Koskamo

Rösti Threat Intel MCP

This official server enables AI assistants to perform read-only threat intelligence operations. It allows users to look up Indicators of Compromise (IOCs), search for threat reports, retrieve YARA rules, and explore MITRE ATT&CK techniques and CVEs directly within their chat interface.

Visit Rösti

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

Rösti Threat Intel MCP logo, by RöstiVendor evidenceStreamable HTTPNo sign-inEndpoint checked 2026-11-07Operated by Rösti
MCP endpoint (Streamable HTTP)
https://mcp.rosti.dev/mcp
Vendor documentation

What its tools do

11 tools, grouped by the hints the server advertises. Hints are self-declared, not verified behavior.

Read-only (11)

11 of 11 have a description · 11 of 11 declare behavior hints · 10 of 10 with parameters document them all

Checks and signals

Each line is separate evidence, not a trust score.

  • Passed Endpoint answered the live check ·
  • Passed Official MCP Registry namespace is tied to rosti.dev ·
  • Passed Endpoint is on the registry namespace domain ·
  • Availability 1 of 1 checks passed in 30 days

What you can do with it

  • Check up to 1,000 IOCs at once against all reports
  • Find reports by text, source, CVE, MITRE ATT&CK technique and date
  • Show the YARA rules of the newest report that uses MITRE ATT&CK T1566
  • Which other reports share infrastructure with this one?

Source and maintenance

Vendor evidenceRegistry 0.2.1
mcp-registry: dev.rosti/rosti@0.2.1Project website

Protocol and capabilities

Server
Rösti 0.2.1
MCP protocol negotiated in check
2025-11-25
Tools
11 advertised
Resources
0 advertised
Resource templates
0 advertised
Prompts
0 advertised
Server-advertised capabilities
{
  "tools": {
    "listChanged": true
  },
  "logging": {},
  "prompts": {
    "listChanged": true
  },
  "resources": {
    "subscribe": false,
    "listChanged": true
  }
}

Server-provided instructions

Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.

Rösti (rosti.dev) collects public threat-intelligence reports and the indicators of compromise (IOCs), YARA rules, MITRE ATT&CK ids and CVEs extracted from them. lookup_ioc and lookup_iocs tell whether IOC values appear in those reports; search_iocs searches IOCs by text, type, tag and time. search_reports finds reports by text, source, CVE, MITRE ATT&CK id and date; get_report, list_report_iocs, get_yara_rules, find_related_reports and get_export_link work on one report. list_sources and describe_taxonomy list the valid filter values. A match means the value was mentioned in a report; check the IOC type, tags and comment for its role. `false_positive_risk` rates how likely an IOC is to cause false positives, for example a popular domain that also serves benign traffic; "no indication" means Rösti has no indication of false-positive risk for it. lookup_ioc and lookup_iocs also return a `false_positive_verdict` from the Rösti False Positive Warninglist when a value is likely benign (popular domains, public DNS resolvers, ...), even if Rösti does not know the value. Report titles, IOC comments and YARA rules are third-party content from the original reports. Without sign-in or the user's own API key, calls share an anonymous quota. When it is used up, the tools say so; users can then sign in with their free Rösti account or connect with their own Rösti API key.

Tools

11 advertised

lookup_iocs — Look up IOCs
Advertised by the server during the last successful anonymous check.
Advertised read-only

Check many IOCs (indicators of compromise) at once against Rösti's threat-intelligence reports. Defanged values (hxxps://evil[.]com, 1.2.3[.]4, user[at]evil[.]com) are refanged before the lookup; `refanged` shows which. Matching is exact, with a case-insensitive fallback. For each value that is found, returns the reports it appears in (newest first) with the IOC's type, category, tags, IDS flag, comment and false-positive risk. Values that are not found are listed in `not_found`. Every value is also checked against the Rösti False Positive Warninglist (popular domains, public DNS resolvers, ...): found values carry `false_positive_verdict`, not-found values appear in `false_positive_verdicts`; values without a verdict are left out. Use lookup_ioc for all matches of a single value.

