io.github.Jam0k/threatcluster

io.github.Jam0k/threatcluster

Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.

Connect this server

Add this to your MCP client config — claude_desktop_config.json (Claude Desktop) or .cursor/mcp.json (Cursor).Suits: Claude Desktop · Cursor.

{
  "mcpServers": {
    "threatcluster": {
      "command": "npx",
      "args": [
        "-y",
        "threatcluster-mcp@0.2.3"
      ],
      "env": {
        "THREATCLUSTER_API_KEY": "<your THREATCLUSTER_API_KEY>",
        "THREATCLUSTER_API_BASE": "https://threatcluster.io/api/public/v1"
      }
    }
  }
}
Environment variables
  • THREATCLUSTER_API_KEYrequiredsecretThreatCluster API key (tc_live_... / tc_agent_...). Free keys: https://threatcluster.io/api
  • THREATCLUSTER_API_BASEAPI base URL

A starting point — check the repository for exact arguments and setup. Restart your client after editing the config.

Category
Developer Tools
Version
0.2.3
Registry
active
Published
9/26/2026

Remotes

  • streamable-httphttps://threatcluster.io/mcp
Browse all Developer Tools →

Add the badge to your site

Show visitors that io.github.Jam0k/threatcluster is listed here — it’s also the link we check for a free listing.

io.github.Jam0k/threatcluster — listed on Serverdex

HTML — for your website

<a href="https://serverdex.io/server/io-github-jam0k-threatcluster?utm_source=badge"><img src="https://serverdex.io/brand/badge.svg" alt="io.github.Jam0k/threatcluster — listed on Serverdex" width="123" height="40" loading="lazy"></a>

Recommended. A dofollow link from your own domain is the one that counts for search engines, and it's the link we check for a free listing.

Markdown — for your README

[![io.github.Jam0k/threatcluster — listed on Serverdex](https://serverdex.io/brand/badge.svg)](https://serverdex.io/server/io-github-jam0k-threatcluster?utm_source=badge)

Nice for visibility, but GitHub marks README links nofollow, so it doesn't pass authority. Use the HTML badge on your site as well.