Google Threat Intelligence MCP – Threat Intel Tools
The Google Threat Intelligence MCP Server is part of Google's MCP Security project and provides tools for querying Google Threat Intelligence and VirusTotal data. It helps AI agents investigate files, URLs, domains, IP addresses, threat actors, malware families, campaigns, vulnerability collections, and related indicators.
Overview
The Google Threat Intelligence MCP Server, also documented as the GTI MCP Server,
is a server in Google's MCP Security project for interacting with the Google
Threat Intelligence and VirusTotal API. It gives MCP-compatible AI agents a
structured way to retrieve threat reports, indicator context, file analysis,
URL reports, domain intelligence, IP intelligence, and related entities during
security investigations.
What the MCP server enables
The server exposes investigation tools for several major GTI data areas. For
threat collections, agents can retrieve collection reports, search threats,
search campaigns, search threat actors, search malware families, search software
toolkits, search reports, search vulnerabilities, and inspect related entities or
timeline events. For files, agents can retrieve file reports, related entities,
behavior reports, and behavior summaries. For network indicators, agents can
retrieve domain and IP address reports, follow relationships such as resolutions,
subdomains, communicating files, downloaded files, referrer files, and URLs. The
URL tools retrieve URL reports and related entities such as redirects,
downloaded files, communicating files, domains, and IP addresses.
When to use it
Use this MCP server when an AI agent needs trusted threat-intelligence context
during malware triage, phishing investigation, incident response, vulnerability
research, or threat actor tracking. Practical workflows include checking whether
a suspicious SHA-256 hash has malicious detections, researching domains observed
in telemetry, pivoting from an IP address to related URLs or files, searching for
reports about a campaign, or gathering timeline information for a named threat
actor.
Connection and authentication
The GTI MCP Server is configured as a local stdio server launched with uv from
the Google MCP Security repository path. The documented configuration uses
uv --directory /path/to/the/repo/server/gti/gti_mcp run server.py. A
VirusTotal API key is required and must be supplied through the VT_APIKEY
environment variable. Google also recommends using uv --env-file to keep
secrets in a .env file rather than embedding credentials in client settings.
Key considerations
Access depends on a valid VirusTotal API key and the permissions, quotas, and
data availability associated with that key. API keys should be stored securely,
scoped and rotated according to organizational policy, and never committed to
source control. Because this server returns live security intelligence, agents
should treat results as investigative context and preserve analyst review for
high-impact response decisions such as blocking infrastructure, escalating
incidents, or attributing activity to named actors.
Supported Transports
stdio
Command: uv
Args:
--directory${GTI_MCP_REPO_PATH}/server/gti/gti_mcprunserver.py
Frequently Asked Questions
- When should an AI agent use this MCP server?
- Use it when an agent needs live Google Threat Intelligence or VirusTotal context for malware triage, phishing investigations, incident response, IOC enrichment, threat actor research, campaign tracking, or vulnerability intelligence lookups.
- What does this MCP server add to an AI agent's capabilities?
- It adds tool-based access to GTI and VirusTotal data, including file, URL, domain, IP address, threat collection, campaign, threat actor, malware family, report, vulnerability, and relationship queries that are not available from static model knowledge.
- What can the AI agent access or manage through this server?
- The agent can retrieve reports and related entities for files, URLs, domains, IP addresses, and GTI collections, search IOCs and threat collections, and inspect file behavior or timeline data. The documented tools are investigation and lookup oriented rather than administrative management actions.
- How is authentication configured for this MCP server?
- Authentication uses a VirusTotal API key supplied as the `VT_APIKEY` environment variable. The documentation recommends keeping secrets in an environment file or system environment variables instead of embedding real API keys directly in MCP client configuration.
- Which transport should be used for this MCP server?
- Use the documented local `stdio` transport launched with `uv` from the Google MCP Security repository's `server/gti/gti_mcp` directory. No hosted streamable HTTP or SSE endpoint is documented for this GTI MCP server.