How to Use SOCRadar Threat Intelligence MCP Server?
How to Use SOCRadar Threat Intelligence MCP Server?
SOCRadar’s MCP Server brings the power of real-time threat intelligence directly into your AI assistant. Once connected, it enables analysts, CISOs, and SOC teams to investigate threats, generate reports, and automate lookups using natural language—without ever leaving the chat interface.
Integrating SOCRadar MCP Server
Before you can start using SOCRadar’s capabilities, you need to connect the MCP Server to your assistant platform. This one-time integration allows secure, real-time access to SOCRadar’s modules, including threat intelligence, vulnerability insights, and more. The process takes just a few steps.
Step 1: Add SOCRadar as a Custom Integration
Navigate to your assistant’s Settings > Integrations page.
Click “+ Add integration” to register a new custom integration.
Integration settings panel showing the available services and the custom SOCRadar option.
In the dialog that opens, name the service (SOCRadar) and enter the MCP Server endpoint:
https://mcp.socradar.com
Editing the integration name and URL to add https://mcp.socradar.com.
Step 2: Authorize the Connection
Click Connect next to the SOCRadar entry.
You will be prompted to provide your SOCRadar API Key and Company ID.
You can also enter optional API keys for different enhanced modules like:
- CTI Threat Investigation
- Vulnerability Intelligence
- Identity Intelligence
- Ransomware Intelligence
Authorization form requesting required credentials and optional module keys.
Step 3: Confirm the Integration Status
After entering your credentials, the integration will validate and show a Connected status under SOCRadar.
Successful connection confirmation displayed on the integrations list.
Step 4: Start Using SOCRadar Tools in the Chat Interface
Once connected, open the assistant’s chat interface. Click the “+” button and select “Add from SOCRadar.”
Chat interface showing “Add from SOCRadar” as an available option in the tool menu.
You’ll now see a library of ready-to-use prompts such as:
- ciso_industry_threats
- architect_vulnerability_report
- red_team_find_exploits
These templates fetch real-time threat intelligence from SOCRadar and can be used directly or invoked via natural language.
Prompt list of available SOCRadar templates, ready to launch in conversation.
How to Use the SOCRadar MCP Server
The SOCRadar MCP Server is designed to empower AI assistants with direct access to enterprise-grade cybersecurity intelligence. Once integrated, the assistant can perform complex investigations, generate reports, and interact with live threat data using simple natural language prompts.
Automating Threat Investigations with Natural Language
Security analysts, CISOs, and SOC teams can interact with the SOCRadar MCP Server by asking AI assistants to perform tasks such as:
- Investigating emerging CVEs
- Generating real-time threat summaries
- Analyzing actor behaviors
- Tracking exposed credentials
- Generating executive briefings
The assistant interprets your query, connects to SOCRadar’s intelligence modules, and returns enriched, actionable results.
Example Use Case: Investigating an Actively Exploited CVE
Scenario: A new remote code execution vulnerability in Microsoft SharePoint (CVE-2025-53770) is suspected to be part of an ongoing exploitation campaign. Your goal is to understand the severity, public attention, available exploits, and threat actor involvement.
The Ask:
“Give me all threat intelligence available on CVE-2025-53770 from SOCRadar’s MCP Server.”
What Happens:
- The AI agent searches the Vulnerability Intelligence and Cyber Threat Intelligence modules
- It performs multiple parallel lookups: vulnerability details, exploit availability, trending status, and broader threat context
- It compiles and returns a summary including risk rating, CVSS, attack vectors, exploitation stats, and observed actor discussions
A prompt asking the assistant to retrieve all available intelligence for CVE-2025-53770 using SOCRadar’s Cyber Threat Intelligence and Vulnerability Intelligence modules.
A part of the final result for CVE-2025-53770, showing high CVSS score, number of exploits, public chatter, trending status, and complete vulnerability context.
Why MCP Workflow Beats Manual Lookups
Using SOCRadar MCP, the same lookup takes seconds compared to manual browsing across multiple threat intel sources.
Traditional Method:
- Open multiple dashboards
- Search CVE databases
- Check dark web mentions manually
- Piece together threat context
With MCP Server:
- One prompt → consolidated results
- AI agent handles orchestration
- Enriched, up-to-date context across all modules