hadobot/threatweaver

ThreatWeaver is a server that lets Claude investigate cybersecurity threat indicators, things like suspicious IP addresses, domains, or file hashes, by pulling information from multiple threat intelligence sources at once and connecting the dots between them. It is built using the Model Context Protocol, often shortened to MCP, which is the standard way tools like this plug into Claude. Normally, a security analyst checking a suspicious indicator has to manually switch between separate services such as VirusTotal, AbuseIPDB, URLhaus, and Shodan, running the same lookup in each one and losing context between checks. Because each of those checks happens in isolation, patterns where several indicators actually belong to the same coordinated attack, sharing infrastructure or the same registered owner, are easy to miss. ThreatWeaver's answer is to query all of those sources in parallel, keep track of everything found across an entire investigation, and automatically compare indicators to spot shared attributes like the same network provider, malware family, or geographic location, flagging groups of three or more related indicators as a likely coordinated campaign. The project explains that it relies specifically on MCP's ability to expose persistent, readable state and to let Claude reason about what to check next on its own, something a typical web API cannot offer without a lot of extra plumbing. It is built with a framework called NitroStack, which provides the underlying structure for defining tools, exposing data, and guiding Claude's behavior within the server. Investigation results can be exported as STIX 2.1 bundles, a standard threat intelligence format that security tools like Splunk, Elastic, and Sentinel can read directly. The server can also run entirely offline using bundled sample data if no API keys are configured, and stores its findings in a local SQLite database with an in memory cache layer for speed. Setup involves cloning the repository, installing dependencies with npm, optionally adding API keys for the outside data sources, and configuring Claude Desktop to connect to the running server. This tool is aimed at security analysts and SOC teams who investigate threat indicators and want that work automated and connected within Claude, rather than at a general audience.