orkl_mcp_server

ORKL MCP Server exposes a set of standardized MCP Tools that fetch, search, and retrieve threat intelligence data from the ORKL Threat Intelligence Library. You can use tools to fetch the latest threat reports, obtain detailed information about specific reports or actors, search for reports by criteria, and retrieve library or source metadata. The server also supports direct MCP Resources for quick access to specific threat reports, threat actors, and sources. If you’re integrating with Claude Desktop, you can register the server so Claude can invoke these tools directly through natural language prompts, using the configured environment and API base URL. Typical workflows include querying for recent threat activity, drilling into a specific report by hash, or listing available sources and actors for attribution and reconnaissance.

Prerequisites:

• Python 3.10 or later
• uv package manager (recommended)

Installation steps:

1. Clone the repository: git clone https://github.com/heiths/orkl_mcp_server.git cd orkl_mcp_server

2. Install uv and Python dependencies (recommended): uv venv uv pip install -r requirements.txt

3. Run the MCP server (via uv integration, see Configuration): uv --directory /path/to/orkl_mcp_server run python run_server.py

4. (Optional) Configure Claude Desktop integration by adding the following to claude_desktop_config.json and adjusting the path: { "ORKL Threat Intelligence": { "command": "uv", "args": [ "--directory", "/path/to/orkl_mcp_server", "run", "python", "run_server.py" ], "env": { "ORKL_API_BASE_URL": "https://orkl.eu/api/v1", "ORKL_REQUEST_TIMEOUT": "30", "ORKL_CACHE_TTL": "300", "ORKL_USE_CACHE": "1", "ORKL_RATE_LIMIT_REQUESTS": "90", "ORKL_RATE_LIMIT_PERIOD": "30" } } }

Tips and notes:

• The server caches ORKL API responses to reduce external calls; adjust ORKL_CACHE_TTL to balance freshness and performance.
• Ensure ORKL_API_BASE_URL is reachable from your environment and that API rate limits are respected (configurable via ORKL_RATE_LIMIT_* variables).
• If running behind a proxy or in restricted environments, set appropriate network settings or environment variables.
• The MCP Tools list (fetch_latest_threat_reports, fetch_threat_report_details, etc.) can be invoked programmatically or via Claude Desktop prompts once the server is registered.
• For direct access, MCP Resources provide URL-like schemes like threat_reports://{report_id} for quick retrieval.
• If you upgrade dependencies or Python versions, re-install requirements and re-run the server to ensure compatibility.