OT Intel API

by No3men60 · remote · no sign-in to list tools · v2.0.0 · published by GitHub user No3men60

OT/ICS threat intel for AI agents: 40 tools, pay per call in USDC on Base via x402.

Changes · 1

Compare Registry entry

40 tools: 1 change things and 39 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone0Claude Code: ask
Changes things1Claude Code: ask: see these tools
Only reads39Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http ot-intel-api https://ot-intel-api.onrender.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 info

InfogetDeviceExposure
The description mentions "credential".
Matched text
description: "...OT devices by vendor and model. Default credential risk, exposed OT protocols (Modbus/502,..."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

40 tools

Changes things 1Creates or changes something that can be changed back.Claude Code: ask

submitSightingSubmit an anonymized IOC/TTP sighting observed in the caller's own OT environment.No findings
Why it is in this group
- The name "submitSighting" says "submit": a word for a change.
Description, as the server wrote it
Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment. Feeds the correlation corpus without storing an org identifier. Written to a separate sightings store, not intel.db. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Submit OT Sighting
- readOnlyHint: false
- openWorldHint: true

Only reads 39Looks things up and changes nothing.Claude Code: allow

getActionConformanceDeterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector/region context.No findings
Why it is in this group
- The name "getActionConformance" says "get": a word for reading.
Description, as the server wrote it
Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector/region context. Built on the same capability x opportunity x intent scoring as /ot/threat-score, with auditable rules layered on top — no LLM in the decision path. auto_approve requires vendor_stack; omitting it caps the verdict at human_review regardless of score. Price: $0.12 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Remediation Action Risk Gate
- readOnlyHint: true
- openWorldHint: true
getActorDossierComprehensive intelligence dossier for an ICS threat actor.No findings
Why it is in this group
- The name "getActorDossier" says "get": a word for reading.
Description, as the server wrote it
Comprehensive intelligence dossier for an ICS threat actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/ioc, /ot/asn, /ot/detection. Returns full profile, infrastructure analysis, IOC table, detection rules, kill chain mapping, and MITRE ATT&CK coverage. Price: $0.35 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Deep Actor Dossier
- readOnlyHint: true
- openWorldHint: true
getActorReportSynthesised Markdown threat report for an ICS/APT actor.No findings
Why it is in this group
- The name "getActorReport" says "get": a word for reading.
Description, as the server wrote it
Synthesised Markdown threat report for an ICS/APT actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/advisory, /ot/detection internally (no extra charge) and synthesises via DeepSeek. Returns executive summary, actor profile, active campaigns, malware families, sector targeting, ATT&CK mappings, recommended actions. TLP: WHITE. Price: $0.25 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Full Threat Actor Report (Markdown)
- readOnlyHint: true
- openWorldHint: true
getActorsBySectorAll ICS threat actors targeting a specific industrial sector from live MITRE ATT&CK ICS STIX data.No findings
Why it is in this group
- The name "getActorsBySector" says "get": a word for reading.
Description, as the server wrote it
All ICS threat actors targeting a specific industrial sector from live MITRE ATT&CK ICS STIX data. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Threat Actors by Industrial Sector
- readOnlyHint: true
- openWorldHint: true
getAdvisoriesLatest CISA ICS-CERT advisories filtered by vendor or sector.No findings
Why it is in this group
- The name "getAdvisories" says "get": a word for reading.
Description, as the server wrote it
Latest CISA ICS-CERT advisories filtered by vendor or sector. Returns advisory IDs, CVSS scores, CVE lists, OT severity, and direct triage links. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: CISA ICS-CERT Advisory Feed
- readOnlyHint: true
- openWorldHint: true
getAiAttackFeasibilityDeterministic lookup against one specific empirical study (Cook, Stoica, Shah & Pezaros, ACM Trans.No findings
