PyCTI FAQs

Question 1

What is PyCTI and what is its primary purpose?

Accepted Answer

PyCTI is an MCP (Model Context Protocol) server designed to consolidate and normalize OpenCTI threat intelligence data into a structured JSON format. Its primary purpose is to optimize this data for efficient consumption by Large Language Models (LLMs).

Question 2

How does PyCTI optimize OpenCTI data for LLMs?

Accepted Answer

PyCTI optimizes data by condensing information, resolving GraphQL-linked entities to provide richer context, reducing non-informative metadata to maximize LLM context window usage, and using more verbose field naming for better LLM intuition.

Question 3

What integrations does PyCTI support?

Accepted Answer

PyCTI integrates seamlessly with `mcp-hub` for multi-server management, allowing you to manage various MCP servers centrally. It also supports direct integration with VSCode Copilot Chat, enhancing your AI-driven threat analysis workflows within VSCode.

Question 4

Can I add custom tools to PyCTI to process specific OpenCTI data?

Accepted Answer

Yes, PyCTI is designed for extensibility. Developers can easily add new custom tools by creating a Python module that implements a `tool_init` function and a type-annotated entrypoint. This allows for tailored processing of OpenCTI data.

Question 5

What types of OpenCTI threat intelligence can PyCTI process out-of-the-box?

Accepted Answer

Out-of-the-box, PyCTI includes tools to perform lookups for OpenCTI Observables, Adversaries (including Intrusion Sets, Threat Actors, and Campaigns), and Reports. These tools transform the relevant threat intelligence into an LLM-ready JSON format.

PyCTI

PyCTI

Key Features

Use Cases

Key Features

Use Cases