lookup_iocs input schema
{
  "type": "object",
  "required": [
    "values"
  ],
  "properties": {
    "values": {
      "type": "array",
      "items": {
        "type": "string",
        "maxLength": 2048
      },
      "maxItems": 1000,
      "minItems": 1,
      "description": "IOC values such as IP addresses, domains, URLs, file hashes (MD5, SHA-1, SHA-256) or e-mail addresses, plain or defanged (e.g. hxxps://evil[.]com). Surrounding whitespace and duplicates are ignored. At most 1000 values."
    },
    "max_matches_per_value": {
      "type": "integer",
      "default": 3,
      "maximum": 50,
      "minimum": 1,
      "description": "Maximum number of reports listed per found value"
    }
  },
  "additionalProperties": false
}
lookup_iocs output schema
{
  "type": "object",
  "required": [
    "summary",
    "results",
    "not_found"
  ],
  "properties": {
    "results": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "value",
          "found",
          "match_count",
          "matches"
        ],
        "properties": {
          "found": {
            "type": "boolean"
          },
          "input": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "The value as given, when it was defanged and refanged before the lookup"
          },
          "value": {
            "type": "string",
            "description": "The looked-up value (trimmed, refanged)"
          },
          "matches": {
            "type": "array",
            "items": {
              "type": "object",
              "required": [
                "ioc_id",
                "value",
                "false_positive_risk",
                "report"
              ],
              "properties": {
                "ids": {
                  "anyOf": [
                    {
                      "type": "boolean"
                    },
                    {
                      "type": "null"
                    }
                  ],
                  "default": null,
                  "description": "Whether the IOC is suitable for intrusion detection systems"
                },
                "date": {
                  "anyOf": [
                    {
                      "type": "string"
                    },
                    {
                      "type": "null"
                    }
                  ],
                  "default": null,
                  "description": "Date associated with the IOC"
                },
                "tags": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  },
                  "description": "Tags such as c2 or phishing"
                },
                "type": {
                  "anyOf": [
                    {
                      "type": "string"
                    },
                    {
                      "type": "null"
                    }
                  ],
                  "default": null,
                  "description": "IOC type, e.g. domain, ip-dst, md5, sha256, url"
                },
                "value": {
                  "type": "string",
                  "description": "IOC value as stored in Rösti"
                },
                "ioc_id": {
                  "type": "string"
                },
                "report": {
                  "type": "object",
                  "required": [
                    "id",
                    "title",
                    "url"
                  ],
                  "properties": {
                    "id": {
                      "type": "string",
                      "description": "Rösti report id"
                    },
                    "url": {
                      "type": "string",
                      "description": "URL of the original report"
                    },
                    "date": {
                      "anyOf": [
                        {
                          "type": "string"
                        },
                        {
                          "type": "null"
                        }
                      ],
                      "default": null,
                      "description": "Publication date of the report (YYYY-MM-DD)"
                    },
                    "title": {
                      "type": "string",
                      "description": "Report title (third-party text)"
                    },
                    "rosti_url": {
                      "anyOf": [
                        {
                          "type": "string"
                        },
                        {
                          "type": "null"
                        }
                      ],
                      "default": null,
                      "description": "The report on rosti.dev"
                    }
                  }
                },
                "comment": {
                  "anyOf": [
                    {
                      "type": "string"
                    },
                    {
                      "type": "null"
                    }
                  ],
                  "default": null,
                  "description": "Comment from the report (third-party text)"
                },
                "category": {
                  "anyOf": [
                    {
                      "type": "string"
                    },
                    {
                      "type": "null"
                    }
                  ],
                  "default": null,
                  "description": "IOC category, e.g. network_activity"
                },
                "entity_ref": {
                  "anyOf": [
                    {
                      "type": "string"
                    },
                    {
                      "type": "null"
                    }
                  ],
                  "default": null,
                  "description": "Links IOCs that belong together in the same report, e.g. hashes of one file"
                },
                "false_positive_risk": {
                  "type": "object",
                  "required": [
                    "level",
                    "meaning"
                  ],
                  "properties": {
                    "level": {
                      "anyOf": [
                        {
                          "type": "integer"
                        },
                        {
                          "type": "null"
                        }
                      ],
                      "description": "False-positive risk level from -1 to 5; higher means more likely to cause false positives. null when Rösti has no indication of false-positive risk."
                    },
                    "meaning": {
                      "type": "string",
                      "description": "Meaning of the level (informational, small, moderate, medium, high, very high), or 'no indication' when Rösti has no indication of false-positive risk."
                    },
                    "message": {
                      "anyOf": [
                        {
                          "type": "string"
                        },
                        {
                          "type": "null"
                        }
                      ],
                      "default": null,
                      "description": "Why the risk was assigned, e.g. 'Rank 4738 on Alexa'"
                    }
                  },
                  "description": "How likely the IOC is to cause false positives (e.g. a popular, mostly benign domain)."
                }
              }
            },
            "description": "Matches, newest report first"
          },
          "match_count": {
            "type": "integer",
            "description": "Number of reports the value appears in"
          },
          "matches_omitted": {
            "type": "integer",
            "default": 0,
            "description": "Matches not included because of the max_matches limit"
          },
          "false_positive_verdict": {
            "anyOf": [
              {
                "type": "object",
                "required": [
                  "level",
                  "confidence",
                  "reason"
                ],
                "properties": {
                  "level": {
                    "type": "integer",
                    "description": "Confidence that the value is a false positive, 1 (low) to 5 (certain)"
                  },
                  "reason": {
                    "type": "string",
                    "description": "Why, e.g. 'example.com has rank 168 in the Tranco dataset'"
                  },
                  "confidence": {
                    "type": "string",
                    "description": "low, moderate, medium, high or certain"
                  }
                },
                "description": "Verdict of the Rösti False Positive Warninglist that a value is likely benign,\nbased on sources such as top-domain rankings and public DNS resolvers."
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "Verdict of the Rösti False Positive Warninglist; null when it has none"
          }
        }
      },
      "description": "Values that were found, in request order"
    },
    "summary": {
      "type": "object",
      "required": [
        "searched",
        "found",
        "not_found",
        "matches"
      ],
      "properties": {
        "found": {
          "type": "integer",
          "description": "Values found in at least one report"
        },
        "matches": {
          "type": "integer",
          "description": "Total matching IOCs across all reports"
        },
        "searched": {
          "type": "integer",
          "description": "Distinct values searched"
        },
        "not_found": {
          "type": "integer",
          "description": "Values not found"
        }
      }
    },
    "refanged": {
      "type": "object",
      "description": "Defanged inputs and the value searched for each, e.g. {'evil[.]com': 'evil.com'}",
      "additionalProperties": {
        "type": "string"
      }
    },
    "not_found": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Values that were not found"
    },
    "false_positive_verdicts": {
      "type": "object",
      "description": "Rösti False Positive Warninglist verdicts for values in not_found, by value; values without a verdict are left out. Found values carry theirs in results.",
      "additionalProperties": {
        "type": "object",
        "required": [
          "level",
          "confidence",
          "reason"
        ],
        "properties": {
          "level": {
            "type": "integer",
            "description": "Confidence that the value is a false positive, 1 (low) to 5 (certain)"
          },
          "reason": {
            "type": "string",
            "description": "Why, e.g. 'example.com has rank 168 in the Tranco dataset'"
          },
          "confidence": {
            "type": "string",
            "description": "low, moderate, medium, high or certain"
          }
        },
        "description": "Verdict of the Rösti False Positive Warninglist that a value is likely benign,\nbased on sources such as top-domain rankings and public DNS resolvers."
      }
    }
  }
}
lookup_iocs annotations
{
  "title": "Look up IOCs",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
lookup_ioc — Look up an IOC
Advertised by the server during the last successful anonymous check.
Advertised read-only

