Koskamo

OT Intel API MCP

An MCP server providing 40 pay-per-call OT/ICS threat intelligence tools for AI agents. It covers CVE triage, device exposure, threat actor profiles, IOC enrichment, and compliance mapping for SCADA and industrial systems, using USDC micropayments on Base via x402.

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

OT Intel API MCP logo, by OT Intel APICommunity listingStreamable HTTPNo sign-inEndpoint checked 2026-11-01Published by OT Intel API
You need:No API key. No account. No subscription.
MCP endpoint (Streamable HTTP)
https://ot-intel-api.onrender.com/mcp
Vendor documentation

What you can do with it

  • Triage CVEs with OT-contextualized severity and ICS impact assessment
  • Enrich IOCs with OT campaign context and threat actor attribution
  • Map compliance gaps across NERC CIP, IEC 62443, and NIST CSF
  • Generate threat actor reports, sector sitreps, and detection artifacts

Source and maintenance

Community listingRegistry 2.0.0
mcp-registry: io.github.No3men60/ot-intel-api@2.0.0Project website

Protocol and capabilities

Server
ot-intel-api 2.0.0
MCP protocol
2025-06-18
Tools
40 advertised
Resources
Not advertised
Resource templates
Not advertised
Prompts
Not advertised
Server-advertised capabilities
{
  "tools": {
    "listChanged": false
  }
}

Server-provided instructions

Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.

OT/ICS threat intelligence. Every tool is a paid call priced in USDC on Base mainnet via x402. Call a tool without payment to receive an x402 PaymentRequired challenge (isError:true, structuredContent). Sign it with an x402 client and retry the identical call (same arguments) with the payload in params._meta["x402/payment"]. The settlement receipt is returned in result._meta["x402/payment-response"]. Full schema: https://ot-intel-api.onrender.com/openapi.json

Tools

40 advertised

getCveTriage — OT-Contextualised CVE Triage
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

CVE lookup enriched for ICS/SCADA environments. Returns OT-adjusted severity, cyber-physical impact, affected ICS layer, compensating controls, patch feasibility, and CISA KEV status. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getCveTriage input schema
{
  "type": "object",
  "required": [
    "id"
  ],
  "properties": {
    "id": {
      "type": "string",
      "description": "CVE identifier e.g. CVE-2023-38802"
    }
  },
  "additionalProperties": false
}
getCveTriage annotations
{
  "title": "OT-Contextualised CVE Triage",
  "readOnlyHint": true,
  "openWorldHint": true
}
getDeviceExposure — OT Device Security Profile
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Security profile for an OT device: its NVD CVEs (newest first), its CISA ICS advisories (full CSAF history), and a model-written hardening profile (default-credential risk, OT protocols at risk, hardening steps; labelled by profile_provenance). Not an internet exposure scan. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getDeviceExposure input schema
{
  "type": "object",
  "required": [
    "vendor"
  ],
  "properties": {
    "model": {
      "type": "string",
      "description": "Device model e.g. s7-1200, modicon-m340, controllogix, vision. With a model, NVD is searched for the model name"
    },
    "vendor": {
      "type": "string",
      "description": "Vendor e.g. siemens, schneider, rockwell, honeywell, unitronics, ge, beckhoff"
    }
  },
  "additionalProperties": false
}
getDeviceExposure annotations
{
  "title": "OT Device Security Profile",
  "readOnlyHint": true,
  "openWorldHint": true
}
getThreatActor — ICS Threat Actor Profile
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

ICS/APT threat actor profiles grounded in published vendor research. MITRE ATT&CK for ICS techniques, known malware, attribution, physical impact, targeted sectors. Alias lookup: Volt Typhoon→VOLTZITE, APT44→SANDWORM. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getThreatActor input schema
{
  "type": "object",
  "required": [
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Actor name or alias e.g. SANDWORM, VOLTZITE, XENOTIME, Volt Typhoon"
    }
  },
  "additionalProperties": false
}
getThreatActor annotations
{
  "title": "ICS Threat Actor Profile",
  "readOnlyHint": true,
  "openWorldHint": true
}
getActorsBySector — Threat Actors by Industrial Sector
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

All ICS threat actors targeting a specific industrial sector from live MITRE ATT&CK ICS STIX data. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getActorsBySector input schema
{
  "type": "object",
  "required": [
    "sector"
  ],
  "properties": {
    "sector": {
      "type": "string",
      "description": "Sector e.g. energy, water, manufacturing, oil-and-gas, chemical, nuclear"
    }
  },
  "additionalProperties": false
}
getActorsBySector annotations
{
  "title": "Threat Actors by Industrial Sector",
  "readOnlyHint": true,
  "openWorldHint": true
}
getIocEnrichment — IOC Enrichment with OT Campaign Context
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

IOC enrichment via AlienVault OTX and AbuseIPDB. Returns verdict on whether the IOC is linked to ICS-targeting campaigns. Price: $0.01 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getIocEnrichment input schema
{
  "type": "object",
  "required": [
    "value",
    "type"
  ],
  "properties": {
    "type": {
      "enum": [
        "ip",
        "domain"
      ],
      "type": "string",
      "description": "IOC type: ip or domain"
    },
    "value": {
      "type": "string",
      "description": "IP address or domain"
    }
  },
  "additionalProperties": false
}
getIocEnrichment annotations
{
  "title": "IOC Enrichment with OT Campaign Context",
  "readOnlyHint": true,
  "openWorldHint": true
}
getAdvisories — CISA ICS-CERT Advisory Feed
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

