SOCRadar XTI MCP (Preview)

Enrich IOCs and investigate threats with SOCRadar Extended Threat Intelligence.

This connector is available in the following products and regions:

SOCRadar XTI

SOCRadar Extended Threat Intelligence (XTI) brings SOCRadar's real-time threat intelligence into Microsoft 365 Copilot and other AI-powered experiences through a remote Model Context Protocol (MCP) server. Security teams can enrich indicators of compromise, investigate threat actors and vulnerabilities, monitor dark web credential leaks, track ransomware activity, and triage incidents directly from an agent — grounded in SOCRadar's XTI platform.

Publisher

SOCRadar Inc.

Prerequisites

To use this MCP server you need:

• An active SOCRadar XTI subscription (https://socradar.io).
• A SOCRadar user account with permission to access the relevant XTI modules (Cyber Threat Intelligence, Attack Surface Management, Dark Web Monitoring, Digital Risk Protection, and others).
• One or more SOCRadar API keys, generated from the SOCRadar platform (Settings → API Options → Generate Key), and your numeric Company ID (visible in your SOCRadar dashboard URL). These are entered on the SOCRadar sign-in screen during connection setup.

Authentication

This MCP server acts as its own OAuth 2.0 authorization server.

• Authorization URL: https://mcp.socradar.com/authorize
• Token URL: https://mcp.socradar.com/token
• Refresh URL: https://mcp.socradar.com/token
• Scopes: tools:read, tools:execute
• Server URL (MCP streamable HTTP): https://mcp.socradar.com/

When a user creates a connection, they are redirected to the SOCRadar sign-in screen, enter their SOCRadar API key(s) and Company ID, and approve the requested scopes. On approval, SOCRadar issues an access token and the connection is established. Public clients use authorization code + PKCE; the Microsoft-provided confidential client uses client_secret_basic with refresh tokens.

Tools

The server provides 46 tools across the following domains. Full names, descriptions, and input schemas are in mcptools.json.

• Indicator (IOC) enrichment — enrich_indicator, enrich_ip_address, enrich_domain, enrich_hash, enrich_url, bulk_enrich_indicators, get_bad_reputation, quick_threat_lookup, get_ioc_enrichment_api_status
• Threat intelligence & investigation — investigate_threat, deep_investigation
• Threat actor intelligence — get_threat_actors, get_threat_actor_detail, get_threat_actor_iocs, search_actors_by_cve, search_actors_by_malware, search_actors_by_sector
• Vulnerability intelligence — search_vulnerabilities, get_vulnerability_details, analyze_vulnerability_risk, get_trending_vulnerabilities, get_cve_trends
• Ransomware intelligence — get_ransomware_victims, get_recent_ransomware_victims, analyze_ransomware_trends
• Dark web & identity intelligence — check_credential_exposure, get_botnet_data, get_blackmarket_data, get_pii_exposure, query_stealer_logs_on_sale, query_breach_intelligence, query_identity_intelligence, get_identity_intelligence_summary, get_credit_card_exposures, get_im_content
• Attack surface management — get_digital_assets, get_digital_footprint_summary
• Brand protection & digital risk — get_impersonating_domains, get_impersonating_accounts, get_social_media_findings, get_rogue_mobile_applications, get_surface_web_monitoring
• Incident management — search_incidents, get_incident_details, resolve_incidents, mark_incidents_as_false_positive

Example prompts

• "Enrich the IP address 8.8.8.8 with SOCRadar."
• "Show me the latest ransomware victims in the finance sector."
• "Investigate threat actor APT29 and list its known IOCs."
• "Has example.com appeared in any dark web credential leaks?"
• "Summarize the open incidents from the last 7 days."

Known issues and limitations

• Tools are discovered dynamically by the agent at runtime; this MCP server does not expose individual actions in the classic connector designer.
• Access to specific tools depends on the modules enabled for your SOCRadar subscription and the permissions of the API key you provide. A tool may return an authorization error if your key lacks access to that module.
• Rate limits follow your SOCRadar plan; heavy bulk enrichment may be throttled.
• A small number of tools (get_ioc_enrichment_api_status, get_digital_footprint_summary) take no input parameters and operate on your account context.

Support

• Website: https://socradar.io/
• Support: https://socradar.io/contact/ · support@socradar.io
• Privacy policy: https://socradar.io/privacy-policy/

Actions

SOCRadar XTI MCP