Check whether one IOC (indicator of compromise) appears in Rösti's threat-intelligence reports. A defanged value (hxxps://evil[.]com, 1.2.3[.]4) is refanged before the lookup; `input` then shows the value as given. Matching is exact, with a case-insensitive fallback. Returns every report the value appears in (newest first, up to max_matches) with the IOC's type, category, tags, IDS flag, comment and false-positive risk. Also checks the value against the Rösti False Positive Warninglist (popular domains, public DNS resolvers, ...) and returns its verdict in `false_positive_verdict`, also when Rösti does not know the value; null when the warninglist has no verdict.

lookup_ioc input schema
{
  "type": "object",
  "required": [
    "value"
  ],
  "properties": {
    "value": {
      "type": "string",
      "maxLength": 2048,
      "minLength": 1,
      "description": "One IOC value, e.g. an IP address, domain, URL, file hash or e-mail address, plain or defanged (e.g. hxxps://evil[.]com)"
    },
    "max_matches": {
      "type": "integer",
      "default": 20,
      "maximum": 100,
      "minimum": 1,
      "description": "Maximum number of reports listed"
    }
  },
  "additionalProperties": false
}
lookup_ioc output schema
{
  "type": "object",
  "required": [
    "value",
    "found",
    "match_count",
    "matches"
  ],
  "properties": {
    "found": {
      "type": "boolean"
    },
    "input": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "The value as given, when it was defanged and refanged before the lookup"
    },
    "value": {
      "type": "string",
      "description": "The looked-up value (trimmed, refanged)"
    },
    "matches": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "ioc_id",
          "value",
          "false_positive_risk",
          "report"
        ],
        "properties": {
          "ids": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "Whether the IOC is suitable for intrusion detection systems"
          },
          "date": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "Date associated with the IOC"
          },
          "tags": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "Tags such as c2 or phishing"
          },
          "type": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "IOC type, e.g. domain, ip-dst, md5, sha256, url"
          },
          "value": {
            "type": "string",
            "description": "IOC value as stored in Rösti"
          },
          "ioc_id": {
            "type": "string"
          },
          "report": {
            "type": "object",
            "required": [
              "id",
              "title",
              "url"
            ],
            "properties": {
              "id": {
                "type": "string",
                "description": "Rösti report id"
              },
              "url": {
                "type": "string",
                "description": "URL of the original report"
              },
              "date": {
                "anyOf": [
                  {
                    "type": "string"
                  },
                  {
                    "type": "null"
                  }
                ],
                "default": null,
                "description": "Publication date of the report (YYYY-MM-DD)"
              },
              "title": {
                "type": "string",
                "description": "Report title (third-party text)"
              },
              "rosti_url": {
                "anyOf": [
                  {
                    "type": "string"
                  },
                  {
                    "type": "null"
                  }
                ],
                "default": null,
                "description": "The report on rosti.dev"
              }
            }
          },
          "comment": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "Comment from the report (third-party text)"
          },
          "category": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "IOC category, e.g. network_activity"
          },
          "entity_ref": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "Links IOCs that belong together in the same report, e.g. hashes of one file"
          },
          "false_positive_risk": {
            "type": "object",
            "required": [
              "level",
              "meaning"
            ],
            "properties": {
              "level": {
                "anyOf": [
                  {
                    "type": "integer"
                  },
                  {
                    "type": "null"
                  }
                ],
                "description": "False-positive risk level from -1 to 5; higher means more likely to cause false positives. null when Rösti has no indication of false-positive risk."
              },
              "meaning": {
                "type": "string",
                "description": "Meaning of the level (informational, small, moderate, medium, high, very high), or 'no indication' when Rösti has no indication of false-positive risk."
              },
              "message": {
                "anyOf": [
                  {
                    "type": "string"
                  },
                  {
                    "type": "null"
                  }
                ],
                "default": null,
                "description": "Why the risk was assigned, e.g. 'Rank 4738 on Alexa'"
              }
            },
            "description": "How likely the IOC is to cause false positives (e.g. a popular, mostly benign domain)."
          }
        }
      },
      "description": "Matches, newest report first"
    },
    "match_count": {
      "type": "integer",
      "description": "Number of reports the value appears in"
    },
    "matches_omitted": {
      "type": "integer",
      "default": 0,
      "description": "Matches not included because of the max_matches limit"
    },
    "false_positive_verdict": {
      "anyOf": [
        {
          "type": "object",
          "required": [
            "level",
            "confidence",
            "reason"
          ],
          "properties": {
            "level": {
              "type": "integer",
              "description": "Confidence that the value is a false positive, 1 (low) to 5 (certain)"
            },
            "reason": {
              "type": "string",
              "description": "Why, e.g. 'example.com has rank 168 in the Tranco dataset'"
            },
            "confidence": {
              "type": "string",
              "description": "low, moderate, medium, high or certain"
            }
          },
          "description": "Verdict of the Rösti False Positive Warninglist that a value is likely benign,\nbased on sources such as top-domain rankings and public DNS resolvers."
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Verdict of the Rösti False Positive Warninglist; null when it has none"
    }
  }
}
lookup_ioc annotations
{
  "title": "Look up an IOC",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
search_iocs — Search IOCs
Advertised by the server during the last successful anonymous check.
Advertised read-only

