Model Context Protocol Integration

What is the Model Context Protocol?

The Model Context Protocol (MCP) is an open standard created by Anthropic that defines how AI applications connect to external data sources and tools. Instead of copying data into prompts or writing one-off integrations, MCP provides a single protocol that any AI client can use to discover, read, and invoke tools from any compatible server.

The Threadlinqs MCP Server exposes the entire intelligence platform—threats, detections, IOCs, MITRE mappings, C2 intelligence, attack simulations, and advanced correlations—as 29 callable tools and 8 browsable resources. Your AI agent gets structured access to the same data analysts use on the web platform, with no API wrangling required.

Transport is stdio (local). The server runs on your machine via npx, communicates over standard input/output, and sends authenticated requests to the Threadlinqs API on your behalf. No open ports, no webhook configuration, no cloud relay.

Install in 30 Seconds

No global install needed. The package runs via npx on demand. Add it to your AI client configuration and it starts automatically when your agent needs threat intelligence.

{
  "mcpServers": {
    "threadlinqs-intel": {
      "command": "npx",
      "args": ["-y", "intelthreadlinqs-mcp"],
      "env": {
        "THREADLINQS_API_KEY": "tl_your_key_here"
      }
    }
  }
}

# Add the MCP server to Claude Code
claude mcp add threadlinqs-intel \
  -e THREADLINQS_API_KEY=tl_your_key_here \
  -- npx -y intelthreadlinqs-mcp

{
  "mcpServers": {
    "threadlinqs-intel": {
      "command": "npx",
      "args": ["-y", "intelthreadlinqs-mcp"],
      "env": {
        "THREADLINQS_API_KEY": "tl_your_key_here"
      }
    }
  }
}

The API key is required — every MCP tool call is authenticated and gated to the Purple and Gold tiers. Generate a tl_ key in your profile settings; the env block above is not optional.

81 MCP Tools

Every tool returns structured JSON. Your AI agent can chain tool calls—search for a threat, pull its detections, look up the associated MITRE techniques, and export a Sigma rule—all in a single conversation turn.

The groups below are a representative selection, not the full inventory. The complete, always-current catalog with input schemas is published at /mcp/catalog.json.

8 MCP Resources

Resources are read-only data feeds your AI agent can browse directly. Unlike tools, resources do not require input parameters—the agent requests a URI and receives the full dataset as structured JSON.

Works with Every MCP Client

The server uses the stdio transport—the most widely supported MCP transport layer. Any client that implements the Model Context Protocol specification can connect. These are the clients we test against:

API Tier Access

Every MCP tool requires authentication. The server is gated to the Purple ($11.99/mo) and Gold tiers — there is no free or Blue-tier MCP access, and no tool answers without a tl_ API key from a Purple or Gold account. The public documentation and the tool catalog at /mcp/catalog.json are the only unauthenticated surfaces.

What Your Agent Can Do

Once the MCP server is connected, your AI agent can answer threat intelligence questions directly:

# Threat research
"Search for threats related to Cobalt Strike"
"Get full details on TL-2026-0288"
"What are the most recent critical threats?"

# Detection engineering
"Show me all SPL detections for ransomware threats"
"Export the Sigma rule for detection DET-0042"

# MITRE mapping
"What techniques does T1059.001 cover?"
"Show MITRE coverage for the Initial Access tactic"

# C2 intelligence
"List active C2 beacons with Cobalt Strike framework"
"Show operator clusters and shared infrastructure"

# Vulnerability lookup
"Look up CVE-2024-3400 and show linked threats"
"What is CWE-79 and how do I mitigate it?"

Architecture

Package: intelthreadlinqs-mcp on npm   Version: 3.0.0   SDK: @modelcontextprotocol/sdk v1.26.0

Transport: stdio (local process, no open ports)   Runtime: Node.js 18+

Data source: Cloudflare D1 via the Threadlinqs REST API (75+ endpoints)

Authentication: Bearer token via THREADLINQS_API_KEY environment variable

Timeout: 30s per API request with automatic abort controller

The server is stateless. Each tool call translates to one or more authenticated GET requests against the platform API. Responses are returned as structured JSON content blocks, ready for the AI model to parse and reason over.