Rösti Threat Intel MCP Tools

Rösti Threat Intel exposes 11 tools. Each one has its own page with the configuration for every client that can run this server.

lookup_iocs Read-only

lookup iocs
lookup_ioc Read-only

lookup ioc
search_iocs Read-only

search iocs
search_reports Read-only

search reports
get_report Read-only

get report
list_report_iocs Read-only

list report iocs
get_yara_rules Read-only

get yara rules
find_related_reports Read-only

find related reports
get_export_link Read-only

get export link
list_sources Read-only

list sources
describe_taxonomy Read-only

describe taxonomy

This list was read from the server itself, by connecting to it and calling tools/list on 11 November 2026. It is what the server actually exposes, not what its listing claims.

Mutating and Read-only are read off each tool's name, not its schema — a hint, not a guarantee. The registry stores tool names only; connect the server for its live schemas.

Rösti Threat Intel MCP server