CISA ICS advisories by vendor or sector from CISA's full CSAF history (since 2010), newest first. CVSS from the advisory, missing scores from NVD. Returns advisory IDs, CVE scores, vendors, CISA sectors, OT severity and triage links. One of vendor or sector is required. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getAdvisories input schema
{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "default": 10,
      "maximum": 25,
      "description": "Page size, default 10, max 25"
    },
    "since": {
      "type": "string",
      "format": "date",
      "description": "Only advisories first published on or after this date (YYYY-MM-DD)"
    },
    "sector": {
      "type": "string",
      "description": "Sector filter e.g. energy, water, manufacturing"
    },
    "vendor": {
      "type": "string",
      "description": "Vendor filter e.g. siemens, schneider, rockwell"
    }
  },
  "additionalProperties": false
}
getAdvisories annotations
{
  "title": "CISA ICS-CERT Advisory Feed",
  "readOnlyHint": true,
  "openWorldHint": true
}
getPatchFeasibility — OT Patch Feasibility Assessment
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Full patch feasibility for a CVE in OT/ICS environments. Returns patch availability, OT-safe workarounds, estimated downtime, safe-to-patch-live flag, and risk-vs-disruption score (1-10). Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getPatchFeasibility input schema
{
  "type": "object",
  "required": [
    "id"
  ],
  "properties": {
    "id": {
      "type": "string",
      "description": "CVE identifier e.g. CVE-2021-34527"
    }
  },
  "additionalProperties": false
}
getPatchFeasibility annotations
{
  "title": "OT Patch Feasibility Assessment",
  "readOnlyHint": true,
  "openWorldHint": true
}
getAssetExposure — Asset Risk Score and Escalation Verdict
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Synthesises vendor, model, firmware, sector, and network context into a branchable risk verdict. Returns risk_score (0-100), escalate (boolean), recommended_action, and contributing threat actors. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getAssetExposure input schema
{
  "type": "object",
  "required": [
    "vendor",
    "model",
    "sector",
    "network"
  ],
  "properties": {
    "model": {
      "type": "string",
      "description": "e.g. s7-1500, modicon-m340, controllogix"
    },
    "sector": {
      "type": "string",
      "description": "energy | water | manufacturing | oil-and-gas | chemical | nuclear"
    },
    "vendor": {
      "type": "string",
      "description": "e.g. siemens, schneider, rockwell, ge, honeywell"
    },
    "network": {
      "type": "string",
      "description": "internet-facing | dmz | lan-only | air-gapped"
    },
    "firmware": {
      "type": "string",
      "description": "Firmware version e.g. 2.9.2 — enables firmware-specific CVE matching"
    }
  },
  "additionalProperties": false
}
getAssetExposure annotations
{
  "title": "Asset Risk Score and Escalation Verdict",
  "readOnlyHint": true,
  "openWorldHint": true
}
getCampaigns — Active ICS Campaign Tracker
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Active campaigns targeting a specific industrial sector. Returns campaign name, attributed actor, start date, targeted geography, TTPs in use, and CVEs being exploited. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getCampaigns input schema
{
  "type": "object",
  "required": [
    "sector"
  ],
  "properties": {
    "sector": {
      "type": "string",
      "description": "energy | water | manufacturing | oil-and-gas | electric | nuclear | chemical"
    },
    "status": {
      "enum": [
        "active",
        "all"
      ],
      "type": "string",
      "default": "active",
      "description": "active (default) or all"
    }
  },
  "additionalProperties": false
}
getCampaigns annotations
{
  "title": "Active ICS Campaign Tracker",
  "readOnlyHint": true,
  "openWorldHint": true
}
getSectorDelta — Sector Change Feed
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getSectorDelta input schema
{
  "type": "object",
  "required": [
    "sector"
  ],
  "properties": {
    "days": {
      "type": "integer",
      "default": 7,
      "maximum": 30,
      "description": "Lookback window in days, default 7"
    },
    "sector": {
      "type": "string",
      "description": "Sector to monitor e.g. energy, water, manufacturing"
    }
  },
  "additionalProperties": false
}
getSectorDelta annotations
{
  "title": "Sector Change Feed",
  "readOnlyHint": true,
  "openWorldHint": true
}
getMalwareProfile — ICS Malware Encyclopedia
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted OT protocols, attributed actor, and MITRE ATT&CK for ICS techniques. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getMalwareProfile input schema
{
  "type": "object",
  "required": [
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Malware name e.g. PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE"
    }
  },
  "additionalProperties": false
}
getMalwareProfile annotations
{
  "title": "ICS Malware Encyclopedia",
  "readOnlyHint": true,
  "openWorldHint": true
}
getSectorBrief — Sector Threat Brief
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/decreasing), and top 3 recommended actions. One call replaces 5+ chained calls. Price: $0.10 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getSectorBrief input schema
{
  "type": "object",
  "required": [
    "sector"
  ],
  "properties": {
    "period": {
      "type": "integer",
      "default": 30,
      "description": "Reporting period in days, default 30"
    },
    "sector": {
      "type": "string",
      "description": "Sector e.g. energy, water, manufacturing, oil-and-gas, nuclear"
    }
  },
  "additionalProperties": false
}
getSectorBrief annotations
{
  "title": "Sector Threat Brief",
  "readOnlyHint": true,
  "openWorldHint": true
}
getAsnProfile — ICS Threat Actor ASN Infrastructure Profiling
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, NakedPages), bulletproof hosting indicators, abuse categories (c2, staging, phishing), and an OT-specific blocking recommendation with WAF rule hint. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getAsnProfile input schema
{
  "type": "object",
  "required": [
    "asn"
  ],
  "properties": {
    "asn": {
      "type": "string",
      "description": "ASN identifier e.g. AS215540, AS9009, AS29802"
    },
    "org": {
      "type": "string",
      "description": "Optional org name fragment e.g. hivelocity, m247"
    }
  },
  "additionalProperties": false
}
getAsnProfile annotations
{
  "title": "ICS Threat Actor ASN Infrastructure Profiling",
  "readOnlyHint": true,
  "openWorldHint": true
}
getDetectionArtifacts — ICS Detection Artifact Retrieval
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Returns YARA/Sigma detection rules for an ICS malware family or threat actor. Rules sourced from public corpus (Florian Roth signature-base, CISA advisories) are marked validated:true and safe for staging. DeepSeek-synthesised rules carry validated:false and require lab testing. Designed for automated threat hunting pipelines that commit rules to SIEMs and EDRs. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getDetectionArtifacts input schema
{
  "type": "object",
  "required": [
    "target"
  ],
  "properties": {
    "format": {
      "enum": [
        "yara",
        "sigma",
        "snort",
        "all"
      ],
      "type": "string",
      "default": "all",
      "description": "Rule format filter (default: all)"
    },
    "target": {
      "type": "string",
      "description": "Malware or actor name e.g. PIPEDREAM, INDUSTROYER2, TRITON, SANDWORM, CHERNOVITE"
    }
  },
  "additionalProperties": false
}
getDetectionArtifacts annotations
{
  "title": "ICS Detection Artifact Retrieval",
  "readOnlyHint": true,
  "openWorldHint": true
}
getComplianceMapping — Multi-Framework Compliance Gap Mapping
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Returns triggered compliance controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, and UAE NESA IA. Deterministic table lookup — LLM only adds compensating control prose. Designed for automated compliance reporting agents: call when a new advisory drops, generate gap report, route to compliance team. Price: $0.04 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getComplianceMapping input schema
{
  "type": "object",
  "properties": {
    "actor": {
      "type": "string",
