Google Threat Intelligence

About

The Google Threat Intelligence (GTI) MCP Server (Standalone) acts as a bridge, enabling AI assistants like Claude, Cline, and Cursor, as well as custom frontend applications, to access comprehensive threat intelligence from Google and VirusTotal. It's built on the Model Context Protocol (MCP) and offers flexible deployment options, supporting both local development for individual analysts and scalable production cloud deployments via Google Cloud Run. This tool empowers users with capabilities like deep threat intelligence search, file analysis, reputation checking for domains, IPs, and URLs, IOC searching, and managing threat profiles and hunting rulesets, making it a critical asset for enhancing security operations and threat analysis workflows.

Key Features

• File analysis and sandbox behavior reporting
• Domain, IP, and URL reputation checking
• 0 GitHub stars
• Management of threat profiles and hunting rulesets
• Indicator of Compromise (IOC) search capabilities
• Comprehensive threat intelligence search (campaigns, threat actors, malware)

Use Cases

• Developing custom security applications that require deep integration with threat intelligence platforms.
• Providing a centralized, scalable threat intelligence service for security teams and applications.
• Enhancing AI assistant capabilities with real-time Google Threat Intelligence data.