The rapid proliferation of Model Context Protocol (MCP)-based agentic systems has introduced a new category of security threats that existing frameworks are inadequately equipped to address. We present MCPThreatHive, an open-source platform that automates the end-to-end lifecycle of MCP threat intelligence: from continuous, multi-source data collection through AI-driven threat extraction and classification, to structured knowledge graph storage and interactive visualization. The platform operationalizes the MCP-38 threat taxonomy, a curated set of 38 MCP-specific threat patterns mapped to STRIDE, OWASP Top 10 for LLM Applications, and OWASP Top 10 for Agentic Applications. A composite risk scoring model provides quantitative prioritization. Through a comparative analysis of representative existing MCP security tools, we identify three critical coverage gaps that MCPThreatHive addresses: incomplete compositional attack modeling, absence of continuous threat intelligence, and lack of unified multi-framework classification.

翻译：基于模型上下文协议（MCP）的智能体系统的快速普及引入了一类新型安全威胁，现有框架对此类威胁的应对能力严重不足。我们提出MCPThreatHive这一开源平台，能够自动化实现MCP威胁情报的端到端生命周期：从持续的多源数据采集、基于AI的威胁提取与分类，到结构化知识图谱存储与交互式可视化。该平台实现了MCP-38威胁分类法——一套包含38种MCP特有威胁模式的精选集合，并映射至STRIDE、OWASP十大LLM应用安全风险及OWASP十大智能体应用安全风险。复合风险评分模型提供定量化优先级排序。通过对比分析现有代表性MCP安全工具，我们识别出MCPThreatHive所填补的三个关键覆盖缺口：不完整的组合攻击建模、持续性威胁情报的缺失，以及缺乏统一的多框架分类体系。