Integration

OpenCTI integration

OpenCTI threat intelligence platform API. OpenCTI exposes a single GraphQL endpoint and no REST surface, so each operation here is one named GraphQL query or mutation: list and search indicators, observables, reports and STIX core objects with Relay style paging and the modern filter groups, read one indicator, and create indicators and reports. OpenCTI is self hosted, so the instance host is part of the credential alongside the API token.

Connect OpenCTI How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in OpenCTI.Built from the 8 OpenCTI tools below, on the connection you add once.

Common OpenCTI use cases

reading the detection pattern behind an indicator match
exporting high scoring indicators into a detection platform
pulling the reports published since the last run for review
pushing indicators from an incident into the intelligence platform
resolving a threat actor or malware name to its platform identifier
removing indicators imported from a feed that turned out to be wrong
recording an incident write-up as a report that groups its indicators
checking whether a raw address or hash is already known to the platform
cleaning up indicators created during a test import
finding the reporting that a set of indicators came from

What you can do with OpenCTI

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Indicator, 4 operations

create_indicatorCreate indicatorPOSTCreates an OpenCTI indicator carrying a detection pattern.
delete_indicatorDelete indicatorPOSTDeletes an OpenCTI indicator.
get_indicatorGet indicatorPOSTReturns a single OpenCTI indicator with its pattern, score and validity window.
list_indicatorsList indicatorsPOSTLists OpenCTI indicators with their detection pattern, score and validity window.

Report, 2 operations

create_reportCreate reportPOSTCreates an OpenCTI report to group related entities and observables.
list_reportsList reportsPOSTLists OpenCTI intelligence reports with their publication date and confidence.

Observable, 1 operation

list_observablesList observablesPOSTLists OpenCTI observables such as addresses, domains, files and URLs.

Stix object, 1 operation

search_stix_core_objectsSearch stix core objectsPOSTSearches across every STIX object type in OpenCTI, from malware to intrusion sets to reports.

Use OpenCTI from Claude Code, Cursor or Codex

Connect OpenCTI in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its OpenCTI operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect OpenCTI

Create your workspace
Sign up free. Nothing to install.
Connect OpenCTI once
Add your OpenCTI connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

OpenCTI integration FAQ

What can you do with the OpenCTI integration?

LiveContext exposes 8 operations on OpenCTI, covering indicator, report, observable and stix object. Common uses include reading the detection pattern behind an indicator match, exporting high scoring indicators into a detection platform and pulling the reports published since the last run for review.