ThreatConnect

ThreatConnect MCP server

ThreatConnect MCP server

ThreatConnect MCP server

for Claude, ChatGPT, Cursor and your own agents

for Claude, ChatGPT, Cursor and your own agents

for Claude, ChatGPT, Cursor and your own agents

Expose ThreatConnect to Claude, ChatGPT, Cursor or your own agents as a governed MCP server, even if the vendor doesnโ€™t ship one. Mindflow turns every API operation into an MCP tool and keeps the connector current when the API changes. The MCP Gateway sits between your AI clients and your data, with scoped access, human approval before sensitive writes and a record of every call.

Expose ThreatConnect to Claude, ChatGPT, Cursor or your own agents as a governed MCP server, even if the vendor doesnโ€™t ship one. Mindflow turns every API operation into an MCP tool and keeps the connector current when the API changes. The MCP Gateway sits between your AI clients and your data, with scoped access, human approval before sensitive writes and a record of every call.

216

operation

s

available

Complete and up-to-date endpoint coverage by Mindflow.

          216

          operation

          s

          available

          Complete and up-to-date endpoint coverage by Mindflow.

                  216

                  operation

                  s

                  available

                  Complete and up-to-date endpoint coverage by Mindflow.

                          Our customers scale automation with security built in.

                          Tools exposed by this MCP server

                          Every ThreatConnect operation, as an MCP tool

                          Every ThreatConnect operation, as an MCP tool

                          Each API operation becomes a tool your AI client can call. You decide which ones: allow reads, require approval before sensitive writes and block the rest. A few of the most used:

