threatcrush MCP Tools

• av_hash_lookup

  av hash lookup

• reputation_lookup

  reputation lookup

• reputation_bulk

  reputation bulk

• redeem_credit_code

  redeem credit code

• list_invites Read-only

  list invites

• create_invite Mutating

  create invite

• findings_list

  findings list

• findings_get

  findings get

• findings_triage

  findings triage

• incidents_list

  incidents list

• incidents_get

  incidents get

• incidents_update

  incidents update

• incidents_raise

  incidents raise

• webhooks_list

  webhooks list

• webhooks_create

  webhooks create

• webhooks_update

  webhooks update

• webhooks_delete

  webhooks delete

• webhooks_test

  webhooks test

• webhooks_rotate_secret

  webhooks rotate secret

• webhooks_deliveries

  webhooks deliveries

This list was read from the server itself, by connecting to it and calling tools/list on 11 November 2026. It is what the server actually exposes, not what its listing claims.

Mutating and Read-only are read off each tool's name, not its schema — a hint, not a guarantee. The registry stores tool names only; connect the server for its live schemas.