stanfrbd/mcp-cyberbro

An MCP server that exposes Cyberbro's IoC extraction and threat intelligence capabilities as LLM-accessible tools, enabling Claude and other AI systems to parse unstructured text for indicators (IPs, domains, hashes, URLs, extensions) and query their reputation across multiple threat intel sources like VirusTotal, WHOIS, and integrated CTI platforms. Operates via stdin/stdout MCP protocol transport, compatible with Claude Desktop via Docker or local Python installation, and can be exposed as OpenAPI endpoints through the MCPO proxy for broader LLM client support. Provides structured threat intelligence analysis without requiring manual API calls or UI interaction.