EdgeProtect MCP Server
The EdgeProtect MCP server gives any MCP-compatible client (Claude Desktop, Claude Code, Cursor, Zed, or your own agent) direct, typed access to the same threat-intelligence dataset that powers the REST API.
It is a hosted, remote MCP server. There is nothing to install. Point your client at the endpoint, add your API key, and start calling tools.
What you can do with it
The server exposes 71 tools spanning the full EdgeProtect dataset:
- CVE detail, EPSS scoring, CISA KEV status, and notable events
- CPE vendor, product, and version lookups with full-text product search
- CWE catalogue
- MITRE ATT&CK tactics and techniques
- Atomic Red Team test library
- Threat actor profiles, including industry-targeting lookups
- IOC intelligence (1M+ records) with substring and exact-match lookup
- Malware sample metadata
- SSL and JA3 blacklists
- Shadowserver honeypot telemetry (per-CVE, per-vendor, and daily aggregates)
- AI-generated remediation summaries
- Account, credit balance, and data-freshness introspection
A complete list grouped by domain lives on the Tools page.
How it works
The server speaks JSON-RPC 2.0 over HTTP POST, implementing the MCP Streamable HTTP transport at protocol version 2025-06-18. Every call:
- Validates your bearer token.
- Charges 1 credit on
tools/call(account_statusis free). - Runs the query against the dataset.
- Returns a standard MCP
CallToolResultwhose single text block is a JSON-serialised payload, with a_meta.edgeprotectblock carrying the request ID, credit balance, and tool metadata.
If the underlying query fails or times out, the credit is refunded automatically.
The server advertises only the tools capability. It does not expose resources, prompts, sampling, or server-initiated notifications. Clients that auto-discover capabilities will see tools.listChanged: false.