MCP Server
ThreatIntellix runs a Model Context Protocol server (Pro plan and above) exposing OTX, VirusTotal, and HIBP lookups as tools any MCP-compatible AI assistant can call directly. Ask your assistant to check an IOC and it queries ThreatIntellix itself, no copy-pasting between tools.
1. Get an API key
In Settings → API keys, generate a key (same key used for the TAXII feed). Copy it immediately, it's only shown once.
2. Configure your MCP client
Add ThreatIntellix as an MCP server. This is the standard config shape (Claude Desktop, Claude Code, and most MCP clients use the same mcpServers structure). Check your specific client's docs for exactly where this goes:
{
"mcpServers": {
"threatintellix": {
"url": "https://your-deployment.example/api/mcp",
"headers": {
"Authorization": "Bearer sk_live_..."
}
}
}
}3. Available tools
otx_lookup: look up an IP, domain, URL, file hash, or CVE in AlienVault OTX.virustotal_lookup: look up a URL, domain, or IP address in VirusTotal.hibp_check: check an email address against Have I Been Pwned.
Transport
Streamable HTTP (JSON-RPC 2.0 over POST), the current MCP spec transport. This server doesn't use server-initiated streaming (no resources or prompts, only tools), so every call is a single request/response.