Search IOCs across all Rösti reports by text, type, tag, category and creation time. Without filters, lists IOCs from all reports. Each IOC carries its report id (use get_report for the report), type, category, tags, IDS flag, comment and false-positive risk. Use lookup_ioc or lookup_iocs to check whether specific values are known.

search_iocs input schema
{
  "type": "object",
  "properties": {
    "tags": {
      "anyOf": [
        {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^[^,]{1,100}$"
          },
          "maxItems": 50
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "IOC tags, e.g. c2, phishing (see describe_taxonomy)"
    },
    "exact": {
      "type": "boolean",
      "default": false,
      "description": "Require the value or comment to equal the query instead of containing it"
    },
    "limit": {
      "type": "integer",
      "default": 25,
      "maximum": 100,
      "minimum": 1,
      "description": "IOCs per page"
    },
    "query": {
      "anyOf": [
        {
          "type": "string",
          "maxLength": 2048
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Text to find in IOC values or comments, e.g. 'mcrosoft' or 'C2 server'. Defanged values are refanged."
    },
    "since": {
      "anyOf": [
        {
          "type": "string",
          "pattern": "^\\d{4}-\\d{2}-\\d{2}(T\\d{2}:\\d{2}:\\d{2}(Z|[+-]\\d{2}:\\d{2}))?$"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Only IOCs created or updated after this date (YYYY-MM-DD) or timestamp (YYYY-MM-DDTHH:MM:SSZ)"
    },
    "types": {
      "anyOf": [
        {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^[^,]{1,100}$"
          },
          "maxItems": 50
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "IOC types, e.g. domain, ip-dst, sha256 (see describe_taxonomy)"
    },
    "cursor": {
      "anyOf": [
        {
          "type": "string",
          "maxLength": 2048
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "next_cursor from a previous call, to get the next page"
    },
    "categories": {
      "anyOf": [
        {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^[^,]{1,100}$"
          },
          "maxItems": 50
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "IOC categories, e.g. network_activity (see describe_taxonomy)"
    }
  },
  "additionalProperties": false
}
search_iocs output schema
{
  "type": "object",
  "required": [
    "iocs"
  ],
  "properties": {
    "iocs": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "ioc_id",
          "value",
          "false_positive_risk",
          "report_id"
        ],
        "properties": {
          "ids": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "Whether the IOC is suitable for intrusion detection systems"
          },
          "date": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "tags": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "type": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "IOC type, e.g. domain, ip-dst, md5, sha256, url"
          },
          "value": {
            "type": "string"
          },
          "ioc_id": {
            "type": "string"
          },
          "comment": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "Comment from the report (third-party text)"
          },
          "category": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "IOC category, e.g. network_activity"
          },
          "report_id": {
            "type": "string"
          },
          "timestamp": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "When the IOC was created or last updated"
          },
          "entity_ref": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "IOCs with the same entity_ref belong together, e.g. hashes of one file or a domain and its IP address"
          },
          "report_rosti_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "false_positive_risk": {
            "type": "object",
            "required": [
              "level",
              "meaning"
            ],
            "properties": {
              "level": {
                "anyOf": [
                  {
                    "type": "integer"
                  },
                  {
                    "type": "null"
                  }
                ],
                "description": "False-positive risk level from -1 to 5; higher means more likely to cause false positives. null when Rösti has no indication of false-positive risk."
              },
              "meaning": {
                "type": "string",
                "description": "Meaning of the level (informational, small, moderate, medium, high, very high), or 'no indication' when Rösti has no indication of false-positive risk."
              },
              "message": {
                "anyOf": [
                  {
                    "type": "string"
                  },
                  {
                    "type": "null"
                  }
                ],
                "default": null,
                "description": "Why the risk was assigned, e.g. 'Rank 4738 on Alexa'"
              }
            },
            "description": "How likely the IOC is to cause false positives (e.g. a popular, mostly benign domain)."
          }
        },
        "description": "An IOC as listed by search_iocs and list_report_iocs."
      }
    },
    "total": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Total number of matching IOCs"
    },
    "next_cursor": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Pass as cursor to get the next page; null if there are no more"
    }
  }
}
search_iocs annotations
{
  "title": "Search IOCs",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
search_reports — Search reports
Advertised by the server during the last successful anonymous check.
Advertised read-only

