Rösti Threat Intel

Connect Remote server

claude mcp add --transport http rosti https://mcp.rosti.dev/mcp --header "X-API-Key: <X_API_KEY>"

{
  "mcpServers": {
    "rosti": {
      "url": "https://mcp.rosti.dev/mcp",
      "headers": {
        "X-API-Key": "<X_API_KEY>"
      }
    }
  }
}

{
  "servers": {
    "rosti": {
      "type": "http",
      "url": "https://mcp.rosti.dev/mcp",
      "headers": {
        "X-API-Key": "<X_API_KEY>"
      }
    }
  }
}

Settings > Connectors > Add custom connector
URL: https://mcp.rosti.dev/mcp

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools 11 found in our last check

• lookup_iocs

  Check many IOCs (indicators of compromise) at once against Rösti's threat-intelligence reports. Defanged values (hxxps://evil[.]com, 1.2.3[.]4, user[at]evil[.]com) are refanged before the lookup; `refanged` shows which. Matching is exact, with a case-insensitive fallback. For ea…

• lookup_ioc

  Check whether one IOC (indicator of compromise) appears in Rösti's threat-intelligence reports. A defanged value (hxxps://evil[.]com, 1.2.3[.]4) is refanged before the lookup; `input` then shows the value as given. Matching is exact, with a case-insensitive fallback. Returns eve…

• search_iocs

  Search IOCs across all Rösti reports by text, type, tag, category and creation time. Without filters, lists IOCs from all reports. Each IOC carries its report id (use get_report for the report), type, category, tags, IDS flag, comment and false-positive risk. Use lookup_ioc or l…

• search_reports

  Search Rösti's threat-intelligence reports by text, source, CVE, MITRE ATT&CK id and publication date. Returns report summaries: title, date, source, authors, tags, counts of IOCs, YARA rules and MITRE ids, and links to the original report and rosti.dev. Use get_report for the d…

• get_report

  Get one Rösti report: metadata, MITRE ATT&CK ids, CVEs, available export formats, and how many of its IOCs there are per type and per tag. Use list_report_iocs for the IOCs themselves and get_yara_rules for its YARA rules.

• list_report_iocs

  List the IOCs of one Rösti report, optionally filtered by type, tag, category or text. IOCs with the same entity_ref belong together, e.g. the MD5, SHA-1 and SHA-256 of one file. Each IOC carries its IDS flag and false-positive risk.

• get_yara_rules

  Get the YARA rules published with one Rösti report, with their full source.

• find_related_reports

  Find other Rösti reports that share IOCs with one report, most shared IOCs first, with the shared values.

• get_export_link

  Get a download link for one report export, e.g. CSV or MISP. The link is signed and expires after 15 minutes; it is meant to be opened by the user, not downloaded here.

• list_sources

  List the publishers whose reports Rösti collects (vendor blogs, CERTs, researchers), with report counts, the newest report date and whether the source is still active. Source ids work as the sources filter of search_reports.

• describe_taxonomy

  List the values Rösti uses for IOC types, IOC tags (with descriptions), IOC categories and export formats, and explain the false-positive risk scale. Use these values for the filters of the search and list tools.

Headers

Details

More security servers See all

• BlackVeil DNS & Email Security Scanner

  DNS and email security scanner with 82 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.

• Forwardsmith buyer desk (read-only)

  Read-only desk for buyers and assistants: offer, prices, fit check, readiness scan, intake draft.

• MakeItSay

  Change the words in a screenshot or photo and keep the original font and layout.

• Kestrova Solidity Security Scan

  Free Slither scan of Solidity contracts for AI coding agents; optional paid report (1 USDC, x402).

• Paragon Boxing & BJJ Gear Advisor

  Read-only boxing and BJJ gear guidance, sizing, product comparison, rules and identity checks.

• Spurvik EU AI Act

  Live URL scan, AI Act risk check, 24-EU-language Art. 50 badge, HMAC receipts & approval gates.