How do I connect Claude Desktop or Claude.ai to the Threadlinqs Intelligence MCP server?

Add a custom connector pointing at the remote endpoint https://intel.threadlinqs.com/mcp (Streamable-HTTP, JSON-RPC 2.0, MCP protocol version 2025-06-18), then complete the OAuth 2.1 sign-in flow (PKCE S256) with a Purple or Gold account and approve access. No API key is required for the remote transport — OAuth 2.1 is live.

How do I use the Threadlinqs Intelligence MCP server from the command line?

Install the local transport by adding the intelthreadlinqs-mcp npm package to your MCP client config. It runs over stdio via npx and authenticates with a Bearer tl_ API key supplied in the THREADLINQS_API_KEY environment variable. This works in any MCP-compatible CLI client.

How many tools does the Threadlinqs Intelligence MCP server have?

Exactly 49 tools, available identically on both the remote (Streamable-HTTP/OAuth) and local (stdio/API key) transports, which share a single tool catalog.

Threadlinqs Intelligence MCP Server v6 — 49 Tools, Two Transports, for Every AI Agent

Q: What is the Threadlinqs Intelligence MCP server?

It is a Model Context Protocol (MCP) server, version 6.0.0, that exposes 49 tools giving AI agents direct, structured access to the Threadlinqs Intelligence threat-intelligence platform — threats, SPL/KQL/Sigma detections, IOCs, CVEs/CWEs, threat actors, MITRE ATT&CK coverage, C2 infrastructure, correlations, daily debriefs, and STIX / ATT&CK Navigator export. It is a Purple-tier feature: every tool requires authentication and a Purple or Gold subscription.

The Threadlinqs Intelligence MCP server is now at v6.0.0, and it exposes 49 tools that put the full Threadlinqs threat-intelligence platform directly inside any AI agent that speaks the Model Context Protocol. Connect Claude Desktop or Claude.ai to a remote endpoint over OAuth 2.1, or wire the intelthreadlinqs-mcp npm package into your terminal-based agent over stdio. Either way, your agent can now search live threats, pull SPL/KQL/Sigma detections, enrich IOCs, look up CVEs, map MITRE ATT&CK coverage, pivot on C2 infrastructure, run cross-correlations, and export STIX bundles and ATT&CK Navigator layers — all without you copy-pasting a single thing.

TL;DR — MCP v6 ships 49 tools on two transports that share one catalog: remote POST https://intel.threadlinqs.com/mcp (Streamable-HTTP + OAuth 2.1) for Claude Desktop / Claude.ai, and local intelthreadlinqs-mcp over stdio (Bearer tl_ API key) for CLI agents. It is a Purple-tier feature — every tool requires authentication and a Purple or Gold subscription (tier ≥ 3). OAuth 2.1 is live today.

What Is the Threadlinqs Intelligence MCP Server?

The Model Context Protocol is an open standard for connecting AI agents to external tools and data sources. An MCP server publishes a catalog of tools (callable functions with typed inputs) that an MCP-capable client — Claude Desktop, Claude.ai, or a CLI agent — can invoke on the user's behalf during a conversation.

The Threadlinqs Intelligence MCP server is the official bridge between that ecosystem and the Threadlinqs Intelligence platform. Instead of asking an agent to scrape the web for stale, half-attributed threat data, you give it a precise, authenticated channel into the same structured intelligence the platform serves through its UI: curated threats, detection rules in three flavors, IOC enrichment, CVE/CWE detail, threat-actor profiles, MITRE coverage, C2 infrastructure intelligence, daily debriefs, and analyst-grade correlations.

Two Transports, One Catalog

v6 runs the same 49 tools over two transports, so you choose based on where your agent lives — not on what data you can reach. The catalog is identical on both.

Transport	Endpoint / Package	Auth	Best for
Remote (Streamable-HTTP)	`POST https://intel.threadlinqs.com/mcp`	OAuth 2.1 (PKCE S256)	Claude Desktop, Claude.ai custom connectors
Local (stdio)	`npx -y intelthreadlinqs-mcp`	Bearer `tl_` API key via `THREADLINQS_API_KEY`	CLI agents, IDE-embedded MCP clients

Both transports speak JSON-RPC 2.0 and target MCP protocol version 2025-06-18. They expose the same tools, return the same structured payloads, and enforce the same access controls.

A Purple-Tier Feature

The Threadlinqs Intelligence MCP server is a Purple-tier capability. Every one of the 49 tools requires authentication and a Purple or Gold subscription (tier ≥ 3). There is no free or anonymous MCP access — the remote transport gates each session behind OAuth 2.1, and the local transport requires a valid Purple/Gold tl_ API key. This keeps the analyst-grade composite intelligence (correlations, C2 cross-pivots, threat bundles, STIX/ATT&CK export) behind a verified subscription.

Pricing is simple: Purple is $11.99/mo (our most popular tier) and Gold is custom for enterprise. See the pricing page for the full breakdown.

The 49 Tools

The catalog spans the entire intelligence lifecycle — from a single CVE lookup to a full daily-intel bundle an agent can summarize into a morning brief.