Search Rösti's threat-intelligence reports by text, source, CVE, MITRE ATT&CK id and publication date. Returns report summaries: title, date, source, authors, tags, counts of IOCs, YARA rules and MITRE ids, and links to the original report and rosti.dev. Use get_report for the details of one report.

search_reports input schema
{
  "type": "object",
  "properties": {
    "cves": {
      "anyOf": [
        {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^[^,]{1,100}$"
          },
          "maxItems": 50
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Reports referencing any of these CVEs, e.g. CVE-2021-44228"
    },
    "sort": {
      "enum": [
        "newest",
        "oldest",
        "recently_updated",
        "most_iocs",
        "most_yara_rules",
        "most_mitre_ids"
      ],
      "type": "string",
      "default": "newest",
      "description": "Sort order"
    },
    "limit": {
      "type": "integer",
      "default": 10,
      "maximum": 50,
      "minimum": 1,
      "description": "Reports per page"
    },
    "query": {
      "anyOf": [
        {
          "type": "string",
          "maxLength": 200
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Text to find in report titles or authors, e.g. 'lumma'"
    },
    "cursor": {
      "anyOf": [
        {
          "type": "string",
          "maxLength": 2048
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "next_cursor from a previous call, to get the next page"
    },
    "sources": {
      "anyOf": [
        {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^[^,]{1,100}$"
          },
          "maxItems": 50
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Source ids, e.g. asec, crowdstrike (see list_sources)"
    },
    "mitre_ids": {
      "anyOf": [
        {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^[^,]{1,100}$"
          },
          "maxItems": 50
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Reports referencing any of these MITRE ATT&CK ids, e.g. T1566.001"
    },
    "published_after": {
      "anyOf": [
        {
          "type": "string",
          "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Reports published on or after this date (YYYY-MM-DD)"
    },
    "published_before": {
      "anyOf": [
        {
          "type": "string",
          "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Reports published on or before this date (YYYY-MM-DD)"
    }
  },
  "additionalProperties": false
}
search_reports output schema
{
  "type": "object",
  "required": [
    "reports"
  ],
  "properties": {
    "total": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Total number of matching reports"
    },
    "reports": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "id",
          "title",
          "url"
        ],
        "properties": {
          "id": {
            "type": "string",
            "description": "Rösti report id"
          },
          "url": {
            "type": "string",
            "description": "URL of the original report"
          },
          "date": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "Publication date (YYYY-MM-DD)"
          },
          "tags": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "title": {
            "type": "string",
            "description": "Report title (third-party text)"
          },
          "authors": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "ioc_count": {
            "anyOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "rosti_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "The report on rosti.dev"
          },
          "source_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "source_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "last_updated": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "When Rösti last updated the report"
          },
          "mitre_id_count": {
            "anyOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "yara_rule_count": {
            "anyOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          }
        }
      }
    },
    "next_cursor": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Pass as cursor to get the next page; null if there are no more"
    }
  }
}
search_reports annotations
{
  "title": "Search reports",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
get_report — Get a report
Advertised by the server during the last successful anonymous check.
Advertised read-only

Get one Rösti report: metadata, MITRE ATT&CK ids, CVEs, available export formats, and how many of its IOCs there are per type and per tag. Use list_report_iocs for the IOCs themselves and get_yara_rules for its YARA rules.

