The Threadlinqs Intelligence MCP server is now at v7.1.3 — and this release is about reach as much as it is about polish. The server is now open source under the MIT license at github.com/threadlinqs-cmd/intelthreadlinqs-mcp, it is listed on the official Model Context Protocol registry, and the v7 rebuild makes all 49 tools leaner and more token-efficient. The catalog and the two transports are the same ones you already know — connect Claude Desktop or Claude.ai over OAuth 2.1, or wire the intelthreadlinqs-mcp npm package into a terminal agent over stdio — but the code is now in the open, the server is discoverable through the registry, and every call gives your agent tighter, more deterministic answers.
TL;DR — MCP v7.1.3 is open source (MIT) atgithub.com/threadlinqs-cmd/intelthreadlinqs-mcp, on the official MCP registry asio.github.threadlinqs-cmd/intelthreadlinqs-mcp, and installable from npm asintelthreadlinqs-mcp. It ships 49 tools on two transports that share one catalog: remotePOST https://intel.threadlinqs.com/mcp(Streamable-HTTP + OAuth 2.1) and localnpx intelthreadlinqs-mcpover stdio (Bearertl_API key). It remains a Purple-tier feature — every tool requires a Purple or Gold subscription (tier ≥ 3). The v7 rebuild is lean by default: tighter payloads, less wasted context, more deterministic calls.
What's New in v7.1.3
If you've used the server since v6, the day-to-day experience is familiar. What changed is where the server lives and how it behaves under the hood:
- Open source, MIT-licensed. The full server source is now public at github.com/threadlinqs-cmd/intelthreadlinqs-mcp — read it, audit it, fork it, or open an issue.
- On the official MCP registry. The server is published to
registry.modelcontextprotocol.iounder the nameio.github.threadlinqs-cmd/intelthreadlinqs-mcp, so registry-aware clients and directories can discover and install it automatically. - A leaner v7. The v7 line rebuilt the tools to be lean by default — structured, minimal payloads that keep your agent's context window free for reasoning, with the option to ask for more detail only when a task needs it.
What Is the Threadlinqs Intelligence MCP Server?
The Model Context Protocol is an open standard for connecting AI agents to external tools and data sources. An MCP server publishes a catalog of tools (callable functions with typed inputs) that an MCP-capable client — Claude Desktop, Claude.ai, or a CLI agent — can invoke on the user's behalf during a conversation.
The Threadlinqs Intelligence MCP server is the official bridge between that ecosystem and the Threadlinqs Intelligence platform. Instead of asking an agent to scrape the web for stale, half-attributed threat data, you give it a precise, authenticated channel into the same structured intelligence the platform serves through its UI: curated threats, detection rules in three flavors, IOC enrichment, CVE/CWE detail, threat-actor profiles, MITRE coverage, C2 infrastructure intelligence, daily debriefs, and analyst-grade correlations.
Open Source, MIT-Licensed
As of v7.1.3, the server source lives in the open at github.com/threadlinqs-cmd/intelthreadlinqs-mcp under the MIT license. You can read exactly how each tool is defined, how requests are shaped, and how your API key is handled — nothing about the client is a black box.
One clarification worth making: the server is a client for the Threadlinqs Intelligence platform. Open-sourcing the code doesn't open the corpus — the tools still call the authenticated Threadlinqs API and return data only for a valid Purple or Gold subscription. What's open is the connective tissue: the tool schema, the transport handling, and the request/auth flow that your AI agent runs locally.
On the Official MCP Registry
v7.1.3 is published to the official Model Context Protocol registry at registry.modelcontextprotocol.io under the name io.github.threadlinqs-cmd/intelthreadlinqs-mcp. The registry is the canonical, machine-readable index of MCP servers — the place a growing number of MCP clients and directories look first when a user wants to add a server by name rather than by hand-editing a config file.
Being in the registry means the Threadlinqs Intelligence server is now discoverable the same way any first-class MCP tool is: search for it, add it, and let your client wire up the npm package for you. Downstream directories that ingest the registry pick it up automatically, so the server's presence spreads without a manual submission to each one.
