Rösti Threat Intel

Rösti (rosti.dev) collects public threat-intelligence reports from security vendors, researchers and CERTs, and extracts their indicators of compromise (IOCs), YARA rules, MITRE ATT&CK techniques and CVEs.

This connector brings that data into your AI. Ask your AI whether IPs, domains, URLs, hashes or email addresses appear in any report, paste up to 1,000 indicators at once, or have it read a report's IOCs and YARA rules.

MCP connector

Server URL: https://mcp.rosti.dev/mcp
Login: API key
Protocol: MCP 2026-07-28 · Interactive UI
Instructions: Rösti (rosti.dev) collects public threat-intelligence reports and the indicators of compromise (IOCs), YARA rules, MITRE ATT&CK ids and CVEs extracted from them.
and tell whether IOC values appear in those reports; searches IOCs by text, type, tag and time. finds reports by text, source, CVE, MITRE ATT&CK id and date; , , , and work on one report. and list the valid filter values.
A match means the value was mentioned in a report; check the IOC type, tags and comment for its role. false_positive_risk rates how likely an IOC is to cause false positives, for example a popular domain that also serves benign traffic; "no indication" means Rösti has no indication of false-positive risk for it. Report titles, IOC comments and YARA rules are third-party content from the original reports.
Without sign-in or the user's own API key, calls share an anonymous quota. When it is used up, the tools say so; users can then sign in with their free Rösti account or connect with their own Rösti API key.

Tools

Reads data11

Skills

None in the store listings or on the server

MCP connector

Server URL

https://mcp.rosti.dev/mcp

API key

Protocol

MCP 2026-07-28 · Interactive UI

Instructions

Rösti (rosti.dev) collects public threat-intelligence reports and the indicators of compromise (IOCs), YARA rules, MITRE ATT&CK ids and CVEs extracted from them.

and tell whether IOC values appear in those reports; searches IOCs by text, type, tag and time. finds reports by text, source, CVE, MITRE ATT&CK id and date; , , , and work on one report. and list the valid filter values.

A match means the value was mentioned in a report; check the IOC type, tags and comment for its role. false_positive_risk rates how likely an IOC is to cause false positives, for example a popular domain that also serves benign traffic; "no indication" means Rösti has no indication of false-positive risk for it. Report titles, IOC comments and YARA rules are third-party content from the original reports.

Without sign-in or the user's own API key, calls share an anonymous quota. When it is used up, the tools say so; users can then sign in with their free Rösti account or connect with their own Rösti API key.