster.io/integrations/mcp>.