get_report input schema
{
  "type": "object",
  "required": [
    "report_id"
  ],
  "properties": {
    "report_id": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{1,64}$",
      "description": "Rösti report id, e.g. dq13KaQv"
    }
  },
  "additionalProperties": false
}
get_report output schema
{
  "type": "object",
  "required": [
    "id",
    "title",
    "url"
  ],
  "properties": {
    "id": {
      "type": "string",
      "description": "Rösti report id"
    },
    "url": {
      "type": "string",
      "description": "URL of the original report"
    },
    "cves": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "id"
        ],
        "properties": {
          "id": {
            "type": "string"
          },
          "description": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          }
        }
      },
      "description": "CVEs referenced in the report"
    },
    "date": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Publication date (YYYY-MM-DD)"
    },
    "tags": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "mitre": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "id",
          "description"
        ],
        "properties": {
          "id": {
            "type": "string",
            "description": "MITRE ATT&CK id, e.g. T1003"
          },
          "description": {
            "type": "string"
          },
          "object_type": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "techniques, tactics, groups, software, ..."
          }
        }
      },
      "description": "MITRE ATT&CK ids referenced in the report"
    },
    "title": {
      "type": "string",
      "description": "Report title (third-party text)"
    },
    "authors": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "ioc_tags": {
      "type": "object",
      "description": "Number of IOCs per tag",
      "additionalProperties": {
        "type": "integer"
      }
    },
    "ioc_count": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "ioc_types": {
      "type": "object",
      "description": "Number of IOCs per IOC type",
      "additionalProperties": {
        "type": "integer"
      }
    },
    "rosti_url": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "The report on rosti.dev"
    },
    "source_id": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "source_name": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "last_updated": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "When Rösti last updated the report"
    },
    "export_formats": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "format"
        ],
        "properties": {
          "name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "size": {
            "anyOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "File size in bytes"
          },
          "format": {
            "type": "string",
            "description": "Format id to pass to get_export_link, e.g. csv or misp"
          }
        }
      },
      "description": "Available downloads"
    },
    "mitre_id_count": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "yara_rule_count": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "yara_rules_hidden": {
      "type": "boolean",
      "default": false,
      "description": "True if the report's YARA rules are hidden at the publisher's request"
    },
    "ioc_breakdown_complete": {
      "type": "boolean",
      "default": true,
      "description": "False if ioc_types/ioc_tags were counted from the first 1000 IOCs only"
    }
  }
}
get_report annotations
{
  "title": "Get a report",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
list_report_iocs — List a report's IOCs
Advertised by the server during the last successful anonymous check.
Advertised read-only

List the IOCs of one Rösti report, optionally filtered by type, tag, category or text. IOCs with the same entity_ref belong together, e.g. the MD5, SHA-1 and SHA-256 of one file. Each IOC carries its IDS flag and false-positive risk.

list_report_iocs input schema
{
  "type": "object",
  "required": [
    "report_id"
  ],
  "properties": {
    "tags": {
      "anyOf": [
        {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^[^,]{1,100}$"
          },
          "maxItems": 50
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "IOC tags, e.g. c2, phishing"
    },
    "limit": {
      "type": "integer",
      "default": 50,
      "maximum": 200,
      "minimum": 1,
      "description": "IOCs per page"
    },
    "query": {
      "anyOf": [
        {
          "type": "string",
          "maxLength": 2048
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Text to find in IOC values or comments"
    },
    "types": {
      "anyOf": [
        {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^[^,]{1,100}$"
          },
          "maxItems": 50
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "IOC types, e.g. domain, ip-dst, sha256"
    },
    "cursor": {
      "anyOf": [
        {
          "type": "string",
          "maxLength": 2048
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "next_cursor from a previous call, to get the next page"
    },
    "report_id": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{1,64}$",
      "description": "Rösti report id, e.g. dq13KaQv"
    },
    "categories": {
      "anyOf": [
        {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^[^,]{1,100}$"
          },
          "maxItems": 50
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "IOC categories, e.g. network_activity"
    }
  },
  "additionalProperties": false
}
list_report_iocs output schema
{
  "type": "object",
  "required": [
    "iocs"
  ],
  "properties": {
    "iocs": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "ioc_id",
          "value",
          "false_positive_risk",
          "report_id"
        ],
        "properties": {
          "ids": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "Whether the IOC is suitable for intrusion detection systems"
          },
          "date": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "tags": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "type": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "IOC type, e.g. domain, ip-dst, md5, sha256, url"
          },
          "value": {
            "type": "string"
          },
          "ioc_id": {
            "type": "string"
          },
          "comment": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "Comment from the report (third-party text)"
          },
          "category": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "IOC category, e.g. network_activity"
          },
          "report_id": {
            "type": "string"
          },
          "timestamp": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "When the IOC was created or last updated"
          },
          "entity_ref": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "IOCs with the same entity_ref belong together, e.g. hashes of one file or a domain and its IP address"
          },
          "report_rosti_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "false_positive_risk": {
            "type": "object",
            "required": [
              "level",
              "meaning"
            ],
            "properties": {
              "level": {
                "anyOf": [
                  {
                    "type": "integer"
                  },
                  {
                    "type": "null"
                  }
                ],
                "description": "False-positive risk level from -1 to 5; higher means more likely to cause false positives. null when Rösti has no indication of false-positive risk."
              },
              "meaning": {
                "type": "string",
                "description": "Meaning of the level (informational, small, moderate, medium, high, very high), or 'no indication' when Rösti has no indication of false-positive risk."
              },
              "message": {
                "anyOf": [
                  {
                    "type": "string"
                  },
                  {
                    "type": "null"
                  }
                ],
                "default": null,
                "description": "Why the risk was assigned, e.g. 'Rank 4738 on Alexa'"
              }
            },
            "description": "How likely the IOC is to cause false positives (e.g. a popular, mostly benign domain)."
          }
        },
        "description": "An IOC as listed by search_iocs and list_report_iocs."
      }
    },
    "total": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Total number of matching IOCs"
    },
    "next_cursor": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Pass as cursor to get the next page; null if there are no more"
    }
  }
}
list_report_iocs annotations
{
  "title": "List a report's IOCs",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
get_yara_rules — Get YARA rules
Advertised by the server during the last successful anonymous check.
Advertised read-only