      "description": "Threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"
    },
    "cve_id": {
      "type": "string",
      "description": "CVE identifier e.g. CVE-2023-38802"
    },
    "framework": {
      "enum": [
        "nerc_cip",
        "iec_62443_2_1",
        "iec_62443_2_4",
        "iec_62443_3_2",
        "iec_62443_3_3",
        "iec_62443_4_2",
        "nist_800_82",
        "nist_csf",
        "cisa_cpg",
        "nca_otcc",
        "uae_nesa_ia",
        "all"
      ],
      "type": "string",
      "default": "all",
      "description": "Optional filter to one compliance framework. Omit or pass 'all' to return matches across every framework."
    }
  },
  "additionalProperties": false
}
getComplianceMapping annotations
{
  "title": "Multi-Framework Compliance Gap Mapping",
  "readOnlyHint": true,
  "openWorldHint": true
}
getComplianceBatch — Aggregate Compliance Gap Assessment
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Rolls up compliance-gap mapping across multiple CVEs/threat actors in a single call. Deterministic per-item table lookup against the same compliance_mappings data as /ot/compliance, deduplicated and rolled up into one aggregate severity rating. LLM only writes the remediation summary prose. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getComplianceBatch input schema
{
  "type": "object",
  "required": [
    "items"
  ],
  "properties": {
    "items": {
      "type": "string",
      "description": "Comma-separated CVE IDs and/or actor names, max 25, e.g. CVE-2023-38802,CVE-2024-12345,SANDWORM,XENOTIME. Each token auto-detected as a CVE ID or treated as an actor name."
    },
    "framework": {
      "enum": [
        "nerc_cip",
        "iec_62443_2_1",
        "iec_62443_2_4",
        "iec_62443_3_2",
        "iec_62443_3_3",
        "iec_62443_4_2",
        "nist_800_82",
        "nist_csf",
        "cisa_cpg",
        "nca_otcc",
        "uae_nesa_ia",
        "all"
      ],
      "type": "string",
      "default": "all",
      "description": "Optional filter to one compliance framework."
    },
    "entity_sector": {
      "enum": [
        "ENERGY",
        "WATER",
        "TRANSPORTATION",
        "GOVERNMENT"
      ],
      "type": "string",
      "description": "Informs the remediation summary's tone/priority framing only — does not filter which controls match."
    }
  },
  "additionalProperties": false
}
getComplianceBatch annotations
{
  "title": "Aggregate Compliance Gap Assessment",
  "readOnlyHint": true,
  "openWorldHint": true
}
getThreatScore — Actor-Target Threat Score (Capability x Opportunity x Intent)
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus GDELT geopolitical tension and OFAC sanctions pressure. Not LLM-generated. Price: $0.04 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getThreatScore input schema
{
  "type": "object",
  "required": [
    "actor",
    "sector",
    "region",
    "vendor_stack"
  ],
  "properties": {
    "actor": {
      "type": "string",
      "description": "ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"
    },
    "region": {
      "type": "string",
      "description": "Target region or country e.g. Europe, GCC, Ukraine"
    },
    "sector": {
      "type": "string",
      "description": "Target sector e.g. energy, water, manufacturing"
    },
    "vendor_stack": {
      "type": "string",
      "description": "Comma-separated OT/ICS vendors in the target environment e.g. Siemens,Schneider Electric. Pass 'none' if unknown."
    }
  },
  "additionalProperties": false
}
getThreatScore annotations
{
  "title": "Actor-Target Threat Score (Capability x Opportunity x Intent)",
  "readOnlyHint": true,
  "openWorldHint": true
}
getPrecursorTtp — Precursor / Dwell-Time TTP Breakdown
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact). Deterministic tactic-taxonomy lookup against intel.db — no LLM in the classification path. Price: $0.04 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getPrecursorTtp input schema
{
  "type": "object",
  "required": [
    "actor"
  ],
  "properties": {
    "actor": {
      "type": "string",
      "description": "ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"
    }
  },
  "additionalProperties": false
}
getPrecursorTtp annotations
{
  "title": "Precursor / Dwell-Time TTP Breakdown",
  "readOnlyHint": true,
  "openWorldHint": true
}
getRootCauseLocalization — Statistical Anomaly Attribution
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Ranks which sensors most likely drove a reported anomaly by z-score deviation from each sensor's own baseline, given a caller-supplied telemetry window. Fully deterministic, no LLM, no trained model. Statistical approximation inspired by Oswal et al. 2025 (kernel SHAP + TCAE) — not a SHAP/TCAE reimplementation. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getRootCauseLocalization input schema
{
  "type": "object",
  "required": [
    "window"
  ],
  "properties": {
    "top_k": {
      "type": "integer",
      "default": 5,
      "description": "How many ranked sensors to return"
    },
    "window": {
      "type": "string",
      "description": "URL-encoded JSON array, max 20 entries: [{sensor_id, values[], baseline_mean?, baseline_stddev?}]"
    },
    "anomaly_event_id": {
      "type": "string",
      "description": "Optional correlation ID, echoed back unchanged"
    }
  },
  "additionalProperties": false
}
getRootCauseLocalization annotations
{
  "title": "Statistical Anomaly Attribution",
  "readOnlyHint": true,
  "openWorldHint": true
}
getThreatHuntControlLoop — Advisory Threat Hunt (Control-Loop Recon / RMM-LOTL)
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Fully deterministic keyword-pattern matching, no LLM. Grounded in CyberAgentX and AgenticCyOps (arXiv 2603.09134). ADVISORY ONLY — never executes containment or any network action. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getThreatHuntControlLoop input schema
{
  "type": "object",
  "properties": {
    "zone": {
      "enum": [
        "OT",
        "IT",
        "DMZ"
      ],
      "type": "string",
      "description": "Asset zone. Any RMM/LOTL match on OT is always scored HIGH."
    },
    "observed_commands": {
      "type": "string",
      "description": "Comma-separated command strings observed. Must not contain literal commas within a command."
    },
    "observed_processes": {
      "type": "string",
      "description": "Comma-separated process/tool names observed. At least one of observed_processes or observed_commands is required."
    }
  },
  "additionalProperties": false
}
getThreatHuntControlLoop annotations
{
  "title": "Advisory Threat Hunt (Control-Loop Recon / RMM-LOTL)",
  "readOnlyHint": true,
  "openWorldHint": true
}
getInvariantReachability — Physical Invariant Check
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out via conservation of mass. Fully deterministic, no LLM, no trained model. Inspired by Barbhaya et al. 2025's physical-invariant residual check — flags inconsistency and direction, does not assert a specific cause. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getInvariantReachability input schema
{
  "type": "object",
  "required": [
    "asset_id",
    "flow_in",
    "flow_out",
    "level_start",
    "level_end",
    "dt_seconds",
    "tank_area"
  ],
  "properties": {
    "flow_in": {
      "type": "number",
      "description": "Metered inflow rate"
    },
    "asset_id": {
      "type": "string",
      "description": "Identifier for the tank/vessel being checked"
    },
    "flow_out": {
      "type": "number",
      "description": "Metered outflow rate"
    },
    "level_end": {
      "type": "number",
      "description": "Level reading at end of interval"
    },
    "tank_area": {
      "type": "number",
      "description": "Cross-sectional area, must be > 0"
    },
    "dt_seconds": {
      "type": "number",
      "description": "Interval duration in seconds, must be > 0"
    },
    "level_start": {
      "type": "number",
      "description": "Level reading at start of interval"
    },
    "noise_floor": {
      "type": "number",
      "default": 0.5,
      "description": "Residual magnitude below which reading is treated as consistent"
    }
  },
  "additionalProperties": false
}
getInvariantReachability annotations
{
  "title": "Physical Invariant Check",
  "readOnlyHint": true,
  "openWorldHint": true
}
getVendorRisk — OT/ICS Third-Party Vendor Risk Assessment
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

