Rösti Threat Intel

Working Security A

dev.rosti/rostiv0.1.0 Domain verified

Look up IOCs and search threat-intel reports, YARA rules, MITRE ATT&CK ids and CVEs from rosti.dev

Security

Watch Website

Registry entry

Open in the registry

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-11-04T14:56:51.010127Z",
      "publishedAt": "2026-11-04T14:56:51.010127Z",
      "statusChangedAt": "2026-11-04T14:56:51.010127Z"
    }
  },
  "server": {
    "name": "dev.rosti/rosti",
    "icons": [
      {
        "src": "https://mcp.rosti.dev/icons/mcp-large.svg",
        "sizes": [
          "any"
        ],
        "mimeType": "image/svg+xml"
      },
      {
        "src": "https://mcp.rosti.dev/icons/mcp-large.png",
        "sizes": [
          "512x513"
        ],
        "mimeType": "image/png"
      }
    ],
    "title": "Rösti Threat Intel",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "remotes": [
      {
        "url": "https://mcp.rosti.dev/mcp",
        "type": "streamable-http",
        "headers": [
          {
            "name": "X-API-Key",
            "isSecret": true,
            "description": "Optional: your own Rösti API key from https://rosti.dev/api for your own quota. Without it, sign in with Rösti or use the shared anonymous quota."
          }
        ]
      }
    ],
    "version": "0.1.0",
    "websiteUrl": "https://rosti.dev",
    "description": "Look up IOCs and search threat-intel reports, YARA rules, MITRE ATT&CK ids and CVEs from rosti.dev"
  }
}

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://mcp.rosti.dev/mcp

X-API-Key (optional)

Optional: your own Rösti API key from https://rosti.dev/api for your own quota. Without it, sign in with Rösti or use the shared anonymous quota.

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

describe_taxonomy Read-only

List the values Rösti uses for IOC types, IOC tags (with descriptions), IOC categories and export formats, and explain the false-positive risk scale. Use these values for the filters of the search and list tools.

This tool takes no arguments.

Argument	Type	Description
limit	integer	Maximum number of related reports
report_id*	string	Rösti report id, e.g. dq13KaQv

Argument	Type	Description
format*	string	Export format id, e.g. csv or misp; get_report lists the formats available for a report
report_id*	string	Rösti report id, e.g. dq13KaQv

Argument	Type	Description
tags	any	IOC tags, e.g. c2, phishing
limit	integer	IOCs per page
query	any	Text to find in IOC values or comments
types	any	IOC types, e.g. domain, ip-dst, sha256
cursor	any	next_cursor from a previous call, to get the next page
report_id*	string	Rösti report id, e.g. dq13KaQv
categories	any	IOC categories, e.g. network_activity

Argument	Type	Description
limit	integer	Sources per page
query	any	Text to find in source names, e.g. 'crowdstrike'
cursor	any	next_cursor from a previous call, to get the next page

Argument	Type	Description
value*	string	One IOC value, e.g. an IP address, domain, URL, file hash or e-mail address, plain or defanged (e.g. hxxps://evil[.]com)
max_matches	integer	Maximum number of reports listed

Rösti Threat Intel

Registry entry

Try it

describe_taxonomy Read-only

Rösti Threat Intel

Registry entry

Try it

describe_taxonomy Read-only

Install

Tools (11)

Security checkA100/100

Argument	Type	Description
values*	array	IOC values such as IP addresses, domains, URLs, file hashes (MD5, SHA-1, SHA-256) or e-mail addresses, plain or defanged (e.g. hxxps://evil[.]com). Surrounding whitespace and duplicates are ignored. At most 1000 values.
max_matches_per_value	integer	Maximum number of reports listed per found value

Argument	Type	Description
tags	any	IOC tags, e.g. c2, phishing (see describe_taxonomy)
exact	boolean	Require the value or comment to equal the query instead of containing it
limit	integer	IOCs per page
query	any	Text to find in IOC values or comments, e.g. 'mcrosoft' or 'C2 server'. Defanged values are refanged.
since	any	Only IOCs created or updated after this date (YYYY-MM-DD) or timestamp (YYYY-MM-DDTHH:MM:SSZ)
types	any	IOC types, e.g. domain, ip-dst, sha256 (see describe_taxonomy)
cursor	any	next_cursor from a previous call, to get the next page
categories	any	IOC categories, e.g. network_activity (see describe_taxonomy)

Argument	Type	Description
cves	any	Reports referencing any of these CVEs, e.g. CVE-2021-44228
sort	string	Sort order
limit	integer	Reports per page
query	any	Text to find in report titles or authors, e.g. 'lumma'
cursor	any	next_cursor from a previous call, to get the next page
sources	any	Source ids, e.g. asec, crowdstrike (see list_sources)
mitre_ids	any	Reports referencing any of these MITRE ATT&CK ids, e.g. T1566.001
published_after	any	Reports published on or after this date (YYYY-MM-DD)
published_before