ThreatNews

What is ThreatNews?

ThreatNews is an MCP server for collecting threat intelligence information. It provides a tool-based interface to query threat news by date range, targeting security researchers and developers who need structured threat data.

How to use ThreatNews?

Configure ThreatNews in Cursor as a stdio MCP server using uv to run the collect.py script from its directory, and set the API_KEY environment variable. Invoke the collect_threat_info tool with start and end date parameters (year, month, day).

Key features of ThreatNews

• Collects threat intelligence via a single MCP tool.
• Queries by configurable start and end dates.
• Runs as a stdio MCP server.
• Requires an API key for authentication.
• Integrates with Cursor IDE.

Use cases of ThreatNews

• Query threat news for a specific date range.
• Integrate threat data collection into Cursor workflows.
• Automate threat intelligence gathering for analysis.
• Support security research with dated incident information.

FAQ from ThreatNews

What tool does ThreatNews provide?

It provides the collect_threat_info tool with required arguments: start_year, start_month, start_day, end_year, end_month, and end_day.

How do I set up ThreatNews in Cursor?

Add a stdio MCP server with the command uv and args ["--directory", "/path/to/threatmcp", "run", "collect.py"], plus the API_KEY environment variable.

Does ThreatNews include Neo4j integration?

The README shows an optional separate Neo4j MCP server configuration for building a knowledge graph, but it is not part of ThreatNews itself.