Connect Claude to your self-hosted Polarity instance via the Model Context Protocol.
Enables Claude to:
- Discover all running integrations on your Polarity server
- Parse indicators of compromise (IPs, domains, hashes, URLs) from any text
- Query integrations and return enriched threat intelligence results — in real time, inside a conversation
- A running Polarity server (v5.7 or later)
- A Polarity user account with API key access
- Node.js ≥ 18
In the Polarity web interface: Settings → API Keys → Create API Key
Add the following to your claude_desktop_config.json:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"polarity": {
"command": "npx",
"args": ["-y", "@polarityio/mcp-connector"],
"env": {
"POLARITY_SERVER_URL": "https://polarity.yourcompany.com",
"POLARITY_TOKEN": "your-api-key-here"
}
}
}
}Restart Claude Desktop. You should see the Polarity tools appear in the tools panel.
| Tool | Description |
|---|---|
list_available_integrations |
Discover all running integrations and their supported entity types |
do_integration_lookup |
Look up a query string against a specific integration |
parse_entities |
Extract typed IOCs (IP, domain, hash, URL, email) from text |
"What Polarity integrations are available?"
"Look up 8.8.8.8 using the VirusTotal integration."
"Parse all the IP addresses and domains from this log line:
[2025-01-15] src=192.168.1.5 dst=185.220.101.42 host=evil.example.com"
"Check if malware.bazaar.abuse.ch is in any of my threat intel integrations."
MIT