Threat intel enrichment
3 tools. Compare how each tool runs, what it needs, where it sends data, what it can change and what its code can touch. Feed: /tasks/threat-intel-enrichment/feed.xml
| Tool | Runs and needsWhere the tool runs and what must be in place before it works. | Sends data toOutside parties the tool contacts, read from the code and the documentation. Other connections are not ruled out. | Can change thingsWhether the tool's functions only read, or also create, change or delete things, run commands, or send data out. | How to run itThe run advice where we have read the tool under the verdict rule, else what the code shows; below it, whether it has run in our lab. |
|---|---|---|---|---|
| CrowdStrike Falcon MCP ServerDraft · awaiting review MCP server that connects agents to the CrowdStrike Falcon platform: detections, threat intel, host management and response. MCP server · CrowdStrike, pushed 2026-10-08 | Started by your client Works with: Any MCP client, Gemini CLI Needs: Access to a CrowdStrike console in which to create API credentials; A Falcon API client with its Client ID and Client Secret; the quickstart enables at minimum Hosts:read and Alerts:read; +4 more | CrowdStrike Falcon API, HTTP/HTTPS proxy, PyPI, quay.io | changes, deletes, runs commands | Code shows: can tunnel or exfiltrate · writes outside the project · changes config or installs globally · +1 more Ran once, 2026-11-07: did more than it said |
| Threat Intel ToolkitDraft · awaiting review Claude Code plugin with a subagent and two skills that triage IOCs and CVEs against free threat-intel feeds, without API keys. Plugin · kevinmhorvath, pushed 2026-08-18 | Started by your client Works with: Claude Code Needs: Needs Python 3.8 or later; the scripts use the standard library and need no pip installs; Installs as a plugin from the repository's own single-plugin marketplace (.claude-plugin/marketplace.json and .claude-plugin/plugin.json); +3 more | CISA KEV and abuse.ch Feodo Tracker, blocklist.de and stamparm/ipsum, Emerging Threats and GreenSnow, Tor Project and SANS DShield, Spamhaus and Phishing.Database, FIRST EPSS (api.first.org), cisa.gov, GitHub and GitLab, nomi-sec and trickest PoC indexes, Client web search | changes, runs commands | Code shows: writes outside the project · runs shell commands or eval · Secrets: unknown Not run yet |
| Purple AI MCP ServerDraft · awaiting review Read-only MCP server for the SentinelOne Singularity platform: Purple AI, data-lake PowerQuery, alerts, vulnerabilities, misconfigurations and inventory. MCP server · Sentinel-One, pushed 2026-09-22 | Started by your client Works with: Any MCP client, Claude Code, Codex Needs: Needs a SentinelOne account to obtain the console token; Needs a console or Service User token with Account or Site scope, not Global, set as PURPLEMCP_CONSOLE_TOKEN; +4 more | SentinelOne console, SentinelOne Purple AI, Singularity Data Lake API, cve.circl.lu, VirusTotal, Pydantic Logfire, GitHub Sentinel-One/purple-mcp | reads, in the groups read | Code shows: can tunnel or exfiltrate · adds autostart, users or keys · reads broad tokens or the environment · +1 more Not run yet |