Why it is in this group
- The name "getAiAttackFeasibility" says "get": a word for reading.
Description, as the server wrote it
Deterministic lookup against one specific empirical study (Cook, Stoica, Shah & Pezaros, ACM Trans. Priv. Sec. 29, 3, Article 31, June 2026) testing whether off-the-shelf general-purpose LLMs can generate working attack code against real PLCs. Only 3 vendors tested (Siemens, Schneider Electric, Rockwell Automation); only Network/Register-Tags techniques ever succeeded (zero for Application Code/Firmware); 1.08% overall end-to-end success rate. Claude models were excluded by the paper's own authors due to stronger safety guardrails. Distinct from /ot/ai-exposure (vendor's own AI copilot) and /ot/ai-uplift (open-ended reconnaissance-uplift synthesis). Deterministic, no LLM in the lookup path. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: LLM-Generated ICS Attack Feasibility
- readOnlyHint: true
- openWorldHint: true
getAiExposureAI/agentic copilot exposure lookup for OT/ICS vendors.No findings
Why it is in this group
- The name "getAiExposure" says "get": a word for reading.
Description, as the server wrote it
AI/agentic copilot exposure lookup for OT/ICS vendors. Returns the vendor's documented AI/agentic copilot, autonomy level (advisory vs agentic — the key risk differentiator), access, and applicable MITRE ATLAS techniques. Hand-verified mapping, ATLAS IDs confirmed against the live atlas.mitre.org matrix. Deterministic, no LLM in the lookup path. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: AI/Agentic Copilot Attack Surface Lookup
- readOnlyHint: true
- openWorldHint: true
getAiUpliftAssesses how much a general-purpose AI agent lowers the skill/time barrier for an attacker to reach a vendor's OT-adjacent footprint.No findings
Why it is in this group
- The name "getAiUplift" says "get": a word for reading.
Description, as the server wrote it
Assesses how much a general-purpose AI agent lowers the skill/time barrier for an attacker to reach a vendor's OT-adjacent footprint. Grounded in a real-world precedent (Dragos, May 2026), not frontier-model governance thresholds. Distinct from /ot/ai-exposure, which covers a vendor's OWN embedded AI copilot. DeepSeek-synthesised, ICD-203 estimative language. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Attacker AI-Uplift Exposure
- readOnlyHint: true
- openWorldHint: true
getAnalystBriefHuman-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector.No findings
Why it is in this group
- The name "getAnalystBrief" says "get": a word for reading.
Description, as the server wrote it
Human-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector. Same fan-out data as /ot/report but synthesised into a short decision-ready brief instead of a full report. Price: $0.12 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Analyst Brief (BLUF)
- readOnlyHint: true
- openWorldHint: true
getAsnProfileProfiles an ASN for ICS threat actor infrastructure use.No findings
Why it is in this group
- The name "getAsnProfile" says "get": a word for reading.
Description, as the server wrote it
Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, NakedPages), bulletproof hosting indicators, abuse categories (c2, staging, phishing), and an OT-specific blocking recommendation with WAF rule hint. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: ICS Threat Actor ASN Infrastructure Profiling
- readOnlyHint: true
- openWorldHint: true
getAssetExposureSynthesises vendor, model, firmware, sector, and network context into a branchable risk verdict.No findings
Why it is in this group
- The name "getAssetExposure" says "get": a word for reading.
Description, as the server wrote it
Synthesises vendor, model, firmware, sector, and network context into a branchable risk verdict. Returns risk_score (0-100), escalate (boolean), recommended_action, and contributing threat actors. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Asset Risk Score and Escalation Verdict
- readOnlyHint: true
- openWorldHint: true
getCampaignsActive campaigns targeting a specific industrial sector.No findings
Why it is in this group
- The name "getCampaigns" says "get": a word for reading.
Description, as the server wrote it
Active campaigns targeting a specific industrial sector. Returns campaign name, attributed actor, start date, targeted geography, TTPs in use, and CVEs being exploited. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Active ICS Campaign Tracker
- readOnlyHint: true
- openWorldHint: true
getClaimReliabilityGrounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026).No findings
Why it is in this group
- The name "getClaimReliability" says "get": a word for reading.
Description, as the server wrote it
Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against the paper's three failure modes — spurious correlation, contradictory knowledge, constrained generalization — using intel.db grounding plus DeepSeek synthesis. Returns a reliability score, verdict, corroborating/contradicting evidence, and confidence. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: CTI Claim Reliability Scoring
- readOnlyHint: true
- openWorldHint: true
getComplianceBatchRolls up compliance-gap mapping across multiple CVEs/threat actors in a single call.No findings
Why it is in this group
- The name "getComplianceBatch" says "get": a word for reading.
Description, as the server wrote it
Rolls up compliance-gap mapping across multiple CVEs/threat actors in a single call. Deterministic per-item table lookup against the same compliance_mappings data as /ot/compliance, deduplicated and rolled up into one aggregate severity rating. LLM only writes the remediation summary prose. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Aggregate Compliance Gap Assessment
- readOnlyHint: true
- openWorldHint: true
getComplianceMappingReturns triggered compliance controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC…No findings
Why it is in this group
- The name "getComplianceMapping" says "get": a word for reading.
Description, as the server wrote it
Returns triggered compliance controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, and UAE NESA IA. Deterministic table lookup — LLM only adds compensating control prose. Designed for automated compliance reporting agents: call when a new advisory drops, generate gap report, route to compliance team. Price: $0.04 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Multi-Framework Compliance Gap Mapping
- readOnlyHint: true
- openWorldHint: true
getCtiArticlePublication-ready threat intelligence article (~700 words).No findings
Why it is in this group
- The name "getCtiArticle" says "get": a word for reading.
Description, as the server wrote it
Publication-ready threat intelligence article (~700 words). Fans out to /ot/actor or /ot/cve + /ot/campaign + /ot/malware + /ot/advisory. DeepSeek writes in journalistic CTI style with headline, lede, body, defanged IOCs, and TLP marking. Suitable for threat intel blog posts or advisories. Price: $0.45 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: CTI Article (Publication-Ready)
- readOnlyHint: true
- openWorldHint: true
getCveTriageCVE lookup enriched for ICS/SCADA environments.No findings
Why it is in this group
- The name "getCveTriage" says "get": a word for reading.
Description, as the server wrote it
CVE lookup enriched for ICS/SCADA environments. Returns OT-adjusted severity, cyber-physical impact, affected ICS layer, compensating controls, patch feasibility, and CISA KEV status. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: OT-Contextualised CVE Triage
- readOnlyHint: true
- openWorldHint: true
getDetectionArtifactsReturns YARA/Sigma detection rules for an ICS malware family or threat actor.No findings
Why it is in this group
- The name "getDetectionArtifacts" says "get": a word for reading.
Description, as the server wrote it
Returns YARA/Sigma detection rules for an ICS malware family or threat actor. Rules sourced from public corpus (Florian Roth signature-base, CISA advisories) are marked validated:true and safe for staging. DeepSeek-synthesised rules carry validated:false and require lab testing. Designed for automated threat hunting pipelines that commit rules to SIEMs and EDRs. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: ICS Detection Artifact Retrieval
- readOnlyHint: true
- openWorldHint: true
getDeviceExposureExposure data for OT devices by vendor and model.1 finding
Why it is in this group
- The name "getDeviceExposure" says "get": a word for reading.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...OT devices by vendor and model. Default credential risk, exposed OT protocols (Modbus/502,..."
  What this check looks for
Description, as the server wrote it
Exposure data for OT devices by vendor and model. Default credential risk, exposed OT protocols (Modbus/502, S7comm/102, DNP3/20000, PCOM/20256), and hardening recommendations. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Internet-Exposed OT Device Lookup
- readOnlyHint: true
- openWorldHint: true
getGccBulletinRecurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep.No findings
Why it is in this group
- The name "getGccBulletin" says "get": a word for reading.
Description, as the server wrote it
Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep. Price: $0.01 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: GCC OT Threat Sitrep (Public Bulletin)
- readOnlyHint: true
- openWorldHint: true
getInvariantReachabilityChecks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out via conservation of mass.No findings
Why it is in this group
- The name "getInvariantReachability" says "get": a word for reading.
Description, as the server wrote it
Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out via conservation of mass. Fully deterministic, no LLM, no trained model. Inspired by Barbhaya et al. 2025's physical-invariant residual check — flags inconsistency and direction, does not assert a specific cause. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Physical Invariant Check
- readOnlyHint: true
- openWorldHint: true
getIocEnrichmentIOC enrichment via AlienVault OTX and AbuseIPDB.No findings
Why it is in this group
- The name "getIocEnrichment" says "get": a word for reading.
Description, as the server wrote it
IOC enrichment via AlienVault OTX and AbuseIPDB. Returns verdict on whether the IOC is linked to ICS-targeting campaigns. Price: $0.01 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: IOC Enrichment with OT Campaign Context
- readOnlyHint: true
- openWorldHint: true
getLinkedinPostLinkedIn post for a CTI/ICS security audience.No findings
Why it is in this group
- The name "getLinkedinPost" says "get": a word for reading.
Description, as the server wrote it
LinkedIn post for a CTI/ICS security audience. Fans out to /ot/actor or /ot/cve + /ot/advisory. Returns hook line, 3-5 intelligence bullet observations, call to action, and hashtags. Ready to publish. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: LinkedIn Post for CTI/ICS Audience
- readOnlyHint: true
- openWorldHint: true
getMalwareProfileStructured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY.No findings
Why it is in this group
- The name "getMalwareProfile" says "get": a word for reading.
Description, as the server wrote it
Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted OT protocols, attributed actor, and MITRE ATT&CK for ICS techniques. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: ICS Malware Encyclopedia
- readOnlyHint: true
- openWorldHint: true
getMitigationMapPrescriptive D3FEND-mapped mitigation guidance for OT/ICS threats.No findings
Why it is in this group
- The name "getMitigationMap" says "get": a word for reading.
Description, as the server wrote it
Prescriptive D3FEND-mapped mitigation guidance for OT/ICS threats. Pass one of actor, cve_id, or technique_id, optionally with vendor_stack. Returns matched ATT&CK ICS techniques mapped to D3FEND defensive countermeasures with priority and rationale, plus prescriptive architecture recommendations. DeepSeek-synthesised, ICD-203 estimative language. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: D3FEND-Mapped Mitigation Guidance
- readOnlyHint: true
- openWorldHint: true
getPatchFeasibilityFull patch feasibility for a CVE in OT/ICS environments.No findings
Why it is in this group
- The name "getPatchFeasibility" says "get": a word for reading.
Description, as the server wrote it
Full patch feasibility for a CVE in OT/ICS environments. Returns patch availability, OT-safe workarounds, estimated downtime, safe-to-patch-live flag, and risk-vs-disruption score (1-10). Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: OT Patch Feasibility Assessment
- readOnlyHint: true
- openWorldHint: true
getPrecursorTtpBuckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-st…No findings
Why it is in this group
- The name "getPrecursorTtp" says "get": a word for reading.
Description, as the server wrote it
Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact). Deterministic tactic-taxonomy lookup against intel.db — no LLM in the classification path. Price: $0.04 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Precursor / Dwell-Time TTP Breakdown
- readOnlyHint: true
- openWorldHint: true
getRiskExposureAggregates the same deterministic capability x opportunity x intent scoring used by /ot/threat-score across the actors relevant to a sector+region, ranks them, and returns a DeepSe…No findings
Why it is in this group
- The name "getRiskExposure" says "get": a word for reading.
Description, as the server wrote it
