Brandefense MCP Server

Brandefense threat intelligence inside Claude and ChatGPT: ask about threats, exposures and brand risks in plain language.

Ver en brandefense.io

Documentación

Skip to content

Brandefense

Search threats, groups, guides

Request a demo Log in

Search Esc

Quick links

Knowledge Hub APT groups Ransomware groups Vulnerabilities Glossary

Press Enter to search, Esc to close

Documentation · For Your Agents

Brandefense MCP. Put Brandefense Inside Your AI Agent.

MCP (Model Context Protocol) is an open standard that lets AI agents use outside tools. Connect your AI agent or code editor to Brandefense, then investigate incidents, pull threat intelligence and generate reports without leaving your agent.

Add to Claude ↗ Open in ChatGPT ↗

Install Claude directory ↗ ChatGPT app ↗

MCP replaces custom glue code with one standard connection. Incidents, exposure, threat intelligence and reports sit behind one server address. The main areas:

IncidentsTriage, assign, report ExposureSubdomains, ports, findings InvestigationSearch and threat investigation TakedownsPhishing and social media Threat IntelligenceActors, dark web, ransomware PoliciesRules and patterns VulnerabilitiesCVEs and exploits ReportsCreate, track, export

NeedWithout MCPWith Brandefense MCP
Give an agent threat contextA custom API client for each tool.One server address for the available tools.
Sign an agent inCopy and store an API token.Sign in with your Brandefense account.
Keep permissions in syncSeparate service accounts to manage.Your own Brandefense role.
Switch AI clientsRebuild the integration.The same server in any client that supports MCP.

One Question, End To End.

Follow a single prompt from your agent to the platform and back.

  1. 00:00 Ask You ask in plain language"investigate incident #4021"No query syntax, no dashboard. Type it the way you would ask a colleague.
  2. 00:01 Authorize The server checks who is askingSign-in check · your role · your organizationThe agent works with your role.
  3. 00:02 Call Reads the incidentincident_detail(4021)The agent calls the platform directly.
  4. 00:03 Call Checks the indicatorintelligences_list(ioc: "185.220.101.0/24")The threat intelligence behind the indicator.
  5. 00:04 Call Looks at historyincidents_list(ioc: "185.220.101.0/24")Earlier incidents from the same source.
  6. 00:05 Correlate Connects the evidencematch: known Tor exit range, seen in earlier incidentsInfrastructure, history and impact, cross-referenced.
  7. 00:06 Answer An answer you can act onRoot cause: credential stuffing from Tor exitsRoot cause, next step and the tool calls behind it.

Sample run on acme.com. Times are illustrative.

Same access as the platform. No separate account.

  1. 01 ### Enable Access

    An organization manager turns connections on once. Everyone in scope can then connect.

  2. 02 ### Install from the Claude directory

    Open the Brandefense listing in the Claude directory and add it. Sign in with your Brandefense account and approve access.

    Add to Claude ↗

  3. 03 ### Verify It Works

    Start a new chat with Brandefense switched on and ask “Who am I on Brandefense?” You should see your name, organization and role.PromptCopy

    Who am I on Brandefense?

Same access as the platform. No separate account.

  1. 01 ### Enable Access

    An organization manager turns connections on once. Everyone in scope can then connect.

  2. 02 ### Open the app in ChatGPT

    Open the Brandefense app in ChatGPT and add it. Sign in with your Brandefense account and approve access.

    Open in ChatGPT ↗

  3. 03 ### Verify It Works

    Start a new chat with Brandefense switched on and ask “Who am I on Brandefense?” You should see your name, organization and role.PromptCopy

    Who am I on Brandefense?

Other ways in: Brandefense In ChatGPT.

Examples of what an agent can call. Read-only tools run directly. Tools that change data ask you to confirm in the chat.

ToolWhat it doesAccess
needs_your_attentionDashboardsYour prioritized “what should I look at first?” feed. The same source powers the Needs Your Attention view in the platform.Read
incident_detailIncidentsFull details or a short summary of one incident, by its code.Read
list_phishing_sitesPhishingPhishing sites detected against your brand, with their status.Read
search_blackhole_domainInvestigationAn investigation on a domain across dark web, breach and botnet sources.ReadAsks you to confirm first
start_phishing_takedownTakedownsStart a takedown for a detected phishing site.WriteAsks you to confirm in the chat

Sample output on acme.com.

Note

Sign in with your Brandefense account. Managers can switch connections off for the whole organization.Does On Its Own

  • Reads what your account can see
  • Calls read-only tools directly
  • Lists the tool calls behind an answer
  • Exports and reports on request

Asks You First

  • Changing an incident, asset or user
  • Starting investigations or scans
  • Starting a takedown
  • Creating teams, policies or reports

Never Does

  • See more than your role allows
  • Run without your sign-in

Switch off

Remove the connection in your client, or ask a manager to switch connections off.

Type these the way you would ask a colleague. Names such as INC-4021 and acme.com are sample data.

Check the connectionCopy

Who am I on Brandefense?

needs_your_attentionCopy

What needs my attention today?

InvestigationCopy

investigate incident #4021

incident_detailCopy

Summarize incident INC-4021 and who is assigned.

list_phishing_sitesCopy

Which phishing sites are still active against my brand?

start_phishing_takedownCopy

Start a takedown for this phishing site.

