PYCTI-MCP

Summary from the TLDR InfoSec newsletter

This is an MCP (Model Context Protocol) server for pycti that provides a front-end interface to OpenCTI threat intelligence data. The server condenses and normalizes OpenCTI data into JSON format for LLMs, making field names more verbose and resolving GraphQL-linked entities to provide better response context. It includes three main tools for looking up observables, adversaries, and reports in OpenCTI, and can run either as a TCP server or STDIO server.