Aggregates the same deterministic capability x opportunity x intent scoring used by /ot/threat-score across the actors relevant to a sector+region, ranks them, and returns a DeepSeek-written executive summary (BLUF, ICD-203 language). Portfolio-level companion to /ot/threat-score — for vCISO agents and GRC/board-reporting automation. Price: $0.40 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Board/GRC-Level Portfolio Risk Aggregator
- readOnlyHint: true
- openWorldHint: true
getRootCauseLocalizationRanks which sensors most likely drove a reported anomaly by z-score deviation from each sensor's own baseline, given a caller-supplied telemetry window.No findings
Why it is in this group
- The name "getRootCauseLocalization" says "get": a word for reading.
Description, as the server wrote it
Ranks which sensors most likely drove a reported anomaly by z-score deviation from each sensor's own baseline, given a caller-supplied telemetry window. Fully deterministic, no LLM, no trained model. Statistical approximation inspired by Oswal et al. 2025 (kernel SHAP + TCAE) — not a SHAP/TCAE reimplementation. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Statistical Anomaly Attribution
- readOnlyHint: true
- openWorldHint: true
getSectorBriefComplete 30-day threat brief for an industrial sector.No findings
Why it is in this group
- The name "getSectorBrief" says "get": a word for reading.
Description, as the server wrote it
Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/decreasing), and top 3 recommended actions. One call replaces 5+ chained calls. Price: $0.10 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Sector Threat Brief
- readOnlyHint: true
- openWorldHint: true
getSectorDeltaWhat is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity.No findings
Why it is in this group
- The name "getSectorDelta" says "get": a word for reading.
Description, as the server wrote it
What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Sector Change Feed
- readOnlyHint: true
- openWorldHint: true
getSectorSitrep30-day situation report for an industrial sector.No findings
Why it is in this group
- The name "getSectorSitrep" says "get": a word for reading.
Description, as the server wrote it
30-day situation report for an industrial sector. Fans out to /ot/actor/sector, /ot/advisory, /ot/campaign, /ot/delta, /ot/compliance. Returns threat landscape, top active actors, new advisories, what changed, compliance posture impact, and weekly recommended priorities. Price: $0.35 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Sector Situation Report
- readOnlyHint: true
- openWorldHint: true
getStixCoverageDeterministic lookup grounded in Hahn, Krief et al., 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXiv:2512.18714v3, Jan …No findings
Why it is in this group
- The name "getStixCoverage" says "get": a word for reading.
Description, as the server wrote it
Deterministic lookup grounded in Hahn, Krief et al., 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXiv:2512.18714v3, Jan 2026). Returns whether STIX 2.1 can represent a given technique/protocol/CVE's artifacts (full/partial/none) and whether public reporting gave enough technical detail to be actionable for detection engineering. No LLM in the lookup path. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: STIX Representability + Actionability Lookup
- readOnlyHint: true
- openWorldHint: true
getThreatActorICS/APT threat actor profiles grounded in published vendor research.No findings
Why it is in this group
- The name "getThreatActor" says "get": a word for reading.
Description, as the server wrote it
ICS/APT threat actor profiles grounded in published vendor research. MITRE ATT&CK for ICS techniques, known malware, attribution, physical impact, targeted sectors. Alias lookup: Volt Typhoon→VOLTZITE, APT44→SANDWORM. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: ICS Threat Actor Profile
- readOnlyHint: true
- openWorldHint: true
getThreatHuntControlLoopFlags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations.No findings
Why it is in this group
- The name "getThreatHuntControlLoop" says "get": a word for reading.
Description, as the server wrote it
Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Fully deterministic keyword-pattern matching, no LLM. Grounded in CyberAgentX and AgenticCyOps (arXiv 2603.09134). ADVISORY ONLY — never executes containment or any network action. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Advisory Threat Hunt (Control-Loop Recon / RMM-LOTL)
- readOnlyHint: true