Example calls

What the agent runs behind a question. You do not type these.

incident_detailCopy

incident_detail("INC-4021", format: "summary")

search_blackhole_domainCopy

search_blackhole_domain("acme.com")

start_phishing_takedownCopy

phishing_site_detail(id)
start_phishing_takedown(id)
  • What is MCP?

Model Context Protocol, an open standard that lets AI agents call outside tools and read outside data in a common way.

  • Which clients are supported?

Brandefense is listed in the Claude directory and as an app in ChatGPT. For other clients that support MCP, your partner can confirm what Brandefense supports today.

  • Do I need a separate account?

No. It gives the same access as the platform. Sign in with your Brandefense account.

  • Do I have to copy an API token?

No. You sign in with your Brandefense account and approve access, so there is no token to copy and store.

  • Can the agent see more than I can?

No. The agent works with your own Brandefense role. Tools can only do what your own account can do.

  • How do I check that it works?

Start a new chat with Brandefense switched on and ask “Who am I on Brandefense?” You should see your name, organization and role.

  • “You don’t have permission to use the MCP server”

An organization manager has not turned connections on, or your team is not in scope. Ask a manager to enable it, then try again.

  • A tool answers “Unauthorized” or “Forbidden”

Your role in the platform does not allow that action. Tools can only do what your own account can do.

  • Do some tools need confirmation?

Tools that change data or start investigations ask you to confirm in the chat before they run.

  • How do I disconnect?

Remove the connection in your client, or ask a manager to switch connections off.

Put Brandefense Inside Your Agent.

A partner switches on MCP for your organization and runs your first questions with you.

Request a demo Talk To An Analyst →

{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://brandefense.io/#organization","name":"Brandefense","sameAs":["https://www.facebook.com/Brandefense","https://www.instagram.com/brandefense/","https://www.linkedin.com/company/brandefense","https://www.youtube.com/channel/UCzYBNxqGFZ2v39OShpVeFFQ","https://x.com/brandefense","https://www.g2.com/products/brandefense-digital-risk-protection-platform/reviews","https://www.gartner.com/reviews/product/brandefense-digital-risk-protection-platform","https://www.crunchbase.com/organization/brandefense","https://github.com/BRANDEFENSE"],"logo":{"@type":"ImageObject","@id":"https://brandefense.io/#logo","url":"https://brandefense.io/wp-content/uploads/2026/08/brandefense-3-scaled.png","contentUrl":"https://brandefense.io/wp-content/uploads/2026/08/brandefense-3-scaled.png","caption":"Brandefense","inLanguage":"en-US","width":"2560","height":"1811"},"url":"https://brandefense.io","description":"Brandefense is an AI-driven threat intelligence platform that unifies Cyber Threat Intelligence, Digital Risk Protection and External Attack Surface Management.","address":[{"@type":"PostalAddress","streetAddress":"300 Delaware Ave. Ste 210 #328","postalCode":"19801","addressLocality":"Wilmington","addressRegion":"DE","addressCountry":"US"},{"@type":"PostalAddress","streetAddress":"\u00dcniversiteler, 1605 Cd. Cyberpark Vak\u0131f Binas\u0131 Kat: -1 No: B25","postalCode":"06800","addressLocality":"\u00c7ankaya, Ankara","addressCountry":"TR"}],"foundingDate":"2019","contactPoint":[{"@type":"ContactPoint","contactType":"general inquiries","email":"info@brandefense.io","availableLanguage":"English"},{"@type":"ContactPoint","contactType":"customer support","email":"support@brandefense.io","availableLanguage":"English"}]},{"@type":"WebSite","@id":"https://brandefense.io/#website","url":"https://brandefense.io","name":"Brandefense","publisher":{"@id":"https://brandefense.io/#organization"},"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https://brandefense.io/wp-content/uploads/2026/09/og-default-1.png","url":"https://brandefense.io/wp-content/uploads/2026/09/og-default-1.png","width":"1200","height":"630","caption":"Brandefense logo with tagline Unified Threat Intelligence for External Cyber Risks.","inLanguage":"en-US"},{"@type":"WebPage","@id":"https://brandefense.io/brandefense-ai/mcp-server/#webpage","url":"https://brandefense.io/brandefense-ai/mcp-server/","name":"Brandefense MCP Server for AI Agents - Brandefense","datePublished":"2026-10-11T17:11:31+03:00","dateModified":"2026-10-11T17:27:45+03:00","isPartOf":{"@id":"https://brandefense.io/#website"},"primaryImageOfPage":{"@id":"https://brandefense.io/wp-content/uploads/2026/09/og-default-1.png"},"inLanguage":"en-US"},{"@type":"BreadcrumbList","@id":"https://brandefense.io/brandefense-ai/mcp-server/#breadcrumb","itemListElement":[{"@type":"ListItem","position":"1","name":"Home","item":"https://brandefense.io/"},{"@type":"ListItem","position":"2","name":"Brandefense AI","item":"https://brandefense.io/brandefense-ai/"},{"@type":"ListItem","position":"3","name":"MCP Server","item":"https://brandefense.io/brandefense-ai/mcp-server/"}]}]}