Connecting Claude to the ThreatStream MCP Server Using OAuth Credentials

You can connect Claude to the ThreatStream MCP server to access ThreatStream and Security Analytics data in Claude conversations. The connection procedure depends on your Claude account type:

Personal plans (Free, Pro, and Max accounts): You configure the connector on Claude yourself.

Organization plans (Team and Enterprise accounts): An Owner configures the connector once, then each organization member connects individually.

Before You Begin

To connect Claude to the ThreatStream MCP server, create a set of MCP credentials that you will use specifically for connecting Claude to ThreatStream. Select the interactive (browser login) use case and enter Claude's OAuth callback URL: https://claude.ai/api/mcp/auth_callback.

See Managing MCP Credentials for details.

Connecting Claude Free, Pro or Max Accounts

To connect a Free, Pro, or Max Claude account to ThreatStream MCP: 

  1. Log in to your Claude account in Claude Desktop.
  2. Go to Customize > Connectors.
  3. Click + > Add custom connector.
  4. Enter the connector name and the following Server URL: https://optic.threatstream.com/mcp.
  5. Click Advanced settings.
  6. Enter your Client ID and Secret Key.
  7. Click Add.
  8. Claude opens a browser window. Log in and click Allow.

The connector is now available.
To use ThreatStream in a conversation, click + in the bottom-left of the chat and toggle the ThreatStream connector on.

Connecting Claude Team or Enterprise Accounts

If you are the Owner of your Team or Enterprise Claude account, you must perform the following steps to enable your account to access ThreatStream before the members of your organization can use it: 

  1. Log in to your Claude account in Claude Desktop.
  2. Go to Organization Settings > Connectors.
  3. Click Add > Custom > Web.
  4. Enter the connector name and the following Server URL: https://optic.threatstream.com/mcp.
  5. Click Advanced settings.
  6. Enter your Client ID and Secret Key.
  7. Click Add.

The connector is now available.

If you are the member of a Team or Enterprise Claude account, you must ensure that the Owner of your account has enabled access to ThreatStream before you can enable the ThreatStream connector using the following steps: 

  1. Log in to your Claude account in Claude Desktop.
  2. Go to Customize > Connectors.
  3. Find the connector labeled Custom.
  4. Click Connect and complete the login process.

The connector is now available.

To use ThreatStream in a conversation, click + in the bottom-left of the chat and toggle the ThreatStream connector on.

Notes:

  • Free plan users can add only one custom connector. Pro, Max, Team, and Enterprise support multiple.

  • Access tokens expire after 1 hour. If the connector stops working, disconnect it, reconnect, and complete the OAuth login again.

  • To update a connector, remove it first and re-add it with the new details.

Troubleshooting

If you run into issues connecting to or using ThreatStream MCP, check the following common causes first.

Issue Likely Cause Resolution
Connector was working but has now stopped, or returns an authentication error The access token has expired. Tokens are valid for only 1 hour. Disconnect the connector, reconnect it, and complete the OAuth login again.
Connector fails to connect, times out, or the OAuth login window never loads Your network or firewall is blocking outbound access to the ThreatStream MCP server. Confirm that https://optic.threatstream.com/mcp is reachable from the machine running Claude Desktop. Ask your network administrator to allow outbound HTTPS access to this address if it's currently blocked.
Claude can connect, but specific actions fail or return a permissions error Your OAuth token was not granted the scope required for that action, and/or your ThreatStream user account lacks the underlying permission. Check the required scope and minimum user permission. If a scope is missing, create a new set of MCP credentials, select all required scopes, and then re-connect Claude to ThreatStream using the newly created MCP credentials. For details on creating MCP credentials, refer to Managing MCP Credentials.
"Add" fails immediately when configuring the connector The Client ID, Client Secret, or Server URL was entered incorrectly. Re-check the values of the Client ID and Secret Key. The Secret Key is shown only once. If you've lost it, create a new set. For details on creating MCP credentials, refer to Managing MCP Credentials.
PIR or Security Analytics tools are missing or unavailable Your organization does not use ThreatStream Next Gen or Security Analytics, or the corresponding scope was not requested. Confirm with your ThreatStream Organization Administrator whether these features are enabled for your organization.
Organization member cannot see the connector The Owner has not yet completed setup, or the member is looking in the wrong menu. Confirm with your Owner that the connector was added under Organization Settings > Connectors. Members should then connect it themselves under Customize > Connectors.