Get the YARA rules published with one Rösti report, with their full source.

get_yara_rules input schema
{
  "type": "object",
  "required": [
    "report_id"
  ],
  "properties": {
    "report_id": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{1,64}$",
      "description": "Rösti report id, e.g. dq13KaQv"
    }
  },
  "additionalProperties": false
}
get_yara_rules output schema
{
  "type": "object",
  "required": [
    "report_id",
    "rules"
  ],
  "properties": {
    "note": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "rules": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "id",
          "name",
          "rule"
        ],
        "properties": {
          "id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "rule": {
            "type": "string",
            "description": "Full YARA rule source"
          },
          "tags": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "filename": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          }
        }
      }
    },
    "hidden": {
      "type": "boolean",
      "default": false,
      "description": "True if the rules are hidden at the publisher's request"
    },
    "report_id": {
      "type": "string"
    }
  }
}
get_yara_rules annotations
{
  "title": "Get YARA rules",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
find_related_reports — Find related reports
Advertised by the server during the last successful anonymous check.
Advertised read-only

Find other Rösti reports that share IOCs with one report, most shared IOCs first, with the shared values.

find_related_reports input schema
{
  "type": "object",
  "required": [
    "report_id"
  ],
  "properties": {
    "limit": {
      "type": "integer",
      "default": 10,
      "maximum": 25,
      "minimum": 1,
      "description": "Maximum number of related reports"
    },
    "report_id": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{1,64}$",
      "description": "Rösti report id, e.g. dq13KaQv"
    }
  },
  "additionalProperties": false
}
find_related_reports output schema
{
  "type": "object",
  "required": [
    "report_id",
    "related",
    "related_total",
    "complete"
  ],
  "properties": {
    "related": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "id",
          "shared_ioc_count",
          "shared_iocs"
        ],
        "properties": {
          "id": {
            "type": "string"
          },
          "url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "URL of the original report"
          },
          "date": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "title": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "Report title (third-party text)"
          },
          "rosti_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "shared_iocs": {
            "type": "array",
            "items": {
              "type": "object",
              "required": [
                "value"
              ],
              "properties": {
                "type": {
                  "anyOf": [
                    {
                      "type": "string"
                    },
                    {
                      "type": "null"
                    }
                  ],
                  "default": null
                },
                "value": {
                  "type": "string"
                }
              }
            },
            "description": "Shared IOC values (at most 10 listed)"
          },
          "source_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "shared_ioc_count": {
            "type": "integer"
          }
        }
      },
      "description": "Most shared IOCs first"
    },
    "complete": {
      "type": "boolean",
      "description": "False if the report has more than 1000 correlations and only the first 1000 were used"
    },
    "report_id": {
      "type": "string"
    },
    "related_total": {
      "type": "integer",
      "description": "Number of related reports found"
    }
  }
}
find_related_reports annotations
{
  "title": "Find related reports",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
get_export_link — Get an export link
Advertised by the server during the last successful anonymous check.
Advertised read-only

Get a download link for one report export, e.g. CSV or MISP. The link is signed and expires after 15 minutes; it is meant to be opened by the user, not downloaded here.

get_export_link input schema
{
  "type": "object",
  "required": [
    "report_id",
    "format"
  ],
  "properties": {
    "format": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_.-]{1,40}$",
      "description": "Export format id, e.g. csv or misp; get_report lists the formats available for a report"
    },
    "report_id": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{1,64}$",
      "description": "Rösti report id, e.g. dq13KaQv"
    }
  },
  "additionalProperties": false
}
get_export_link output schema
{
  "type": "object",
  "required": [
    "report_id",
    "format",
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "description": "Signed download URL"
    },
    "format": {
      "type": "string"
    },
    "report_id": {
      "type": "string"
    },
    "expires_in_minutes": {
      "type": "integer",
      "default": 15
    }
  }
}
get_export_link annotations
{
  "title": "Get an export link",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
list_sources — List sources
Advertised by the server during the last successful anonymous check.
Advertised read-only

