dev.rosti/rosti

up checked 2026-11-10T18:37:26.935Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided title

Rösti Threat Intel

Publisher-provided description

Look up IOCs and search threat-intel reports, YARA rules, MITRE ATT&CK ids and CVEs from rosti.dev

Summary by lookupd

Look up indicators of compromise, search threat-intel reports, YARA rules and MITRE ATT&CK or CVE references for security analysis.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http rosti https://mcp.rosti.dev/mcp

Codex, remote (streamable-http)

codex mcp add rosti --url https://mcp.rosti.dev/mcp

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "rosti": {
      "url": "https://mcp.rosti.dev/mcp"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (11 tools)

Publisher-provided text

• lookup_iocs Check many IOCs (indicators of compromise) at once against Rösti's threat-intelligence reports. Defanged values (hxxps://evil[.]com, 1.2.3[.]4, user[at]evil[.]
• lookup_ioc Check whether one IOC (indicator of compromise) appears in Rösti's threat-intelligence reports. A defanged value (hxxps://evil[.]com, 1.2.3[.]4) is refanged be
• search_iocs Search IOCs across all Rösti reports by text, type, tag, category and creation time. Without filters, lists IOCs from all reports. Each IOC carries its report
• search_reports Search Rösti's threat-intelligence reports by text, source, CVE, MITRE ATT&CK id and publication date. Returns report summaries: title, date, source, authors,
• get_report Get one Rösti report: metadata, MITRE ATT&CK ids, CVEs, available export formats, and how many of its IOCs there are per type and per tag. Use list_report_iocs
• list_report_iocs List the IOCs of one Rösti report, optionally filtered by type, tag, category or text. IOCs with the same entity_ref belong together, e.g. the MD5, SHA-1 and S
• get_yara_rules Get the YARA rules published with one Rösti report, with their full source.
• find_related_reports Find other Rösti reports that share IOCs with one report, most shared IOCs first, with the shared values.
• get_export_link Get a download link for one report export, e.g. CSV or MISP. The link is signed and expires after 15 minutes; it is meant to be opened by the user, not downloa
• list_sources List the publishers whose reports Rösti collects (vendor blogs, CERTs, researchers), with report counts, the newest report date and whether the source is still
• describe_taxonomy List the values Rösti uses for IOC types, IOC tags (with descriptions), IOC categories and export formats, and explain the false-positive risk scale. Use these

Details

• Version: 0.2.1
• Transports: streamable-http
• Uptime (7 days): 100%
• Median latency: 1368 ms
• First indexed: 2026-11-04T15:17:17.907Z
• Last seen in registry: 2026-11-05T15:17:15.245Z
• Website: https://rosti.dev/mcp

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/dev.rosti/rosti.svg)](https://lookupd.com/servers/dev.rosti/rosti)

• 62071 servers
• Last crawl: 2026-11-11T16:39:06.253Z
• API base: https://api.lookupd.com
• MCP URL: https://api.lookupd.com/mcp