Rösti Threat Intel

Install

Pick the AI app you use, then copy the settings.

Passed 2/3 checks · What you ask goes through the maker’s server (mcp.rosti.dev) · ✓ Commands checked Nov 13, 2026

claude mcp add --transport http --scope user rosti https://mcp.rosti.dev/mcp

{
  "mcpServers": {
    "rosti": {
      "url": "https://mcp.rosti.dev/mcp"
    }
  }
}

{
  "servers": {
    "rosti": {
      "type": "http",
      "url": "https://mcp.rosti.dev/mcp"
    }
  }
}

Which apps can use it

Based on how this server connects and on each app’s own docs, checked Nov 10, 2026.

Connect over the internet in

ClaudeChatGPTGooseLM StudioMsty StudioCherry StudioCursorVS Code + GitHub CopilotVisual StudioWindsurf (Devin Desktop)ZedKiroClineContinueJetBrains AI AssistantClaude CodeCodex CLIGemini CLIOpenCodenodecodeWarpLibreChatOpen WebUIRaycast

All apps, with pros and cons →

What it can do

Tool names and descriptions exactly as the server reported them on Nov 11, 2026. The maker wrote them, not us; we show them as plain text.

• lookup_iocs

  Check many IOCs (indicators of compromise) at once against Rösti's threat-intelligence reports. Defanged values (hxxps://evil[.]com, 1.2.3[.]4, user[at]evil[.]com) are refanged before the lookup; `refanged` shows which. Matching is exact, with a case-insensitive fallback. For eac

• lookup_ioc

  Check whether one IOC (indicator of compromise) appears in Rösti's threat-intelligence reports. A defanged value (hxxps://evil[.]com, 1.2.3[.]4) is refanged before the lookup; `input` then shows the value as given. Matching is exact, with a case-insensitive fallback. Returns ever

• search_iocs

  Search IOCs across all Rösti reports by text, type, tag, category and creation time. Without filters, lists IOCs from all reports. Each IOC carries its report id (use get_report for the report), type, category, tags, IDS flag, comment and false-positive risk. Use lookup_ioc or lo

• search_reports

  Search Rösti's threat-intelligence reports by text, source, CVE, MITRE ATT&CK id and publication date. Returns report summaries: title, date, source, authors, tags, counts of IOCs, YARA rules and MITRE ids, and links to the original report and rosti.dev. Use get_report for the de

• get_report

  Get one Rösti report: metadata, MITRE ATT&CK ids, CVEs, available export formats, and how many of its IOCs there are per type and per tag. Use list_report_iocs for the IOCs themselves and get_yara_rules for its YARA rules.

• list_report_iocs

  List the IOCs of one Rösti report, optionally filtered by type, tag, category or text. IOCs with the same entity_ref belong together, e.g. the MD5, SHA-1 and SHA-256 of one file. Each IOC carries its IDS flag and false-positive risk.

• get_yara_rules

  Get the YARA rules published with one Rösti report, with their full source.

• find_related_reports

  Find other Rösti reports that share IOCs with one report, most shared IOCs first, with the shared values.

• get_export_link

  Get a download link for one report export, e.g. CSV or MISP. The link is signed and expires after 15 minutes; it is meant to be opened by the user, not downloaded here.

• list_sources

  List the publishers whose reports Rösti collects (vendor blogs, CERTs, researchers), with report counts, the newest report date and whether the source is still active. Source ids work as the sources filter of search_reports.

• describe_taxonomy

  List the values Rösti uses for IOC types, IOC tags (with descriptions), IOC categories and export formats, and explain the false-positive risk scale. Use these values for the filters of the search and list tools.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 13, 2026

• ! Caution

  Maker matches the repo

  The registry lists no source repo, so we cannot match the publisher (rosti.dev) to the code

• … Not checked yet

  Still maintained

  We have not read this repo from GitHub yet

• … Not checked yet

  Has a licence

  We have not read this repo from GitHub yet

• ✓ Pass

  Endpoint responds

  Responded in 162 ms (HTTP 200)

• – Not applicable

  Sign-in with OAuth

  No sign-in needed

• ✓ Pass

  No hidden instructions in tool descriptions

  Read 11 tool descriptions and found no hidden instructions to the AI

User reviews

No reviews yet

Sign in with Google to write a review

Compared with others in Cybersecurityi

• More stars than 0% of the other 1051 servers in this category
• Published to the registry more recently than 81% of the other 1051 servers in this category
• Basic checks equal to or better than 46% of the other 1051 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Others in the same category

Servers in the same category from other makers, sorted by stars.

Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Robin: AI-Powered Dark Web OSINT

Dark web OSINT over Tor: search onion engines, scrape pages, report with your own model.

by apurvsinghgautam·Growing·★ 8K·Updated 41 days ago

Runs on your computer

Install

HOL Guard

Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.

by hashgraph-online·Widely used·↓ 7.1K/wk·★ 1.1K·Updated 8 days ago

Runs on your computer

Install

SonarQube MCP Server

Analyze code quality and security with SonarQube Server or Cloud directly in AI assistants.

by SonarSource·Growing·★ 686·Updated 2 days ago

Runs on your computer

Install

README from the maker

No README found in the repo