Group	Count	Tools
Threats	10	`search_threats`, `get_threat`, `get_recent_threats`, `list_threat_categories`, `get_similar_threats`, `get_threat_simulations`, `get_threat_transcripts`, `get_threat_bundle`, `get_threat_hunting_bundle`, `bulk_get_threats`
Detections	4	`get_detections`, `search_detections`, `get_detection_detail`, `export_detection`
IOCs	4	`search_iocs`, `get_ioc_dns`, `get_ioc_intelligence`, `get_ioc_blast_radius`
CVE / CWE	4	`get_cve`, `get_cwe`, `get_cve_intelligence`, `bulk_get_cves`
Threat Actors	4	`get_actor`, `search_actors`, `get_actor_intelligence`, `get_infrastructure_pivots`
MITRE ATT&CK	4	`get_mitre_coverage`, `get_mitre_technique`, `get_mitre_gap_analysis`, `predict_mitre_transitions`
C2 Infrastructure	2	`get_c2`, `generate_c2_blocklist`
Correlations	2	`get_correlations`, `get_enrichment_overview`
Debriefs	4	`list_debriefs`, `get_debrief`, `get_latest_debrief`, `get_daily_intel_bundle`
Simulations	1	`list_simulations`
Standards Export	2	`export_stix`, `export_attack_navigator`
Platform	8	`get_started`, `get_platform_stats`, `get_landscape_briefing`, `get_daily_theme`, `get_threat_level`, `get_roadmap`, `get_changelog`, `health`

What Your AI Agent Can Actually Do

The point of MCP isn't a tool list — it's the questions your agent can now answer on its own. A few examples:

Threat triage. "What new critical threats landed this week, and which ones touch the AI stack?" — the agent calls get_recent_threats, filters with search_threats, and pulls full context with get_threat and get_threat_bundle.
Detection engineering. "Give me the Splunk SPL, Microsoft KQL, and Sigma rules for this campaign." — search_detections and get_detection_detail return all three flavors; export_detection hands back deployable rule text.
IOC enrichment. "Is this domain seen in any active campaign, and what's the blast radius?" — get_ioc_intelligence and get_ioc_blast_radius resolve context; get_ioc_dns adds passive-DNS pivots.
Vulnerability context. "How urgent is CVE-2026-XXXXX — is it in CISA KEV, and what's the EPSS?" — get_cve and get_cve_intelligence deliver enriched detail; bulk_get_cves batches a whole patch cycle.
Attribution & infrastructure. "Profile this actor and pivot off its known infrastructure." — get_actor_intelligence, get_infrastructure_pivots, and the C2 tools get_c2 / generate_c2_blocklist turn a name into a blocklist.
Coverage & gaps. "Where are the holes in our ATT&CK coverage?" — get_mitre_coverage and get_mitre_gap_analysis map the matrix; predict_mitre_transitions forecasts likely next techniques.
Standards export. "Export this into our TIP and our ATT&CK Navigator." — export_stix emits a STIX bundle, export_attack_navigator emits a Navigator layer.
Daily brief. "Summarize today's intelligence." — get_daily_intel_bundle and get_latest_debrief feed the agent a ready-to-read morning brief.

How to Connect — Remote (Claude Desktop & Claude.ai)

The remote transport is the fastest path for chat-based agents. OAuth 2.1 is live — there's no API key to manage and no config file to edit.

In Claude Desktop or Claude.ai, open the connector settings and choose Add custom connector.
Enter the MCP endpoint URL: https://intel.threadlinqs.com/mcp
When prompted, complete the OAuth 2.1 sign-in (authorization code with PKCE S256) using your Purple or Gold Threadlinqs account, then approve the requested access.
The 49 tools appear in your client. Ask a question — the agent calls them automatically.

Under the hood, the endpoint is a Streamable-HTTP MCP server:

POST https://intel.threadlinqs.com/mcp
Content-Type: application/json
Accept: application/json, text/event-stream

{ "jsonrpc": "2.0", "id": 1, "method": "tools/list" }http

How to Connect — Local (CLI & stdio)

For terminal-based agents and IDE-embedded MCP clients, use the published npm package intelthreadlinqs-mcp over stdio, authenticated with a Bearer tl_ API key. Generate your key from Profile → API Key on the platform (your account must be Purple or Gold), then add this to your MCP client config:

{
  "mcpServers": {
    "threadlinqs-intel": {
      "command": "npx",
      "args": ["-y", "intelthreadlinqs-mcp"],
      "env": {
        "THREADLINQS_API_KEY": "tl_your_key"
      }
    }
  }
}json

That's it — restart your client and the same 49 tools are available locally.

Discovery & Documentation

Everything an agent (or a curious human) needs to discover the server is published at well-known URLs:

What	URL
MCP manifest	`https://intel.threadlinqs.com/.well-known/mcp.json`
OAuth protected-resource metadata	`https://intel.threadlinqs.com/.well-known/oauth-protected-resource`
OAuth authorization-server metadata	`https://intel.threadlinqs.com/.well-known/oauth-authorization-server`
Human documentation	https://intel.threadlinqs.com/mcp
Markdown twin (for agents)	https://intel.threadlinqs.com/mcp.md

Why This Matters

Threat intelligence is only useful at the speed of decision. When an analyst has to leave their workflow, open a portal, run a search, copy an IOC, paste it into another tool, and reformat a detection rule, the half-life of that intel is spent on mechanics. MCP collapses that loop: the agent your team already talks to can now reach authenticated, structured, current intelligence and act on it in the same breath — triage a threat, pull the matching SPL/KQL/Sigma, enrich an indicator, and hand back a STIX bundle for the TIP.

v6 is the version where that promise becomes real across both surfaces analysts actually use — the chat window and the command line — backed by a single, consistent 49-tool catalog and live OAuth 2.1.

The Threadlinqs Intelligence MCP server is available to Purple and Gold subscribers. Start at the MCP documentation page, or read more about the platform at intel.threadlinqs.com. Questions or enterprise inquiries: contact@threadlinqs.com.