AI导哈

OpenCTI FastMCP 服务器

OpenCTI FastMCP Server 是一个通过 FastMCP 框架将 OpenCTI 实例暴露给 Model Context Protocol (MCP) 客户端的服务，提供 REST 指标搜索、实体获取和 GraphQL 查询执行功能。

  • by 7elu-dl
  • Python
  • 本地部署
  • 更新于
在 GitHub 查看 7elu-dl/OpenCTI_MCP_Server

使用说明

OpenCTI FastMCP Server

This project exposes an OpenCTI instance to Model Context Protocol (MCP) clients via the FastMCP framework.

Features

  • REST indicator search with simple filtering
  • Fetch any OpenCTI entity by type and identifier
  • Execute raw GraphQL queries for advanced use cases

Requirements

  • Python 3.10+
  • Access to an OpenCTI instance with a valid API token

Installation

pip install -e .

Configuration

Set the following environment variables (a .env file is supported):

OPENCTI_URL=https://your-opencti.example.com
OPENCTI_TOKEN=YOUR_API_TOKEN
# Optional
OPENCTI_VERIFY_SSL=true
OPENCTI_TIMEOUT=30
VIRUSTOTAL_CONNECTOR_ID=CONNECTOR_ID

Running the server

opencti-mcp

By default FastMCP runs the server over STDIO. Consult the FastMCP documentation for alternative transports if required.

Tools

All search tools run predefined GraphQL queries and return the connection payload (edges, nodes, pageInfo).

search_indicators

Search indicators via curated GraphQL query returning key indicator metadata. Parameters:

  • search (optional): search string
  • limit (default 25): maximum number of results

search_threat_actors

Locate threat actors (id, aliases, motivations, labels, markings). Parameters:

  • search (optional): search string
  • limit (default 25): maximum number of results

search_intrusion_sets

Locate intrusion sets (aliases, goals, temporal bounds, markings). Parameters mirror search_threat_actors.

search_campaigns

Locate campaigns (objectives, temporal bounds, labels). Parameters mirror search_threat_actors.

search_malware

Locate malware (types, family flag, temporal bounds, labels). Parameters mirror search_threat_actors.

search_attack_patterns

Locate attack patterns and TTPs (MITRE metadata, labels, markings). Parameters mirror search_threat_actors.

search_infrastructures

Locate infrastructures leveraged by adversaries (types, temporal bounds, labels). Parameters mirror search_threat_actors.

search_vulnerabilities

Locate vulnerabilities (score details, attack vector, labels). Parameters mirror search_threat_actors.

search_reports

Locate finished intelligence reports (report types, publication date, markings). Parameters mirror search_threat_actors.

ask_virustotal_enrichment

Request enrichment for an observable value using the VirusTotal connector. Parameters:

  • value: observable value (IP, domain, or hash)
  • value_type (optional): explicitly specify ip, domain, or hash (auto-detected when omitted)

get_entity

Retrieve a single entity from the REST API. Parameters:

  • entity_type: REST resource (e.g. indicator, threat-actor)
  • entity_id: OpenCTI internal ID

execute_graphql

Execute arbitrary GraphQL queries. Parameters:

  • query: GraphQL query string
  • variables (optional): variables dictionary

相关 MCP