A Leaner v7
The most useful change under the hood is that v7 is lean by default. In earlier versions, a broad call could return far more than an agent needed for the step at hand — and every extra field is context the model has to carry. v7 flips that: tools return tight, structured payloads scoped to what you asked for, and expose the option to pull richer detail only when a task actually requires it.
For an agent, that translates into two practical wins. First, more room to think — less of the context window is spent on payload boilerplate, so multi-step hunts stay coherent for longer. Second, more deterministic behavior — narrow, well-scoped calls return predictable shapes instead of a firehose the model has to sift, which makes tool use more reliable inside a longer chain.
Two Transports, One Catalog
v7.1.3 runs the same 49 tools over two transports, so you choose based on where your agent lives — not on what data you can reach. The catalog is identical on both.
| Transport | Endpoint / Package | Auth | Best for |
|---|---|---|---|
| Remote (Streamable-HTTP) | POST https://intel.threadlinqs.com/mcp | OAuth 2.1 (PKCE S256) | Claude Desktop, Claude.ai custom connectors |
| Local (stdio) | npx -y intelthreadlinqs-mcp | Bearer tl_ API key via THREADLINQS_API_KEY | CLI agents, IDE-embedded MCP clients |
Both transports speak JSON-RPC 2.0. They expose the same tools, return the same structured payloads, and enforce the same access controls.
A Purple-Tier Feature
The Threadlinqs Intelligence MCP server is a Purple-tier capability. Every one of the 49 tools requires authentication and a Purple or Gold subscription (tier ≥ 3). There is no free or anonymous MCP access — the remote transport gates each session behind OAuth 2.1, and the local transport requires a valid Purple/Gold tl_ API key. Open-sourcing the client doesn't change this: the code is public, but the data behind it stays behind a verified subscription.
Pricing is simple: Purple is $11.99/mo (our most popular tier) and Gold is custom for enterprise. See the pricing page for the full breakdown.
The 49 Tools
The catalog spans the entire intelligence lifecycle — from a single CVE lookup to a full daily-intel bundle an agent can summarize into a morning brief. The groups below are stable across v7; the authoritative, always-current tool list lives at the MCP docs page and the registry entry.
| Group | Count | Representative tools |
|---|---|---|
| Threats | 10 | search_threats, get_threat, get_recent_threats, get_similar_threats, get_threat_bundle, get_threat_hunting_bundle, bulk_get_threats |
| Detections | 4 | get_detections, search_detections, get_detection_detail, export_detection |
| IOCs | 4 | search_iocs, get_ioc_dns, get_ioc_intelligence, get_ioc_blast_radius |
| CVE / CWE | 4 | get_cve, get_cwe, get_cve_intelligence, bulk_get_cves |
| Threat Actors | 4 | get_actor, search_actors, get_actor_intelligence, get_infrastructure_pivots |
| MITRE ATT&CK | 4 | get_mitre_coverage, get_mitre_technique, get_mitre_gap_analysis, predict_mitre_transitions |
| C2 Infrastructure | 2 | get_c2, generate_c2_blocklist |
| Correlations | 2 | get_correlations, get_enrichment_overview |
| Debriefs | 4 | list_debriefs, get_debrief, get_latest_debrief, get_daily_intel_bundle |
| Simulations | 1 | list_simulations |
| Standards Export | 2 | export_stix, export_attack_navigator |
| Platform | 8 | get_started, get_platform_stats, get_landscape_briefing, get_threat_level, get_roadmap, get_changelog, health |
What Your AI Agent Can Actually Do
The point of MCP isn't a tool list — it's the questions your agent can now answer on its own. A few examples:
- Threat triage. "What new critical threats landed this week, and which ones touch the AI stack?" — the agent calls
get_recent_threats, filters withsearch_threats, and pulls full context withget_threatandget_threat_bundle. - Detection engineering. "Give me the Splunk SPL, Microsoft KQL, and Sigma rules for this campaign." —
search_detectionsandget_detection_detailreturn all three flavors;export_detectionhands back deployable rule text. - IOC enrichment. "Is this domain seen in any active campaign, and what's the blast radius?" —
get_ioc_intelligenceandget_ioc_blast_radiusresolve context;get_ioc_dnsadds passive-DNS pivots. - Vulnerability context. "How urgent is this CVE — is it in CISA KEV, and what's the EPSS?" —
get_cveandget_cve_intelligencedeliver enriched detail;bulk_get_cvesbatches a whole patch cycle. - Attribution & infrastructure. "Profile this actor and pivot off its known infrastructure." —
get_actor_intelligence,get_infrastructure_pivots, and the C2 toolsget_c2/generate_c2_blocklistturn a name into a blocklist. - Coverage & gaps. "Where are the holes in our ATT&CK coverage?" —
get_mitre_coverageandget_mitre_gap_analysismap the matrix;predict_mitre_transitionsforecasts likely next techniques. - Standards export. "Export this into our TIP and our ATT&CK Navigator." —
export_stixemits a STIX bundle,export_attack_navigatoremits a Navigator layer. - Daily brief. "Summarize today's intelligence." —
get_daily_intel_bundleandget_latest_debrieffeed the agent a ready-to-read morning brief.