List the publishers whose reports Rösti collects (vendor blogs, CERTs, researchers), with report counts, the newest report date and whether the source is still active. Source ids work as the sources filter of search_reports.

list_sources input schema
{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "default": 50,
      "maximum": 200,
      "minimum": 1,
      "description": "Sources per page"
    },
    "query": {
      "anyOf": [
        {
          "type": "string",
          "maxLength": 100
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Text to find in source names, e.g. 'crowdstrike'"
    },
    "cursor": {
      "anyOf": [
        {
          "type": "string",
          "maxLength": 2048
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "next_cursor from a previous call, to get the next page"
    }
  },
  "additionalProperties": false
}
list_sources output schema
{
  "type": "object",
  "required": [
    "sources"
  ],
  "properties": {
    "total": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    },
    "sources": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "id",
          "name"
        ],
        "properties": {
          "id": {
            "type": "string",
            "description": "Source id, usable as source filter in search_reports"
          },
          "url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "name": {
            "type": "string"
          },
          "active": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "report_count": {
            "anyOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "most_recent_report": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null,
            "description": "Date of the newest report"
          },
          "deactivation_reason": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          }
        }
      }
    },
    "next_cursor": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null
    }
  }
}
list_sources annotations
{
  "title": "List sources",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}
describe_taxonomy — Describe the taxonomy
Advertised by the server during the last successful anonymous check.
Advertised read-only

List the values Rösti uses for IOC types, IOC tags (with descriptions), IOC categories and export formats, and explain the false-positive risk scale. Use these values for the filters of the search and list tools.

describe_taxonomy input schema
{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}
describe_taxonomy output schema
{
  "type": "object",
  "required": [
    "ioc_types",
    "ioc_tags",
    "categories",
    "export_formats"
  ],
  "properties": {
    "ioc_tags": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "tag"
        ],
        "properties": {
          "tag": {
            "type": "string"
          },
          "subtags": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "description": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          }
        }
      },
      "description": "Values for IOC tag filters"
    },
    "ioc_types": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Values for IOC type filters"
    },
    "categories": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Values for IOC category filters"
    },
    "export_formats": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "id"
        ],
        "properties": {
          "id": {
            "type": "string",
            "description": "Format id, as used by get_export_link"
          },
          "name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "extension": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          },
          "description": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "default": null
          }
        }
      },
      "description": "Export and feed file formats"
    },
    "false_positive_risk": {
      "type": "string",
      "default": "false_positive_risk rates how likely an IOC is to cause false positives, e.g. a popular domain that also serves benign traffic. level runs from -1 to 5 (higher means more likely to cause false positives) with meanings informational, small, moderate, medium, high and very high. 'no indication' means Rösti has no indication of false-positive risk for the IOC."
    }
  }
}
describe_taxonomy annotations
{
  "title": "Describe the taxonomy",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": false
}

Prompts

0 advertised

No prompt definitions available.

Resources

0 advertised

No resource definitions available.

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks
1 of 1 (100%)
Average latency
1567 ms
95th percentile latency
1567 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

  • · probe · passed · 1567 ms · metadata changed · 11 tool(s), 0 resource(s), 0 resource template(s), 0 prompt(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.
Claude Code configuration
claude mcp add --transport http ro-sti-threat-intel-mcp https://mcp.rosti.dev/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).
Codex configuration
codex mcp add ro-sti-threat-intel-mcp --url https://mcp.rosti.dev/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable ro-sti-threat-intel-mcp in your MCP settings.
Cursor configuration
{
  "mcpServers": {
    "ro-sti-threat-intel-mcp": {
      "url": "https://mcp.rosti.dev/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).
Cline configuration
{
  "mcpServers": {
    "ro-sti-threat-intel-mcp": {
      "type": "streamableHttp",
      "url": "https://mcp.rosti.dev/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start ro-sti-threat-intel-mcp and inspect its tools.
VS Code configuration
{
  "servers": {
    "ro-sti-threat-intel-mcp": {
      "type": "http",
      "url": "https://mcp.rosti.dev/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.
Gemini CLI configuration
gemini mcp add --transport http ro-sti-threat-intel-mcp https://mcp.rosti.dev/mcp

Claude Desktop

Open Claude Settings > Connectors > Add custom connector, enter this server URL and enable it for the conversation. This is a manual remote-connector handoff, not a desktop JSON configuration.
Claude Desktop configuration
https://mcp.rosti.dev/mcp

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.
Windsurf configuration
{
  "mcpServers": {
    "ro-sti-threat-intel-mcp": {
      "serverUrl": "https://mcp.rosti.dev/mcp"
    }
  }
}

Let your agent find its tools

Find servers like Rösti Threat Intel MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows
See all 5,557

Do you run Rösti Threat Intel MCP?

Prove ownership with a DNS record, a well-known file, or your Official MCP Registry entry, and your edits publish immediately. Proofs are re-checked weekly; admins can still hide or remove a listing.

Claim this listing