Rösti Threat Intel

dev.rosti/rostiVersion 0.2.1

Look up IOCs and search threat-intel reports, YARA rules, MITRE ATT&CK ids and CVEs from rosti.dev

Status

Responds178 msNov 14, 2026, 14:27 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:27 UTC
Latency: 178 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 21:12 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://mcp.rosti.dev/mcpResponds178 msNov 14, 2026, 14:27 UTC

No sign-in

Claude Code

claude mcp add --transport http rosti https://mcp.rosti.dev/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: rosti
Remote MCP server URL: https://mcp.rosti.dev/mcp

Cursor

{
  "mcpServers": {
    "rosti": {
      "url": "https://mcp.rosti.dev/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"rosti","type":"http","url":"https://mcp.rosti.dev/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

11 tools

Tools of Rösti Threat Intel
	Description		Read-only	Idempotent	Open world
`describe_taxonomy`List the values Rösti uses for IOC types, IOC tags (with descriptions), IOC categories and export formats, and explain the false-positive risk scale. Use these values for the filters of the search and list tools.	List the values Rösti uses for IOC types, IOC tags (with descriptions), IOC categories and export formats, and explain the false-positive risk scale. Use these values for the filters of the search and list tools.	No	Yes	Yes	No
`find_related_reports`Find other Rösti reports that share IOCs with one report, most shared IOCs first, with the shared values.	Find other Rösti reports that share IOCs with one report, most shared IOCs first, with the shared values.	No	Yes	Yes	No
`get_export_link`Get a download link for one report export, e.g. CSV or MISP. The link is signed and expires after 15 minutes; it is meant to be opened by the user, not downloaded here.	Get a download link for one report export, e.g. CSV or MISP. The link is signed and expires after 15 minutes; it is meant to be opened by the user, not downloaded here.	No	Yes	Yes	No
`get_report`Get one Rösti report: metadata, MITRE ATT&CK ids, CVEs, available export formats, and how many of its IOCs there are per type and per tag. Use list_report_iocs for the IOCs themselves and get_yara_rules for its YARA rules.	Get one Rösti report: metadata, MITRE ATT&CK ids, CVEs, available export formats, and how many of its IOCs there are per type and per tag. Use list_report_iocs for the IOCs themselves and get_yara_rules for its YARA rules.	No	Yes	Yes	No
`get_yara_rules`Get the YARA rules published with one Rösti report, with their full source.	Get the YARA rules published with one Rösti report, with their full source.	No	Yes	Yes	No
`list_report_iocs`List the IOCs of one Rösti report, optionally filtered by type, tag, category or text. IOCs with the same entity_ref belong together, e.g. the MD5, SHA-1 and SHA-256 of one file. Each IOC carries its IDS flag and false-positive risk.	List the IOCs of one Rösti report, optionally filtered by type, tag, category or text. IOCs with the same entity_ref belong together, e.g. the MD5, SHA-1 and SHA-256 of one file. Each IOC carries its IDS flag and false-positive risk.	No	Yes	Yes	No
`list_sources`List the publishers whose reports Rösti collects (vendor blogs, CERTs, researchers), with report counts, the newest report date and whether the source is still active. Source ids work as the sources filter of search_reports.	List the publishers whose reports Rösti collects (vendor blogs, CERTs, researchers), with report counts, the newest report date and whether the source is still active. Source ids work as the sources filter of search_reports.	No	Yes	Yes	No
`lookup_ioc`Check whether one IOC (indicator of compromise) appears in Rösti's threat-intelligence reports. A defanged value (hxxps://evil[.]com, 1.2.3[.]4) is refanged before the lookup; `input` then shows the value as given. Matching is exact, with a case-insensitive fallback. Returns every report the value appears in (newest first, up to max_matches) with the IOC's type, category, tags, IDS flag, comment and false-positive risk. Also checks the value against the Rösti False Positive Warninglist (popular domains, public DNS resolvers, ...) and returns its verdict in `false_positive_verdict`, also when Rösti does not know the value; null when the warninglist has no verdict.	Check whether one IOC (indicator of compromise) appears in Rösti's threat-intelligence reports. A defanged value (hxxps://evil[.]com, 1.2.3[.]4) is refanged before the lookup; `input` then shows the value as given. Matching is exact, with a case-insensitive fallback. Returns every report the value appears in (newest first, up to max_matches) with the IOC's type, category, tags, IDS flag, comment and false-positive risk. Also checks the value against the Rösti False Positive Warninglist (popular domains, public DNS resolvers, ...) and returns its verdict in `false_positive_verdict`, also when Rösti does not know the value; null when the warninglist has no verdict.	No	Yes	Yes	No
`lookup_iocs`Check many IOCs (indicators of compromise) at once against Rösti's threat-intelligence reports. Defanged values (hxxps://evil[.]com, 1.2.3[.]4, user[at]evil[.]com) are refanged before the lookup; `refanged` shows which. Matching is exact, with a case-insensitive fallback. For each value that is found, returns the reports it appears in (newest first) with the IOC's type, category, tags, IDS flag, comment and false-positive risk. Values that are not found are listed in `not_found`. Every value is also checked against the Rösti False Positive Warninglist (popular domains, public DNS resolvers, ...): found values carry `false_positive_verdict`, not-found values appear in `false_positive_verdicts`; values without a verdict are left out. Use lookup_ioc for all matches of a single value.	Check many IOCs (indicators of compromise) at once against Rösti's threat-intelligence reports. Defanged values (hxxps://evil[.]com, 1.2.3[.]4, user[at]evil[.]com) are refanged before the lookup; `refanged` shows which. Matching is exact, with a case-insensitive fallback. For each value that is found, returns the reports it appears in (newest first) with the IOC's type, category, tags, IDS flag, comment and false-positive risk. Values that are not found are listed in `not_found`. Every value is also checked against the Rösti False Positive Warninglist (popular domains, public DNS resolvers, ...): found values carry `false_positive_verdict`, not-found values appear in `false_positive_verdicts`; values without a verdict are left out. Use lookup_ioc for all matches of a single value.	No	Yes	Yes	No
`search_iocs`Search IOCs across all Rösti reports by text, type, tag, category and creation time. Without filters, lists IOCs from all reports. Each IOC carries its report id (use get_report for the report), type, category, tags, IDS flag, comment and false-positive risk. Use lookup_ioc or lookup_iocs to check whether specific values are known.	Search IOCs across all Rösti reports by text, type, tag, category and creation time. Without filters, lists IOCs from all reports. Each IOC carries its report id (use get_report for the report), type, category, tags, IDS flag, comment and false-positive risk. Use lookup_ioc or lookup_iocs to check whether specific values are known.	No	Yes	Yes	No
`search_reports`Search Rösti's threat-intelligence reports by text, source, CVE, MITRE ATT&CK id and publication date. Returns report summaries: title, date, source, authors, tags, counts of IOCs, YARA rules and MITRE ids, and links to the original report and rosti.dev. Use get_report for the details of one report.	Search Rösti's threat-intelligence reports by text, source, CVE, MITRE ATT&CK id and publication date. Returns report summaries: title, date, source, authors, tags, counts of IOCs, YARA rules and MITRE ids, and links to the original report and rosti.dev. Use get_report for the details of one report.	No	Yes	Yes	No

Details

Registry status: Active
Published: Nov 5, 2026
Updated: Nov 5, 2026
Website: https://rosti.dev/mcp⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing