ppcvote/misp-mcp-server

A **Model Context Protocol** server for MISP (Malware Information Sharing Platform), with **built-in prompt injection defense** powered by prompt-defense-audit.
> **Why this exists:** MISP holds operational threat intel — IOCs, threat actor profiles, attack patterns. When you connect an LLM agent to MISP via MCP, two new attack surfaces emerge:
>
> 1. **Adversarial seeding.** A threat actor who can submit content into your MISP instance (or a federated feed) can plant prompt-injection payloads designed to hijack downstream LLM agents.
> 2. **Sensitive intel leakage.** A manipulated LLM can be coerced into returning intel above its authorized TLP level.
>
> This server wraps every outgoing MISP response in prompt-defense-audit's output scanner, blocking high-risk patterns before they reach the LLM. Read-only by design — no write tools exposed.
Tracks: MISP/MISP#10745 — MCP server for MISP
---
Features
- 🛡️ **Defense built in** — every MISP response scanned for prompt-injection / XSS / shell-injection patterns before being returned
- 🔒 **Read-only by design** — no event/attribute mutation tools; an LLM cannot modify your threat-intel platform
- 🧰 **8 high-utility tools** covering events, attributes, search, tags, feeds, galaxies
- ⚡ **Zero-config** beyond MISP_URL and MISP_API_KEY
- 🪶 **Stdio transport** — works with Claude Desktop, Cursor, Continue, Cline, any MCP client
- 📋 **MIT license** — fork freely, use commercially
---
Quick start
1. Install
Or use npx directly in your MCP client config (no install needed).
2. Configure your MCP client
**Claude Desktop** (~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%/Claude/claude_desktop_config.json on Windows):
**Cursor / Continue / Cline** — similar pattern, see your client's MCP config docs.
3. Restart your MCP client and start asking
---
Tools exposed
| Tool | Purpose |
|------|---------|
| misp_version | Health check + server version |
| misp_list_events | Paginated event headers |
| misp_get_event | Full event with attributes (scanned for injection) |
| misp_search_events | Search by tag / type / value / date range |
| misp_search_attributes | Direct IOC lookup |
| misp_list_tags | All configured tags (TLP, taxonomy, etc.) |
| misp_list_feeds | Configured threat-intel feeds |
| misp_list_galaxies | Threat actor / campaign clusters |
> **Mutation tools intentionally not included.** An LLM with write access to MISP is a supply-chain compromise vector. If you need agent-driven MISP mutations, build a per-tool allowlist with human-in-the-loop confirmation.
---
Defense layer
Every tool response is run through prompt-defense-audit's scanOutput before being returned to the LLM client.
**High-risk patterns** (critical / high severity) — response is **blocked** and replaced with a safe summary. Example trigger patterns:
- Script-tag injection ( ... )
- Iframe / object injection
- JavaScript URLs (javascript:)
- Shell-command patterns in unexpected contexts
- Known prompt-injection vector signatures from prompt-defense-audit's 17+ vector library
**Low/medium-risk patterns** — response annotated with a [defense] prefix listing matched patterns but still returned.