OT/ICS supply-chain vendor risk assessment. Returns risk tier, confidence, cited CVEs (KEV/EPSS), threat actors with historical targeting interest, and supply-chain mitigation recommendations. DeepSeek-synthesised, ICD-203 language. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getVendorRisk input schema
{
  "type": "object",
  "required": [
    "vendor"
  ],
  "properties": {
    "vendor": {
      "type": "string",
      "description": "OT/ICS vendor name e.g. Schneider Electric, Siemens, Rockwell Automation"
    },
    "product": {
      "type": "string",
      "description": "Optional product line filter e.g. Modicon, SIMATIC"
    }
  },
  "additionalProperties": false
}
getVendorRisk annotations
{
  "title": "OT/ICS Third-Party Vendor Risk Assessment",
  "readOnlyHint": true,
  "openWorldHint": true
}
getRiskExposure — Board/GRC-Level Portfolio Risk Aggregator
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Aggregates the same deterministic capability x opportunity x intent scoring used by /ot/threat-score across the actors relevant to a sector+region, ranks them, and returns a DeepSeek-written executive summary (BLUF, ICD-203 language). Portfolio-level companion to /ot/threat-score — for vCISO agents and GRC/board-reporting automation. Price: $0.40 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getRiskExposure input schema
{
  "type": "object",
  "required": [
    "sector",
    "region"
  ],
  "properties": {
    "region": {
      "type": "string",
      "description": "Target region e.g. GCC, KSA, UAE, Qatar, Europe"
    },
    "sector": {
      "type": "string",
      "description": "Target sector e.g. energy, water, manufacturing"
    },
    "timeframe": {
      "type": "string",
      "default": "90d",
      "description": "Optional lookback window, default 90d"
    },
    "vendor_stack": {
      "type": "string",
      "description": "Optional comma-separated vendor list e.g. 'Schneider Modicon,Siemens SIMATIC' — feeds each actor's capability score, same as /ot/threat-score"
    },
    "compliance_framework": {
      "type": "string",
      "description": "Optional — framework to note qualitatively in the narrative e.g. NIST_CSF_2_0, IEC_62443_3_2"
    }
  },
  "additionalProperties": false
}
getRiskExposure annotations
{
  "title": "Board/GRC-Level Portfolio Risk Aggregator",
  "readOnlyHint": true,
  "openWorldHint": true
}
getActionConformance — Remediation Action Risk Gate
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector/region context. Built on the same capability x opportunity x intent scoring as /ot/threat-score, with auditable rules layered on top — no LLM in the decision path. auto_approve requires vendor_stack; omitting it caps the verdict at human_review regardless of score. Price: $0.12 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getActionConformance input schema
{
  "type": "object",
  "required": [
    "actor",
    "sector",
    "region",
    "planned_action"
  ],
  "properties": {
    "actor": {
      "type": "string",
      "description": "ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"
    },
    "region": {
      "type": "string",
      "description": "Target region e.g. GCC, KSA, UAE, Europe"
    },
    "sector": {
      "type": "string",
      "description": "Target sector e.g. energy, water, manufacturing"
    },
    "vendor_stack": {
      "type": "string",
      "description": "Comma-separated vendor list e.g. 'Schneider Modicon,Siemens SIMATIC'. REQUIRED for auto_approve to be reachable at all; omitting it caps the verdict at human_review."
    },
    "asset_context": {
      "type": "string",
      "description": "Optional free text, e.g. 'shared_infra:cloudflare' — escalates to human_review when shared cloud/CDN infra is detected"
    },
    "planned_action": {
      "enum": [
        "block_ip",
        "block_domain",
        "quarantine_host",
        "isolate_segment",
        "halt_pipeline",
        "disable_account"
      ],
      "type": "string",
      "description": "The remediation action being gated"
    }
  },
  "additionalProperties": false
}
getActionConformance annotations
{
  "title": "Remediation Action Risk Gate",
  "readOnlyHint": true,
  "openWorldHint": true
}
getAiExposure — AI/Agentic Copilot Attack Surface Lookup
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

