Abstract:With the increasing complexity of cyber attacks, the collection and integration of threat intelligence face challenges of fragmentation. In this context, enterprises have begun building private threat intelligence knowledge graph systems. However, traditional construction methods suffer from inefficiency and limited effectiveness due to inaccurate extraction of entities and their relationships. To address these issues, this study proposes OPFA: a general threat intelligence knowledge graph construction framework based on model context protocol (MCP) agents. Through dynamic semantic subject positioning, large language model prompt templates are fine-tuned to drive agents to extract threat entities and their relationships. These threat entities and relationships are automatically created as nodes and edges in the knowledge graph, and threat intelligence is then linked through entity attribute value matching to form a complete knowledge graph. The system subsequently retrieves MCP resources for critical threat entities (such as vulnerabilities and malicious samples) to achieve customized knowledge graph expansion. Experimental results demonstrate that the agents not only improve Precision (97.22% and 97.83%, respectively), Recall (90.91% and 95.52%, respectively), and F1-score (94.44% and 96.66%, respectively) in threat entity and entity relationship extraction, but also effectively enhance the construction efficiency of the knowledge graph.