OT Intel API

Name: OT Intel API
Author: No3men60

MCP serverMCP

OT/ICS threat intel for AI agents: 40 tools, pay per call in USDC on Base via x402.

by No3men60homepage ↗v2.0.0

Is this yours?

This record is unclaimed

Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.

Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"ot-intel-api","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.

Claim this record

Observed by Wellknown

Evidence

Everything here was measured by our prober or read from a registry. Nothing is self-reported.

30-day availability3/3 checks ok

30 days ago

Tools observed via MCP handshake

getCveTriage — CVE lookup enriched for ICS/SCADA environments. Returns OT-adjusted severity, cyber-physical impact, affected ICS layer, compensating controls, patch feasibilit
getDeviceExposure — Exposure data for OT devices by vendor and model. Default credential risk, exposed OT protocols (Modbus/502, S7comm/102, DNP3/20000, PCOM/20256), and hardening
getThreatActor — ICS/APT threat actor profiles grounded in published vendor research. MITRE ATT&CK for ICS techniques, known malware, attribution, physical impact, targeted sect
getActorsBySector — All ICS threat actors targeting a specific industrial sector from live MITRE ATT&CK ICS STIX data. Price: $0.03 USDC per call via x402 on Base mainnet. An unpai
getIocEnrichment — IOC enrichment via AlienVault OTX and AbuseIPDB. Returns verdict on whether the IOC is linked to ICS-targeting campaigns. Price: $0.01 USDC per call via x402 on
getAdvisories — Latest CISA ICS-CERT advisories filtered by vendor or sector. Returns advisory IDs, CVSS scores, CVE lists, OT severity, and direct triage links. Price: $0.02 U
getPatchFeasibility — Full patch feasibility for a CVE in OT/ICS environments. Returns patch availability, OT-safe workarounds, estimated downtime, safe-to-patch-live flag, and risk-
getAssetExposure — Synthesises vendor, model, firmware, sector, and network context into a branchable risk verdict. Returns risk_score (0-100), escalate (boolean), recommended_act
getCampaigns — Active campaigns targeting a specific industrial sector. Returns campaign name, attributed actor, start date, targeted geography, TTPs in use, and CVEs being ex
getSectorDelta — What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes
getMalwareProfile — Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted OT protocols,
getSectorBrief — Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/de
getAsnProfile — Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, Na
getDetectionArtifacts — Returns YARA/Sigma detection rules for an ICS malware family or threat actor. Rules sourced from public corpus (Florian Roth signature-base, CISA advisories) ar
getComplianceMapping — Returns triggered compliance controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA
getComplianceBatch — Rolls up compliance-gap mapping across multiple CVEs/threat actors in a single call. Deterministic per-item table lookup against the same compliance_mappings da
getThreatScore — Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus GDELT geopolitical tension an
getPrecursorTtp — Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disr
getRootCauseLocalization — Ranks which sensors most likely drove a reported anomaly by z-score deviation from each sensor's own baseline, given a caller-supplied telemetry window. Fully d
getThreatHuntControlLoop — Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Fully deterministic keyword-pattern
getInvariantReachability — Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out via conservation of mass. Fully deterministic,
getVendorRisk — OT/ICS supply-chain vendor risk assessment. Returns risk tier, confidence, cited CVEs (KEV/EPSS), threat actors with historical targeting interest, and supply-c
getRiskExposure — Aggregates the same deterministic capability x opportunity x intent scoring used by /ot/threat-score across the actors relevant to a sector+region, ranks them,
getActionConformance — Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector
getAiExposure — AI/agentic copilot exposure lookup for OT/ICS vendors. Returns the vendor's documented AI/agentic copilot, autonomy level (advisory vs agentic — the key risk di
getAiUplift — Assesses how much a general-purpose AI agent lowers the skill/time barrier for an attacker to reach a vendor's OT-adjacent footprint. Grounded in a real-world p
getAiAttackFeasibility — Deterministic lookup against one specific empirical study (Cook, Stoica, Shah & Pezaros, ACM Trans. Priv. Sec. 29, 3, Article 31, June 2026) testing whether off
getClaimReliability — Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against t
getStixCoverage — Deterministic lookup grounded in Hahn, Krief et al., 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXi
getMitigationMap — Prescriptive D3FEND-mapped mitigation guidance for OT/ICS threats. Pass one of actor, cve_id, or technique_id, optionally with vendor_stack. Returns matched ATT
getActorReport — Synthesised Markdown threat report for an ICS/APT actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/advisory, /ot/detection internally (no extra char
getActorDossier — Comprehensive intelligence dossier for an ICS threat actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/ioc, /ot/asn, /ot/detection. Returns full prof
getSectorSitrep — 30-day situation report for an industrial sector. Fans out to /ot/actor/sector, /ot/advisory, /ot/campaign, /ot/delta, /ot/compliance. Returns threat landscape,
getCtiArticle — Publication-ready threat intelligence article (~700 words). Fans out to /ot/actor or /ot/cve + /ot/campaign + /ot/malware + /ot/advisory. DeepSeek writes in jou
getLinkedinPost — LinkedIn post for a CTI/ICS security audience. Fans out to /ot/actor or /ot/cve + /ot/advisory. Returns hook line, 3-5 intelligence bullet observations, call to
getXThread — X/Twitter thread for an actor or CVE. Fans out to /ot/actor or /ot/cve. Returns 5-7 posts: hook, intel posts with ATT&CK IDs and affected systems, mitigation po
getAnalystBrief — Human-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector. Same fan-out data as /ot
getVendorRiskDelta — Counterfactual vendor-swap risk comparison. Runs the same assessment used by /ot/vendor-risk on each vendor and returns the risk-tier delta plus per-vendor summ
submitSighting — Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment. Feeds the correlation corpus without storing an org identifier. Written to a
getGccBulletin — Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep. Price: $0.01 USD

when	check	result	http	latency	detail
2 h ago	mcp initialize	ok	200	175 ms	server ot-intel-api 2.0.0 · protocol 2025-06-18 · 40 tools
8 h ago	mcp initialize	ok	200	574 ms	server ot-intel-api 2.0.0 · protocol 2025-06-18 · 40 tools
14 h ago	mcp initialize	ok	200	192 ms	server ot-intel-api 2.0.0 · protocol 2025-06-18 · 40 tools

OT Intel API

This record is unclaimed

Evidence

What the publisher says

Capabilities

Where this record came from