Categories › Security › Code & dependency scanning
Look up IOCs and search threat-intel reports, YARA rules, MITRE ATT&CK ids and CVEs from rosti.dev
Remote server: your requests and data go to mcp.rosti.dev. Claude Code: claude mcp add --transport http r-sti-threat-intel https://mcp.rosti.dev/mcp · Claude app: Settings → Connectors → Add custom connector.
The tools this server listed when we connected to it, in its own words.
lookup_iocs — Check many IOCs (indicators of compromise) at once against Rösti's threat-intelligence reports. Defanged values (hxxps://evil[.]com, 1.2.3[.lookup_ioc — Check whether one IOC (indicator of compromise) appears in Rösti's threat-intelligence reports. A defanged value (hxxps://evil[.]com, 1.2.3[search_iocs — Search IOCs across all Rösti reports by text, type, tag, category and creation time. Without filters, lists IOCs from all reports. Each IOC search_reports — Search Rösti's threat-intelligence reports by text, source, CVE, MITRE ATT&CK id and publication date. Returns report summaries: title, dateget_report — Get one Rösti report: metadata, MITRE ATT&CK ids, CVEs, available export formats, and how many of its IOCs there are per type and per tag. Ulist_report_iocs — List the IOCs of one Rösti report, optionally filtered by type, tag, category or text. IOCs with the same entity_ref belong together, e.g. tget_yara_rules — Get the YARA rules published with one Rösti report, with their full source.find_related_reports — Find other Rösti reports that share IOCs with one report, most shared IOCs first, with the shared values.get_export_link — Get a download link for one report export, e.g. CSV or MISP. The link is signed and expires after 15 minutes; it is meant to be opened by thlist_sources — List the publishers whose reports Rösti collects (vendor blogs, CERTs, researchers), with report counts, the newest report date and whether describe_taxonomy — List the values Rösti uses for IOC types, IOC tags (with descriptions), IOC categories and export formats, and explain the false-positive riNot tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.