# Threadlinqs Intelligence

> Live cyber-threat-intelligence platform: 2326+ profiled threats, 21373+ detections (Splunk SPL, Microsoft KQL, Sigma), 59473+ IOCs, 1963+ enriched CVEs, MITRE ATT&CK coverage and daily debriefs. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server.

## Threat intelligence (public, crawlable)
- Threat pages: https://intel.threadlinqs.com/threat/TL-YYYY-NNNN (append `.md` for clean Markdown)
- CVE pages: https://intel.threadlinqs.com/cve/CVE-YYYY-NNNN (append `.md` for Markdown)
- Threat-actor pages: https://intel.threadlinqs.com/actor/<name> (append `.md` for Markdown)
- Daily debrief: https://intel.threadlinqs.com/debrief
- Live CVE feed: https://intel.threadlinqs.com/vulnerabilities
- Platform statistics: https://intel.threadlinqs.com/statistics
- ATT&CK coverage: https://intel.threadlinqs.com/coverage
- Sitemap index: https://intel.threadlinqs.com/sitemap-index.xml
- RSS (latest threats): https://intel.threadlinqs.com/feed.xml

## Free machine-readable feeds
- STIX 2.1 + TAXII 2.1 + native MISP feeds: see https://intel.threadlinqs.com/mcp for endpoints
- Free C2 blocklist: generated from live C2 tracking (see MCP docs)

## MCP — AI-agent access (v8.2.0, Purple tier)
- Official MCP registry: com.threadlinqs/intelthreadlinqs-mcp
- Source (MIT): https://github.com/threadlinqs-cmd/intelthreadlinqs-mcp
- npm: intelthreadlinqs-mcp — `npx -y intelthreadlinqs-mcp` (stdio, THREADLINQS_API_KEY)
- Remote: POST https://intel.threadlinqs.com/mcp (Streamable-HTTP, OAuth 2.1)
- Manifest: https://intel.threadlinqs.com/.well-known/mcp.json
- Docs: https://intel.threadlinqs.com/mcp (Markdown twin: /mcp.md)
- Agent skill: https://intel.threadlinqs.com/mcp/skill.md (single file) · https://intel.threadlinqs.com/skills/intelthreadlinqs-mcp-skill.zip
- Machine catalog (no key required): https://intel.threadlinqs.com/mcp/catalog.json
81 tools and 25 analyst-playbook prompts: search_threats, get_threat, hunt (TLQL over a 106k-row observation index), search_detections, search_iocs, get_cve_intelligence, get_actor, get_attribution_evidence, explain_correlation, get_mitre_coverage, get_c2, get_correlations, get_osint_trends, list_debriefs, export_stix and more. Purple or Gold subscription required (tier >= 3).

## Blog
In-depth threat reports with SPL/KQL/Sigma detections: https://threadlinqs.com/blog/

## Optional
- Pricing (Blue free, Red, Purple $11.99/mo, Gold enterprise): https://threadlinqs.com/pricing
- Contact: contact@threadlinqs.com