AI/agentic copilot exposure lookup for OT/ICS vendors. Returns the vendor's documented AI/agentic copilot, autonomy level (advisory vs agentic — the key risk differentiator), access, and applicable MITRE ATLAS techniques. Hand-verified mapping, ATLAS IDs confirmed against the live atlas.mitre.org matrix. Deterministic, no LLM in the lookup path. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getAiExposure input schema
{
  "type": "object",
  "required": [
    "vendor"
  ],
  "properties": {
    "vendor": {
      "type": "string",
      "description": "OT/ICS vendor name e.g. Siemens, Schneider Electric, Rockwell Automation, ABB, Emerson, Honeywell, Yokogawa, GE Vernova, Omron, Mitsubishi Electric"
    }
  },
  "additionalProperties": false
}
getAiExposure annotations
{
  "title": "AI/Agentic Copilot Attack Surface Lookup",
  "readOnlyHint": true,
  "openWorldHint": true
}
getAiUplift — Attacker AI-Uplift Exposure
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Assesses how much a general-purpose AI agent lowers the skill/time barrier for an attacker to reach a vendor's OT-adjacent footprint. Grounded in a real-world precedent (Dragos, May 2026), not frontier-model governance thresholds. Distinct from /ot/ai-exposure, which covers a vendor's OWN embedded AI copilot. DeepSeek-synthesised, ICD-203 estimative language. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getAiUplift input schema
{
  "type": "object",
  "required": [
    "vendor"
  ],
  "properties": {
    "vendor": {
      "type": "string",
      "description": "OT/ICS vendor name e.g. Schneider Electric, Siemens, Rockwell Automation"
    },
    "product": {
      "type": "string",
      "description": "Optional product line filter e.g. Modicon, SIMATIC"
    },
    "auth_type": {
      "type": "string",
      "description": "single-factor, mfa, or unknown (default)"
    },
    "segmented": {
      "type": "string",
      "description": "true, false, or unknown (default). If all three deployment-context params are unknown, the tier is capped at informational."
    },
    "internet_facing": {
      "type": "string",
      "description": "true, false, or unknown (default)"
    }
  },
  "additionalProperties": false
}
getAiUplift annotations
{
  "title": "Attacker AI-Uplift Exposure",
  "readOnlyHint": true,
  "openWorldHint": true
}
getAiAttackFeasibility — LLM-Generated ICS Attack Feasibility
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Deterministic lookup against one specific empirical study (Cook, Stoica, Shah & Pezaros, ACM Trans. Priv. Sec. 29, 3, Article 31, June 2026) testing whether off-the-shelf general-purpose LLMs can generate working attack code against real PLCs. Only 3 vendors tested (Siemens, Schneider Electric, Rockwell Automation); only Network/Register-Tags techniques ever succeeded (zero for Application Code/Firmware); 1.08% overall end-to-end success rate. Claude models were excluded by the paper's own authors due to stronger safety guardrails. Distinct from /ot/ai-exposure (vendor's own AI copilot) and /ot/ai-uplift (open-ended reconnaissance-uplift synthesis). Deterministic, no LLM in the lookup path. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getAiAttackFeasibility input schema
{
  "type": "object",
  "properties": {
    "vendor": {
      "type": "string",
      "description": "Siemens, Schneider Electric, or Rockwell Automation — only these three were tested in the study."
    },
    "campaign": {
      "type": "string",
      "description": "Industroyer2, Fuxnet, FrostyGoop, INCONTROLLER, Stuxnet, or Triton."
    },
    "technique": {
      "type": "string",
      "description": "MITRE ICS technique name or ID, e.g. 'Brute Force I/O' or T0806. At least one of technique, vendor, or campaign required."
    }
  },
  "additionalProperties": false
}
getAiAttackFeasibility annotations
{
  "title": "LLM-Generated ICS Attack Feasibility",
  "readOnlyHint": true,
  "openWorldHint": true
}
getClaimReliability — CTI Claim Reliability Scoring
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against the paper's three failure modes — spurious correlation, contradictory knowledge, constrained generalization — using intel.db grounding plus DeepSeek synthesis. Returns a reliability score, verdict, corroborating/contradicting evidence, and confidence. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getClaimReliability input schema
{
  "type": "object",
  "required": [
    "claim"
  ],
  "properties": {
    "actor": {
      "type": "string",
      "description": "Optional actor name to ground the claim against intel.db, e.g. SANDWORM."
    },
    "claim": {
      "type": "string",
      "description": "The CTI claim to assess, e.g. an actor-targeting, attribution, or TTP claim."
    },
    "cve_id": {
      "type": "string",
      "description": "Optional CVE ID to ground the claim against intel.db."
    }
  },
  "additionalProperties": false
}
getClaimReliability annotations
{
  "title": "CTI Claim Reliability Scoring",
  "readOnlyHint": true,
  "openWorldHint": true
}
getStixCoverage — STIX Representability + Actionability Lookup
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Deterministic lookup grounded in Hahn, Krief et al., 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXiv:2512.18714v3, Jan 2026). Returns whether STIX 2.1 can represent a given technique/protocol/CVE's artifacts (full/partial/none) and whether public reporting gave enough technical detail to be actionable for detection engineering. No LLM in the lookup path. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getStixCoverage input schema
{
  "type": "object",
  "properties": {
    "cve_id": {
      "type": "string",
      "description": "CVE ID from the paper's CISA KEV table, e.g. CVE-2023-3595. At least one of technique_id, protocol, or cve_id is required."
    },
    "campaign": {
      "type": "string",
      "description": "Optional filter: Triton, Stuxnet, or Industroyer."
    },
    "protocol": {
      "type": "string",
      "description": "ICS protocol name, e.g. TriStation, S7Comm, CIP. At least one of technique_id, protocol, or cve_id is required."
    },
    "technique_id": {
      "type": "string",
      "description": "MITRE ATT&CK ICS technique ID, e.g. T0836. At least one of technique_id, protocol, or cve_id is required."
    }
  },
  "additionalProperties": false
}
getStixCoverage annotations
{
  "title": "STIX Representability + Actionability Lookup",
  "readOnlyHint": true,
  "openWorldHint": true
}
getMitigationMap — D3FEND-Mapped Mitigation Guidance
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Prescriptive D3FEND-mapped mitigation guidance for OT/ICS threats. Pass one of actor, cve_id, or technique_id, optionally with vendor_stack. Returns matched ATT&CK ICS techniques mapped to D3FEND defensive countermeasures with priority and rationale, plus prescriptive architecture recommendations. DeepSeek-synthesised, ICD-203 estimative language. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getMitigationMap input schema
{
  "type": "object",
  "properties": {
    "actor": {
      "type": "string",
      "description": "Threat actor name e.g. SANDWORM. At least one of actor, cve_id, or technique_id is required."
    },
    "cve_id": {
      "type": "string",
      "description": "CVE identifier. At least one of actor, cve_id, or technique_id is required."
    },
    "technique_id": {
      "type": "string",
      "description": "MITRE ATT&CK ICS technique ID e.g. T0836. At least one of actor, cve_id, or technique_id is required."
    },
    "vendor_stack": {
      "type": "string",
      "description": "Optional vendor/product context e.g. Schneider Modicon"
    }
  },
  "additionalProperties": false
}
getMitigationMap annotations
{
  "title": "D3FEND-Mapped Mitigation Guidance",
  "readOnlyHint": true,
  "openWorldHint": true
}
getActorReport — Full Threat Actor Report (Markdown)
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Synthesised Markdown threat report for an ICS/APT actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/advisory, /ot/detection internally (no extra charge) and synthesises via DeepSeek. Returns executive summary, actor profile, active campaigns, malware families, sector targeting, ATT&CK mappings, recommended actions. TLP: WHITE. Price: $0.25 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getActorReport input schema
{
  "type": "object",
  "required": [
    "actor"
  ],
  "properties": {
    "actor": {
      "type": "string",
      "description": "Actor name e.g. CHERNOVITE, SANDWORM, VOLTZITE, XENOTIME"
    },
    "sector": {
      "type": "string",
      "description": "Optional sector focus e.g. energy, water, manufacturing"
    }
  },
  "additionalProperties": false
}
getActorReport annotations
{
  "title": "Full Threat Actor Report (Markdown)",
  "readOnlyHint": true,
  "openWorldHint": true
}
getActorDossier — Deep Actor Dossier
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Comprehensive intelligence dossier for an ICS threat actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/ioc, /ot/asn, /ot/detection. Returns full profile, infrastructure analysis, IOC table, detection rules, kill chain mapping, and MITRE ATT&CK coverage. Price: $0.35 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getActorDossier input schema
{
  "type": "object",
  "required": [
    "actor"
  ],
  "properties": {
    "actor": {
      "type": "string",
      "description": "Actor name e.g. SANDWORM, XENOTIME, VOLTZITE"
    }
  },
  "additionalProperties": false
}
getActorDossier annotations
{
  "title": "Deep Actor Dossier",
  "readOnlyHint": true,
  "openWorldHint": true
}
getSectorSitrep — Sector Situation Report
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

