Managing MCP Credentials

The ThreatStream Model Context Protocol (MCP) server enables MCP-compatible AI applications, agents, and automation tools to access threat intelligence in ThreatStream. OAuth 2.0 provides a secure authentication method for connecting these clients without using a static API key.

Once connected, you can query threat intelligence, investigate observables, and perform supported ThreatStream actions directly from your AI application.

ThreatStream supports two OAuth authentication flows:

• Authorization Code with PKCE (with browser login): Use for interactive applications where a user authenticates through a browser, such as Claude Desktop or other interactive AI clients.
• Client Credentials (no browser login): Use for unattended or headless applications, such as custom agents, scripts, SOAR playbooks, and server-to-server integrations. Authentication is performed directly using the client ID and secret key without browser interaction.

Connecting an MCP client to ThreatStream MCP involves the following steps: 

1. Creating a set of MCP credentials. See Creating MCP Credentials for details

2. Connecting an MCP client. See Connecting an MCP Client for details.

Creating MCP Credentials

You can create up to 10 sets of credentials for connecting MCP clients.

To create a set of MCP credentials:

1. Navigate to Profile > Account Settings.
2. Under Account Settings, click MCP credentials.
   
   
3. Click New.
4. Enter a name for the set of credentials.
5. Select the appropriate use case:
   • Interactive (browser login)—for applications that authenticate through a browser.
   • Unattended (no browser)—for scripts, agents, and other headless automation.
     Note that the use case selected for the client cannot be changed after you create the credentials.
     
6. If you selected Interactive/browser, enter the client's redirect URI.
7. Select the OAuth scopes for the client. You can select any scope when creating a set of credentials, regardless of your ThreatStream user permissions. However, if you select a scope that is not covered by your permissions, MCP tool calls that require that scope will fail when the MCP client attempts to run them. Therefore, Anomali recommends selecting only the scopes that correspond to your ThreatStream permissions.
   Scopes selected for the client cannot be updated after the credential creation.
   

   Scope	Description
   MCP_READ_TS_DATA	Read ThreatStream threat intelligence data such as investigations, Actors, Threat Bulletins, and Rules.
   MCP_WRITE_TS_DATA	Import observables and threat models.
   MCP_ENRICHMENTS_ACCESS	Access observable enrichment and intelligence associations.
   MCP_READ_PIR_DATA Note: This scope is applicable only to organizations that use ThreatStream Next Gen.	Read PIRs.
   MCP_WRITE_PIR_DATA Note: This scope is applicable only to organizations that use ThreatStream Next Gen.	Create and update PIRs.
   MCP_SA_ACCESS Note: This scope is applicable only to organizations that use Security Analytics.	Access Search Analyst tools for natural language queries and search jobs.

8. Click Create.
   

ThreatStream displays the Client ID, Secret Key, and MCP Server URL after the set of credentials is created. The Secret Key is displayed only once and cannot be retrieved later. Copy it and store it in a secure location.

Managing MCP Credentials

After creating a set of credentials, you can view all your MCP credentials, edit their names, or delete them. Scopes and use case are fixed when a credential is created. To change them, delete the credential and create a new one.

Editing MCP Credentials

To edit the name of set of MCP credentials: 

1. Navigate to Profile > Account Settings.
2. Under Account Settings, click MCP credentials.
3. Select the client ID whose name you want to edit.
4. Click Edit. Alternatively, hover over the client ID and click the Edit icon ().
   
5. In the Edit MCP Credential dialog box, change the name and click Save.

The name of the selected Client ID is updated.

Deleting MCP Credentials

To delete a set of MCP credentials:

1. Navigate to Profile > Account Settings.
2. Under Account Settings, click MCP credentials.
3. Select the client ID that you want to delete.
4. Click Delete. Alternatively, hover over the client ID and click the Delete icon ().
   
   
5. In the confirmation pop-up message, click Delete.
   The selected MCP credentials are deleted. All active sessions with these MCP credentials are immediately terminated.

Connecting an MCP Client

Claude Desktop is the tested and validated client for this connection method. For details, see Connecting Claude to the ThreatStream MCP Server Using OAuth Credentials.

For other MCP clients, refer to the OAuth documentation for that client and use a set of MCP credentials you created for it.

Auditing ThreatStream MCP User Activity

ThreatStream tracks MCP-related user activity through three audit event categories:

• mcp_auth (authentication events)

• mcp_credential (credential creation and deletion)

• mcp_scope_violation (attempts to access resources beyond granted scopes)

To view details for any event—such as user, client IP, scopes, or tool name—click the arrow on the left side of the row to expand it.

You can filter these events without needing to know AQL. In Basic mode, select the audit dataset and add a WHERE clause for category = "mcp_auth"

Alternatively, if you prefer AQL, use:

audit | where category in ('mcp_credential', 'mcp_scope_violation', 'mcp_auth')

For more information on monitoring ThreatStream user actions, see Audit Lookup Table (ThreatStream) .