- openWorldHint: true
getThreatScoreDeterministic capability x opportunity x intent threat score for an actor-target pairing.No findings
Why it is in this group
- The name "getThreatScore" says "get": a word for reading.
Description, as the server wrote it
Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus GDELT geopolitical tension and OFAC sanctions pressure. Not LLM-generated. Price: $0.04 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Actor-Target Threat Score (Capability x Opportunity x Intent)
- readOnlyHint: true
- openWorldHint: true
getVendorRiskOT/ICS supply-chain vendor risk assessment.No findings
Why it is in this group
- The name "getVendorRisk" says "get": a word for reading.
Description, as the server wrote it
OT/ICS supply-chain vendor risk assessment. Returns risk tier, confidence, cited CVEs (KEV/EPSS), threat actors with historical targeting interest, and supply-chain mitigation recommendations. DeepSeek-synthesised, ICD-203 language. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: OT/ICS Third-Party Vendor Risk Assessment
- readOnlyHint: true
- openWorldHint: true
getVendorRiskDeltaCounterfactual vendor-swap risk comparison.No findings
Why it is in this group
- The name "getVendorRiskDelta" says "get": a word for reading.
Description, as the server wrote it
Counterfactual vendor-swap risk comparison. Runs the same assessment used by /ot/vendor-risk on each vendor and returns the risk-tier delta plus per-vendor summaries, for pre-purchase or migration decisions. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: Vendor-Swap Risk Comparison
- readOnlyHint: true
- openWorldHint: true
getXThreadX/Twitter thread for an actor or CVE.No findings
Why it is in this group
- The name "getXThread" says "get": a word for reading.
Description, as the server wrote it
X/Twitter thread for an actor or CVE. Fans out to /ot/actor or /ot/cve. Returns 5-7 posts: hook, intel posts with ATT&CK IDs and affected systems, mitigation post, and hashtag post. Each post under 280 characters. Price: $0.10 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
Annotations the server declares
- title: X/Twitter Thread (5-7 Posts)
- readOnlyHint: true
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 2.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http ot-intel-api https://ot-intel-api.onrender.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__ot-intel-api__getCveTriage",
      "mcp__ot-intel-api__getDeviceExposure",
      "mcp__ot-intel-api__getThreatActor",
      "mcp__ot-intel-api__getActorsBySector",
      "mcp__ot-intel-api__getIocEnrichment",
      "mcp__ot-intel-api__getAdvisories",
      "mcp__ot-intel-api__getPatchFeasibility",
      "mcp__ot-intel-api__getAssetExposure",
      "mcp__ot-intel-api__getCampaigns",
      "mcp__ot-intel-api__getSectorDelta",
      "mcp__ot-intel-api__getMalwareProfile",
      "mcp__ot-intel-api__getSectorBrief",
      "mcp__ot-intel-api__getAsnProfile",
      "mcp__ot-intel-api__getDetectionArtifacts",
      "mcp__ot-intel-api__getComplianceMapping",
      "mcp__ot-intel-api__getComplianceBatch",
      "mcp__ot-intel-api__getThreatScore",
      "mcp__ot-intel-api__getPrecursorTtp",
      "mcp__ot-intel-api__getRootCauseLocalization",
      "mcp__ot-intel-api__getThreatHuntControlLoop",
      "mcp__ot-intel-api__getInvariantReachability",
      "mcp__ot-intel-api__getVendorRisk",
      "mcp__ot-intel-api__getRiskExposure",
      "mcp__ot-intel-api__getActionConformance",
      "mcp__ot-intel-api__getAiExposure",
      "mcp__ot-intel-api__getAiUplift",
      "mcp__ot-intel-api__getAiAttackFeasibility",
      "mcp__ot-intel-api__getClaimReliability",
      "mcp__ot-intel-api__getStixCoverage",
      "mcp__ot-intel-api__getMitigationMap",
      "mcp__ot-intel-api__getActorReport",
      "mcp__ot-intel-api__getActorDossier",
      "mcp__ot-intel-api__getSectorSitrep",
      "mcp__ot-intel-api__getCtiArticle",
      "mcp__ot-intel-api__getLinkedinPost",
      "mcp__ot-intel-api__getXThread",
      "mcp__ot-intel-api__getAnalystBrief",
      "mcp__ot-intel-api__getVendorRiskDelta",
      "mcp__ot-intel-api__getGccBulletin"
    ],
    "ask": [
      "mcp__ot-intel-api__submitSighting"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as ot-intel-api. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.No3men60/ot-intel-api/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

1 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry. Synced Oct 21, 2026, 18:18 UTC.

For agents: Markdown · JSON · report this listing