How to Connect — Remote (Claude Desktop & Claude.ai)
The remote transport is the fastest path for chat-based agents. OAuth 2.1 is live — there's no API key to manage and no config file to edit.
- In Claude Desktop or Claude.ai, open the connector settings and choose Add custom connector.
- Enter the MCP endpoint URL:
https://intel.threadlinqs.com/mcp - When prompted, complete the OAuth 2.1 sign-in (authorization code with PKCE S256) using your Purple or Gold Threadlinqs account, then approve the requested access.
- The 49 tools appear in your client. Ask a question — the agent calls them automatically.
Under the hood, the endpoint is a Streamable-HTTP MCP server:
POST https://intel.threadlinqs.com/mcp
Content-Type: application/json
Accept: application/json, text/event-stream
{ "jsonrpc": "2.0", "id": 1, "method": "tools/list" }httpHow to Connect — Local (CLI & stdio)
For terminal-based agents and IDE-embedded MCP clients, use the published npm package intelthreadlinqs-mcp over stdio, authenticated with a Bearer tl_ API key. Generate your key from Profile → API Key on the platform (your account must be Purple or Gold), then add this to your MCP client config:
{
"mcpServers": {
"threadlinqs-intel": {
"command": "npx",
"args": ["-y", "intelthreadlinqs-mcp"],
"env": {
"THREADLINQS_API_KEY": "tl_your_key"
}
}
}
}jsonThat's it — restart your client and the same 49 tools are available locally. Registry-aware clients can also add the server by its registry name, io.github.threadlinqs-cmd/intelthreadlinqs-mcp, and let the client wire up the npm package for you.
Discovery & Documentation
Everything an agent (or a curious human) needs to discover the server is published at well-known URLs:
| What | URL |
|---|---|
| Source code (MIT) | github.com/threadlinqs-cmd/intelthreadlinqs-mcp |
| npm package | npmjs.com/package/intelthreadlinqs-mcp |
| Official MCP registry | io.github.threadlinqs-cmd/intelthreadlinqs-mcp |
| MCP manifest | https://intel.threadlinqs.com/.well-known/mcp.json |
| Human documentation | https://intel.threadlinqs.com/mcp |
| Markdown twin (for agents) | https://intel.threadlinqs.com/mcp.md |
Why This Matters
Threat intelligence is only useful at the speed of decision. When an analyst has to leave their workflow, open a portal, run a search, copy an IOC, paste it into another tool, and reformat a detection rule, the half-life of that intel is spent on mechanics. MCP collapses that loop: the agent your team already talks to can reach authenticated, structured, current intelligence and act on it in the same breath.
v7.1.3 makes that loop both more open and more efficient. The client is now something you can read and trust line-by-line, the server is discoverable through the ecosystem's own registry, and the tools are lean enough to stay out of your agent's way while it does real work — triage a threat, pull the matching SPL/KQL/Sigma, enrich an indicator, and hand back a STIX bundle for the TIP.
The Threadlinqs Intelligence MCP server is available to Purple and Gold subscribers. Read the source at github.com/threadlinqs-cmd/intelthreadlinqs-mcp, start at the MCP documentation page, or read more about the platform at intel.threadlinqs.com. Questions or enterprise inquiries: contact@threadlinqs.com.