Connecting Claude Code to the ThreatStream MCP Server

You can connect the ThreatStream MCP server to Claude Code. The steps include registering the ThreatStream MCP server with Claude Code, checking the connection status, and then using it in a chat session.

Before You Begin

To connect ThreatStream MCP to Claude Code, you must have the following:

  • Claude Code installed and authenticated on your machine.

  • A terminal open in a project directory (any directory works, including an empty one).

  • A set of ThreatStream MCP Credentials (Client ID and Secret Key) created with the Interactive (browser login) use case. To learn how to create MCP credentials, refer to Managing MCP Credentials.

    When creating the credential set, ThreatStream asks for the client’s redirect URI. Enter http://localhost:<port>/callback, where <port> is a local port you choose and will also pass to Claude Code in Connecting Claude Code to the ThreatStream MCP Server.
    For example, http://localhost:8765/callback.

  • ThreatStream MCP Server URL: https://optic.threatstream.com/mcp

Step 1: Add the MCP Server

Run the following command in your terminal, not inside a claude session:

Copy 
claude mcp add --transport http threatstream https://optic.threatstream.com/mcp --client-id <client_id> --client-secret --callback-port 8765

  • Replace <client_id> with the Client ID ThreatStream displayed when you created the credential set.

  • --client-secret with no value prompts you for the secret with masked input. Claude Code stores it in your operating system’s keychain, not in a configuration file.

  • --callback-port must match the port you registered in the credential’s redirect URI.

The command confirms with a message like Added HTTP MCP server threatstream with URL: https://optic.threatstream.com/mcp to local config, followed by a File modified: line showing the configuration file that was written.

By default, this registers the server at local scope (active only in this project, for you only).

To make it available across all your projects, add --scope user to the command.

To share it with teammates via version control, use --scope project, which writes to .mcp.json in the project root.

Step 2: Authenticate and Check the Connection Status

  1. Start a session:

    claude

  2. Run the MCP panel and authenticate:

    /mcp

  3. Select threatstream, press Enter, and choose Authenticate. Your browser opens to ThreatStream’s sign-in page—approve the connection there. Back in Claude Code, the server’s status changes to Connected.

You can also check the status from your shell at any time by running the following command:

claude mcp list

You should see threatstream listed with the ✔ Connected status.

If it still shows ! Needs authentication, repeat the /mcp > Authenticate step.

If you see ✘ Failed to connect or ✘ Connection error, see Troubleshooting below.

Step 3: Use ThreatStream in a Session

Ask a question that requires ThreatStream data, naming the server so the request routes through it:

For example, 

Use the threatstream server to show me recently active threat actors targeting the financial industry

Approve the tool-use prompt the first time Claude calls a ThreatStream tool. Tool calls in Claude’s output are labeled with the threatstream server name, which confirms the answer came from ThreatStream rather than Claude’s built-in knowledge or web search.

Where the Configuration Is Saved

Scope File Available to
local (default) ~/.claude.json, under this project’s entry Only you, only this project
project .mcp.json in the project root Everyone who clones the project
user ~/.claude.json, top-level mcpServers key Only you, all projects

Run claude mcp get threatstream to see which scope holds the server’s definition and confirm the configured URL, client ID, and callback port. The client secret itself is not shown; it is held in your OS keychain.

Removing the ThreatStream MCP Server From Claude Code

When you no longer need the connection, run the following command:

claude mcp remove threatstream

Troubleshooting

Issue Likely Cause Resolution
claude mcp list shows ✘ Failed to connect or ✘ Connection error Network/firewall is blocking outbound access, or Claude Code is older than v2.1.64 and doesn’t support --client-id/--client-secret/--callback-port Run curl -I https://optic.threatstream.com/mcp to confirm the endpoint is reachable, and claude --version to confirm your Claude Code version. Upgrade Claude Code if needed
Browser opens but authentication fails, or the callback never completes The --callback-port value doesn’t match the redirect URI registered on the ThreatStream credential set Confirm the redirect URI you entered in ThreatStream is exactly http://localhost:<port>/callback using the same port passed to --callback-port. Scopes and the use case can’t be changed after creation, so if the redirect URI is wrong, create a new credential set with the correct one
Status stays at ! Needs authentication after running /mcp > Authenticate OAuth sign-in failed or the browser didn’t open Run /mcp, select threatstream, and choose Authenticate again. If the browser doesn’t open, copy the URL shown in the terminal and open it manually
Server connects but returns a permissions error on specific actions The MCP credential’s scopes don’t cover the action, or your ThreatStream user lacks the underlying permission Check the required scope and your ThreatStream permissions. Scopes can’t be changed after creation—create a new set of MCP credentials with the needed scopes and re-add the server with the new credentials
threatstream doesn’t appear after adding You ran claude mcp add from a different project (local scope is tied to the project you were in) Re-add the server from your current project directory, or use --scope user so it isn’t tied to one project
Server connects but no tools appear The client ID, secret, or callback port is incorrect Run claude mcp remove threatstream and re-add it, double-checking the Client ID and redirect URI/port against the credential set in ThreatStream