30-day situation report for an industrial sector. Fans out to /ot/actor/sector, /ot/advisory, /ot/campaign, /ot/delta, /ot/compliance. Returns threat landscape, top active actors, new advisories, what changed, compliance posture impact, and weekly recommended priorities. Price: $0.35 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getSectorSitrep input schema
{
  "type": "object",
  "required": [
    "sector"
  ],
  "properties": {
    "period": {
      "type": "integer",
      "default": 30,
      "description": "Lookback days, default 30"
    },
    "sector": {
      "type": "string",
      "description": "energy | water | manufacturing | oil-and-gas | electric | nuclear | chemical"
    }
  },
  "additionalProperties": false
}
getSectorSitrep annotations
{
  "title": "Sector Situation Report",
  "readOnlyHint": true,
  "openWorldHint": true
}
getCtiArticle — CTI Article (Publication-Ready)
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Publication-ready threat intelligence article (~700 words). Fans out to /ot/actor or /ot/cve + /ot/campaign + /ot/malware + /ot/advisory. DeepSeek writes in journalistic CTI style with headline, lede, body, defanged IOCs, and TLP marking. Suitable for threat intel blog posts or advisories. Price: $0.45 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getCtiArticle input schema
{
  "type": "object",
  "properties": {
    "cve": {
      "type": "string",
      "description": "CVE ID e.g. CVE-2024-12345 (required if no actor)"
    },
    "actor": {
      "type": "string",
      "description": "Actor name e.g. CHERNOVITE (required if no cve)"
    },
    "sector": {
      "type": "string",
      "description": "Optional sector context"
    }
  },
  "additionalProperties": false
}
getCtiArticle annotations
{
  "title": "CTI Article (Publication-Ready)",
  "readOnlyHint": true,
  "openWorldHint": true
}
getLinkedinPost — LinkedIn Post for CTI/ICS Audience
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

