For threat hunting, the sources point to a few distinct kinds of tools: Google Threat Intelligence exposes threat, report and actor search 2; Elastic Security provides SIEM-based alert triage and search across ingested data 3; watchTowr offers hunt search and findings lookup tied to CVEs and TTPs 5; and phishunt.io supplies a free IOC feed explicitly recommended for threat hunting 10. Docker's sandboxes and hardened images 1 and GitHub's threat-model analyst 4 are adjacent rather tha
- 1
Elastic Securityelastic.coverified and signed
A SIEM that ingests and stores data to detect threats, with alert triage and search actions to investigate signals 3.
official:MCP server · Elasticsearch MCP ServerSDK · elasticsearchlibrary · Elasticsearch.NetCLI · logstashrepository · elastic-labs+27 community tools built for it
for agents: security-alert-triage · search · lucene
- 2
Google Threat Intelligencegoogle.comfound in code, not yet checked
Searches threats, threat reports and threat actors in the Google Threat Intelligence platform 2.
official:MCP server · mcp-securityAPI · Travel Partner APISDK · brotlilibrary · zerocopyCLI · googletest+1,236 community tools built for it
for agents: search_threats · search_threat_reports · search_threat_actors
- 3
watchTowr Platformwatchtowr.comfound in code, not yet checked
Searches hunts by title, CVE ID or TTP tactic and lists the findings each hunt discovered 5.
+1 community tools built for it
for agents: search_hunts · search_capabilities · list_findings_by_hunt
- 4
Sources
- 1Docker | Secure Sandboxes for AI Agentsdocker.com · read 2026-10-29
- 2Googlegoogle.com · read just now
- 3Elastic: The search database for AI | Search, AI agents, Observability, and Security | Elasticelastic.co · read 2026-10-29
- 4GitHub · Change is constant. GitHub keeps you ahead. · GitHub · GitHubgithub.com · read 2026-10-29
- 5watchTowr | Preemptive Exposure Managementwatchtowr.com · read 2026-10-29
- 10Free phishing websites & domains feed (TXT/JSON/CSV) - phishunt.iophishunt.io · read 2026-10-29
Left out: Webhound has shut down, because each one's own page says it is retired or discontinued.
For agents: the 10 actions behind this answer
manage_threats · Threat Modeling MCP Server found in code, not yet checked
Manage threats, mitigations, and their links.
search_threats · mcp-security found in code, not yet checked
Search threats in the Google Threat Intelligence platform.
security-alert-triage · security-alert-triage verified and signed
Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, or investigating detections.
threat-model-analyst · threat-model-analyst verified and signed
Full STRIDE-A threat model analysis and incremental update skill for repositories and systems. Supports two modes: (1) Single analysis — full STRIDE-A threat model of a repository, producing architecture overviews, DFD diagrams, STRIDE-A analysis, prioritized findings, and executive assessments. (2)
search_hunts · watchTowr Platform MCP Server found in code, not yet checked
Search hunts with rich filters.
· ThreatDeck website read, tools not yet checked
A Rust-powered terminal-based threat intelligence monitoring and alerting platform for SOCs, security researchers, and threat intelligence analysts.
semgrep · semgrep verified and signed
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
search_threatatlas · www-project-threatatlas found in code, not yet checked
Search across products, diagrams, threats, and mitigations by name.
get_platform · dell-ai found in code, not yet checked
Get detailed information about a specific platform.
· phishunt.io website read, tools not yet checked
Free real-time phishing domains feed. Download 24h/7d/30d of IOCs in TXT, JSON or CSV. Browse by brand, IP, country, or TLS certificate.
Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.