                          • ThreatConnect

                            ThreatConnect

                            Create artifact

                            Create artifact

                          • ThreatConnect

                            ThreatConnect

                            Create case

                            Create case

                          • ThreatConnect

                            ThreatConnect

                            Create group

                            Create group

                          • ThreatConnect

                            ThreatConnect

                            Create indicator

                            Create indicator

                          • ThreatConnect

                            ThreatConnect

                            Create note

                            Create note

                          • ThreatConnect

                            ThreatConnect

                            Create tag

                            Create tag

                          • ThreatConnect

                            ThreatConnect

                            Retrieve artifact by id

                            Retrieve artifact by id

                          • ThreatConnect

                            ThreatConnect

                            Retrieve case by id

                            Retrieve case by id

                          • ThreatConnect

                            ThreatConnect

                            Retrieve cases

                            Retrieve cases

                          • ThreatConnect

                            ThreatConnect

                            Retrieve group by id

                            Retrieve group by id

                          • ThreatConnect

                            ThreatConnect

                            Retrieve groups

                            Retrieve groups

                          • ThreatConnect

                            ThreatConnect

                            Retrieve indicator by id

                            Retrieve indicator by id

                          • ThreatConnect

                            ThreatConnect

                            Retrieve indicators

                            Retrieve indicators

                          • ThreatConnect

                            ThreatConnect

                            Retrieve notes

                            Retrieve notes

                          • ThreatConnect

                            ThreatConnect

                            Retrieve tags

                            Retrieve tags

                          • ThreatConnect

                            ThreatConnect

                            Retrieve users

                            Retrieve users

                          • ThreatConnect

                            Create artifact

                          • ThreatConnect

                            Create case

                          • ThreatConnect

                            Create group

                          • ThreatConnect

                            Create indicator

                          • ThreatConnect

                            Create note

                          • ThreatConnect

                            Create tag

                          • ThreatConnect

                            Retrieve artifact by id

                          • ThreatConnect

                            Retrieve case by id

                          • ThreatConnect

                            Retrieve cases

                          • ThreatConnect

                            Retrieve group by id

                          • ThreatConnect

                            Retrieve groups

                          • ThreatConnect

                            Retrieve indicator by id

                          • ThreatConnect

                            Retrieve indicators

                          • ThreatConnect

                            Retrieve notes

                          • ThreatConnect

                            Retrieve tags

                          • ThreatConnect

                            Retrieve users

                          • ThreatConnect

                            ThreatConnect

                            Retrieve users

                            Retrieve users

                          • ThreatConnect

                            ThreatConnect

                            Retrieve tags

                            Retrieve tags

                          • ThreatConnect

                            ThreatConnect

                            Retrieve notes

                            Retrieve notes

                          • ThreatConnect

                            ThreatConnect

                            Retrieve indicators

                            Retrieve indicators

                          • ThreatConnect

                            ThreatConnect

                            Retrieve indicator by id

                            Retrieve indicator by id

                          • ThreatConnect

                            ThreatConnect

                            Retrieve groups

                            Retrieve groups

                          • ThreatConnect

                            ThreatConnect

                            Retrieve group by id

                            Retrieve group by id

                          • ThreatConnect

                            ThreatConnect

                            Retrieve cases

                            Retrieve cases

                          • ThreatConnect

                            ThreatConnect

                            Retrieve case by id

                            Retrieve case by id

                          • ThreatConnect

                            ThreatConnect

                            Retrieve artifact by id

                            Retrieve artifact by id

                          • ThreatConnect

                            ThreatConnect

                            Create tag

                            Create tag

                          • ThreatConnect

                            ThreatConnect

                            Create note

                            Create note

                          • ThreatConnect

                            ThreatConnect

                            Create indicator

                            Create indicator

                          • ThreatConnect

                            ThreatConnect

                            Create group

                            Create group

                          • ThreatConnect

                            ThreatConnect

                            Create case

                            Create case

                          • ThreatConnect

                            ThreatConnect

                            Create artifact

                            Create artifact

                          • ThreatConnect

                            Retrieve users

                          • ThreatConnect

                            Retrieve tags

                          • ThreatConnect

                            Retrieve notes

                          • ThreatConnect

                            Retrieve indicators

                          • ThreatConnect

                            Retrieve indicator by id

                          • ThreatConnect

                            Retrieve groups

                          • ThreatConnect

                            Retrieve group by id

                          • ThreatConnect

                            Retrieve cases

                          • ThreatConnect

                            Retrieve case by id

                          • ThreatConnect

                            Retrieve artifact by id

                          • ThreatConnect

                            Create tag

                          • ThreatConnect

                            Create note

                          • ThreatConnect

                            Create indicator

                          • ThreatConnect

                            Create group

                          • ThreatConnect

                            Create case

                          • ThreatConnect

                            Create artifact

                          Connect ThreatConnect to your AI client in three steps.

                          01

                          Connect the service

                          Add ThreatConnect in Mindflow with its credentials. They stay in Mindflow and never reach the AI client.

                          02

                          Choose the tools

                          Pick the operations each AI client may call. Allow reads, require approval before sensitive writes and block the rest.

                          03

                          Connect your AI client

                          Point Claude, ChatGPT, Cursor or your own agent to your MCP Gateway endpoint, then check real calls in the audit log.

                          Use cases

                          Use cases

                          What your AI agents can do with ThreatConnect

                          What your AI agents can do with ThreatConnect

                          AI clients

                          Mindflow

                          ThreatConnect

                          โ†’ Automate incident case creation and updates in ThreatConnect to reduce manual entry. The automation triggers case creation or modification directly via API calls to create or update case attributes, accelerating response times. โ†’ Streamline victim attribute and asset management by automatically retrieving and updating victim information. This use case automates victim asset data handling through targeted API operations to maintain accurate and up-to-date profiles. โ†’ Enhance threat indicator management by automatically creating, retrieving, and enriching indicators. This automation uses API methods to handle indicators dynamically, enabling rapid threat assessment and response.

                          โ†’ Automate incident case creation and updates in ThreatConnect to reduce manual entry. The automation triggers case creation or modification directly via API calls to create or update case attributes, accelerating response times. โ†’ Streamline victim attribute and asset management by automatically retrieving and updating victim information. This use case automates victim asset data handling through targeted API operations to maintain accurate and up-to-date profiles. โ†’ Enhance threat indicator management by automatically creating, retrieving, and enriching indicators. This automation uses API methods to handle indicators dynamically, enabling rapid threat assessment and response.

                          Every call goes through one governed endpoint.

                          Every call goes through one governed endpoint.

                          Your AI clients get access. You keep control.

                          Your AI clients get access. You keep control.

                          Every call to ThreatConnect goes through the Mindflow MCP Gateway. The same policies apply to every AI client: role-based access by team and environment, scoped credentials that never reach the client, human approval before sensitive writes, and a log of every call you can export to your SIEM.

                          Every call to ThreatConnect goes through the Mindflow MCP Gateway. The same policies apply to every AI client: role-based access by team and environment, scoped credentials that never reach the client, human approval before sensitive writes, and a log of every call you can export to your SIEM.

                          ThreatConnect MCP server

                          Live

                          RBAC ยท SecOps

                          Scoped credentials

                          Audit log

                          Create artifact

                          Allowed

                          Create case

                          Allowed

                          Create group

                          Needs approval

                          Create indicator

                          Blocked

                          Every call logged ยท Export to SIEM

                          Put this MCP server to work.

                          Bring one AI client and the tools it needs. Weโ€™ll show you the setup in Mindflow, from scoped access to the audit log.

                          Put this MCP server to work.

                          Bring one AI client and the tools it needs. Weโ€™ll show you the setup in Mindflow, from scoped access to the audit log.

                          Less busywork. More possibility.

                          Let your agents handle the routine. Make room for what comes next.

                          Automation intelligence, delivered monthly.

                          Product releases, automation playbooks, and security research โ€” straight to your inbox. No spam, unsubscribe anytime.

                          ยฉ 2026 Mindflow โ€” All rights reserved.

                          SOC 2 Type II
                          ISO 27001
                          GDPR
                          France 2030
                          Bpifrance
                          รŽle-de-France

                          Less busywork. More possibility.

                          Let your agents handle the routine. Make room for what comes next.

                          Automation intelligence, delivered monthly.

                          Product releases, automation playbooks, and security research โ€” straight to your inbox. No spam, unsubscribe anytime.

                          ยฉ 2026 Mindflow โ€” All rights reserved.

                          SOC 2 Type II
                          ISO 27001
                          GDPR
                          France 2030
                          Bpifrance
                          รŽle-de-France

                          Less busywork. More possibility.

                          Let your agents handle the routine. Make room for what comes next.

                          Automation intelligence, delivered monthly.

                          Product releases, automation playbooks, and security research โ€” straight to your inbox. No spam, unsubscribe anytime.

                          ยฉ 2026 Mindflow โ€” All rights reserved.

                          SOC 2 Type II
                          ISO 27001
                          GDPR
                          France 2030
                          Bpifrance
                          รŽle-de-France