Log In Sign Up

Rösti in your AI assistant

The Rösti MCP server lets AI assistants such as Claude and ChatGPT use Rösti: check IOCs, search reports, read YARA rules and follow related reports, right in your conversation. It's free, read-only and works without an account.

Server URL:

https://mcp.rosti.dev/mcp

Connect

Claude

  1. Go to Customize → Connectors and click Add custom connector
  2. Enter https://mcp.rosti.dev/mcp as the server URL
  3. If you're asked about authentication, choose Sign in when needed and Register automatically
  4. Click Add
  5. In a chat, turn Rösti on under + → Connectors

ChatGPT

  1. Open chatgpt.com/plugins
  2. Click + and choose Add custom MCP server
  3. Name it Rösti and enter https://mcp.rosti.dev/mcp as the public endpoint
  4. Confirm the warning and select Create as a plugin

Whether you can add custom servers depends on your ChatGPT plan and workspace settings.

Claude Code

claude mcp add --transport http rosti https://mcp.rosti.dev/mcp

Other MCP clients

Any client that supports remote MCP servers over Streamable HTTP can connect to the server URL above.

Free use, sign-in and API keys

  • Without an account: all anonymous users share one quota. When it's used up, your assistant tells you and offers to sign in.
  • Sign in with Rösti: sign in with your free Rösti account and allow the assistant once. Your requests then use your own quota.
  • Your own API key: clients that can send HTTP headers, such as Claude Code, can send your API key in the X-API-Key header:
claude mcp add --transport http rosti https://mcp.rosti.dev/mcp --header "X-API-Key: YOUR_KEY"

Tools

All tools only read data; none of them change anything.

  • lookup_iocs – Check up to 1,000 IOCs at once against all reports.
  • lookup_ioc – Check one IOC and list the reports that mention it.
  • search_iocs – Search IOCs by text, type, tag, category and date.
  • search_reports – Find reports by text, source, CVE, MITRE ATT&CK technique and date.
  • get_report – Details of one report: ATT&CK techniques, CVEs, IOC counts, exports.
  • list_report_iocs – The IOCs of one report, filtered by type or tag.
  • get_yara_rules – The YARA rules of one report.
  • find_related_reports – Reports that share IOCs with a report.
  • get_export_link – A download link for a report export, e.g. STIX or MISP.
  • list_sources – The publishers Rösti collects reports from.
  • describe_taxonomy – IOC types, tags, categories and the false-positive risk scale.

Defanged values such as hxxps://evil[.]com are accepted. A match means the value was mentioned in a public report; check its type, tags and false-positive risk before acting on it.

Things to ask

  • “Check these indicators against Rösti: (paste a list of IPs, domains, URLs or hashes)”
  • “Find the newest reports about CVE-2024-3400 and summarize their IOCs.”
  • “Show the YARA rules of the newest report that uses MITRE ATT&CK T1566.”
  • “Which other reports share infrastructure with this one?”

Privacy

The server forwards what your assistant looks up to the Rösti API and returns the results to the assistant. See the privacy policy for what is processed and kept.

Support