alienvault-otx 3 tools

MCP server exposing 3 tools for alienvault-otx.

Endpoint

This URL is a JSON-RPC 2.0 endpoint over HTTP. Issue POST requests with a JSON-RPC body. Browsers and search crawlers land here on GET.

POST https://gateway.pipeworx.io/alienvault-otx/mcp
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"tools/list"}

search_pulses — Search OTX threat-intel pulses by KEYWORD — campaign, malware family or actor name, e.g. "ransomware" or "APT29". Returns pulse ID, name, description preview, tags, targeted countries, malware families, attack IDs, and indicator count. This matches pulse titles and descriptions, so a bare indicator value (an IP, domain, hash or CVE id) will find nothing here — use lookup_indicator for those.
get_pulse — Fetch a single OTX pulse: full description, references, indicators, attack IDs, targeted countries, malware families, industries, and creation/modification dates.
lookup_indicator — Look up a threat indicator in OTX: an IPv4 or IPv6 address, a domain or hostname, a URL, an MD5/SHA1/SHA256 file hash, or a CVE id such as CVE-2021-4034. Returns the threat-intel pulses referencing that indicator plus observed-context fields, so it answers questions like which campaigns exploit a given CVE or whether an IP is known-malicious. type is auto-detected when omitted.

Code samples (curl / TypeScript / one-click client install), schemas, and the live playground are on the pack page:
https://pipeworx.io/packs/alienvault-otx/

Pipeworx is an open MCP gateway connecting AI agents to live data. pipeworx.io