LinkedIn post for a CTI/ICS security audience. Fans out to /ot/actor or /ot/cve + /ot/advisory. Returns hook line, 3-5 intelligence bullet observations, call to action, and hashtags. Ready to publish. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getLinkedinPost input schema
{
  "type": "object",
  "properties": {
    "cve": {
      "type": "string",
      "description": "CVE ID (required if no actor)"
    },
    "actor": {
      "type": "string",
      "description": "Actor name e.g. VOLTZITE (required if no cve)"
    }
  },
  "additionalProperties": false
}
getLinkedinPost annotations
{
  "title": "LinkedIn Post for CTI/ICS Audience",
  "readOnlyHint": true,
  "openWorldHint": true
}
getXThread — X/Twitter Thread (5-7 Posts)
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

X/Twitter thread for an actor or CVE. Fans out to /ot/actor or /ot/cve. Returns 5-7 posts: hook, intel posts with ATT&CK IDs and affected systems, mitigation post, and hashtag post. Each post under 280 characters. Price: $0.10 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getXThread input schema
{
  "type": "object",
  "properties": {
    "cve": {
      "type": "string",
      "description": "CVE ID (required if no actor)"
    },
    "actor": {
      "type": "string",
      "description": "Actor name e.g. XENOTIME (required if no cve)"
    }
  },
  "additionalProperties": false
}
getXThread annotations
{
  "title": "X/Twitter Thread (5-7 Posts)",
  "readOnlyHint": true,
  "openWorldHint": true
}
getAnalystBrief — Analyst Brief (BLUF)
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Human-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector. Same fan-out data as /ot/report but synthesised into a short decision-ready brief instead of a full report. Price: $0.12 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getAnalystBrief input schema
{
  "type": "object",
  "required": [
    "actor"
  ],
  "properties": {
    "actor": {
      "type": "string",
      "description": "ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"
    },
    "sector": {
      "type": "string",
      "description": "Optional target sector e.g. energy, water, manufacturing"
    }
  },
  "additionalProperties": false
}
getAnalystBrief annotations
{
  "title": "Analyst Brief (BLUF)",
  "readOnlyHint": true,
  "openWorldHint": true
}
getVendorRiskDelta — Vendor-Swap Risk Comparison
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Counterfactual vendor-swap risk comparison. Runs the same assessment used by /ot/vendor-risk on each vendor and returns the risk-tier delta plus per-vendor summaries, for pre-purchase or migration decisions. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getVendorRiskDelta input schema
{
  "type": "object",
  "required": [
    "vendor_current",
    "vendor_proposed"
  ],
  "properties": {
    "vendor_current": {
      "type": "string",
      "description": "Current OT/ICS vendor name e.g. Siemens"
    },
    "product_current": {
      "type": "string",
      "description": "Optional current product line e.g. SIMATIC"
    },
    "vendor_proposed": {
      "type": "string",
      "description": "Proposed replacement vendor name e.g. Schneider Electric"
    },
    "product_proposed": {
      "type": "string",
      "description": "Optional proposed product line e.g. Modicon"
    }
  },
  "additionalProperties": false
}
getVendorRiskDelta annotations
{
  "title": "Vendor-Swap Risk Comparison",
  "readOnlyHint": true,
  "openWorldHint": true
}
submitSighting — Submit OT Sighting
Advertised by the server during the last successful anonymous check.
Open-world

Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment. Feeds the correlation corpus without storing an org identifier. Written to a separate sightings store, not intel.db. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

submitSighting input schema
{
  "type": "object",
  "required": [
    "ioc_or_ttp_id",
    "sector",
    "region"
  ],
  "properties": {
    "region": {
      "type": "string",
      "description": "Region where this was observed e.g. KSA, UAE"
    },
    "sector": {
      "type": "string",
      "description": "Sector where this was observed e.g. energy, water"
    },
    "actor_name": {
      "type": "string",
      "description": "Optional actor name if the sighting is attributed"
    },
    "observed_at": {
      "type": "string",
      "description": "Optional ISO 8601 timestamp of observation"
    },
    "ioc_or_ttp_id": {
      "type": "string",
      "description": "CVE ID, MITRE ATT&CK-for-ICS technique ID, or sha256 hash"
    }
  },
  "additionalProperties": false
}
submitSighting annotations
{
  "title": "Submit OT Sighting",
  "readOnlyHint": false,
  "openWorldHint": true
}
getGccBulletin — GCC OT Threat Sitrep (Public Bulletin)
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep. Price: $0.01 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

getGccBulletin input schema
{
  "type": "object",
  "properties": {
    "issue_date": {
      "type": "string",
      "description": "Optional YYYY-MM-DD of a past edition; defaults to latest reviewed edition"
    }
  },
  "additionalProperties": false
}
getGccBulletin annotations
{
  "title": "GCC OT Threat Sitrep (Public Bulletin)",
  "readOnlyHint": true,
  "openWorldHint": true
}

Prompts

Not advertised

No prompt definitions available.

Resources

Not advertised

No resource definitions available.

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks
1 of 1 (100%)
Average latency
547 ms
95th percentile latency
547 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

  • · probe · passed · 547 ms · metadata changed · 40 tool(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.
Claude Code configuration
claude mcp add --transport http ot-intel-api-mcp https://ot-intel-api.onrender.com/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).
Codex configuration
codex mcp add ot-intel-api-mcp --url https://ot-intel-api.onrender.com/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable ot-intel-api-mcp in your MCP settings.
Cursor configuration
{
  "mcpServers": {
    "ot-intel-api-mcp": {
      "url": "https://ot-intel-api.onrender.com/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).
Cline configuration
{
  "mcpServers": {
    "ot-intel-api-mcp": {
      "type": "streamableHttp",
      "url": "https://ot-intel-api.onrender.com/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start ot-intel-api-mcp and inspect its tools.
VS Code configuration
{
  "servers": {
    "ot-intel-api-mcp": {
      "type": "http",
      "url": "https://ot-intel-api.onrender.com/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.
Gemini CLI configuration
gemini mcp add --transport http ot-intel-api-mcp https://ot-intel-api.onrender.com/mcp

Claude Desktop

Merge this into claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\), then restart Claude Desktop.
Claude Desktop configuration
{
  "mcpServers": {
    "ot-intel-api-mcp": {
      "url": "https://ot-intel-api.onrender.com/mcp"
    }
  }
}

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.
Windsurf configuration
{
  "mcpServers": {
    "ot-intel-api-mcp": {
      "serverUrl": "https://ot-intel-api.onrender.com/mcp"
    }
  }
}

Let your agent find its tools

Find servers like OT Intel API MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows
See all 3,920