{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_64qhuju9arwt","handle":"ot-intel-api","url":"https://wellknown.network/agents/ot-intel-api","links":{"self":"https://wellknown.network/agents/ot-intel-api/record.json","html":"https://wellknown.network/agents/ot-intel-api","markdown":"https://wellknown.network/agents/ot-intel-api/record.md","api":"https://wellknown.network/api/v1/agents/ot-intel-api","status":"https://wellknown.network/api/v1/agents/ot-intel-api/status","claim":"https://wellknown.network/agents/ot-intel-api/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/ot-intel-api/claim.json","badge":"https://wellknown.network/agents/ot-intel-api/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/ot-intel-api/history","tools":"https://wellknown.network/api/v1/agents/ot-intel-api/tools"},"ard":{"identifier":"urn:air:ot-intel-api.onrender.com:server:ot-intel-api","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"OT Intel API","summary":"OT/ICS threat intel for AI agents: 40 tools, pay per call in USDC on Base via x402.","description":"OT/ICS threat intel for AI agents: 40 tools, pay per call in USDC on Base via x402.","publisher":{"name":"No3men60","url":null},"homepage":"https://ot-intel-api.onrender.com/SKILL.md","repository":null,"version":"2.0.0","license":null,"protocols":["mcp"],"tags":[],"pricing":null,"endpoints":[{"url":"https://ot-intel-api.onrender.com/mcp","type":"mcp_streamable_http","auth":null,"probeable":true}],"skills":null,"tools":null,"extra":{"updatedAt":"2026-10-20T17:30:47.452733Z","publishedAt":"2026-10-20T17:30:47.452733Z","registryName":"io.github.No3men60/ot-intel-api"},"attribution":{"kind":"mcp_registry","name":"mcp_registry","summary":"mcp_registry","version":"mcp_registry","description":"mcp_registry","homepageUrl":"mcp_registry","publisherName":"mcp_registry"}},"derived":{"capabilities":[{"slug":"content.social","name":"Social Media","confidence":1,"provenance":"derived"},{"slug":"code.security-review","name":"Security Review","confidence":1,"provenance":"derived"},{"slug":"automation.scheduling","name":"Scheduling & Cron","confidence":1,"provenance":"derived"},{"slug":"dev.monitoring","name":"Monitoring & Observability","confidence":0.554,"provenance":"derived"},{"slug":"research.people-companies","name":"People & Company Research","confidence":0.554,"provenance":"derived"},{"slug":"research.web","name":"Deep Web Research","confidence":0.54,"provenance":"derived"},{"slug":"content.marketing","name":"Marketing","confidence":0.525,"provenance":"derived"},{"slug":"dev.ci-cd","name":"CI/CD & Deploy","confidence":0.525,"provenance":"derived"}],"categories":["automation","code","content","dev","research"],"language":"en"},"observed":{"status":"live","statusReason":"Responded 3h ago.","lastOkAt":"2026-10-23T04:27:39.454Z","lastProbedAt":"2026-10-23T04:27:39.454Z","statusComputedAt":"2026-10-23T04:29:46.470Z","reliability30d":{"probes":3,"successRate":1,"p50Ms":279,"basis":"service","measures":{"availability":"availability","latency":"response time","tools":"tool surface observed","summary":"Checks reached the service itself."},"checks":{"total":3,"ok":3,"authBoundaryOk":0,"serviceOk":3,"note":"Counted from the observation rows for the window, checks of the server only (HTTP, A2A card, MCP initialize). ok = authBoundaryOk + serviceOk. `probes` is the sum of daily rollups and includes registry checks, so it can differ from `total`."}},"latestObservations":[{"at":"2026-10-23T04:27:39.454Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":175,"error":null,"detail":{"tools":[{"name":"getCveTriage","description":"CVE lookup enriched for ICS/SCADA environments. Returns OT-adjusted severity, cyber-physical impact, affected ICS layer, compensating controls, patch feasibilit"},{"name":"getDeviceExposure","description":"Exposure data for OT devices by vendor and model. Default credential risk, exposed OT protocols (Modbus/502, S7comm/102, DNP3/20000, PCOM/20256), and hardening "},{"name":"getThreatActor","description":"ICS/APT threat actor profiles grounded in published vendor research. MITRE ATT&CK for ICS techniques, known malware, attribution, physical impact, targeted sect"},{"name":"getActorsBySector","description":"All ICS threat actors targeting a specific industrial sector from live MITRE ATT&CK ICS STIX data. Price: $0.03 USDC per call via x402 on Base mainnet. An unpai"},{"name":"getIocEnrichment","description":"IOC enrichment via AlienVault OTX and AbuseIPDB. Returns verdict on whether the IOC is linked to ICS-targeting campaigns. Price: $0.01 USDC per call via x402 on"},{"name":"getAdvisories","description":"Latest CISA ICS-CERT advisories filtered by vendor or sector. Returns advisory IDs, CVSS scores, CVE lists, OT severity, and direct triage links. Price: $0.02 U"},{"name":"getPatchFeasibility","description":"Full patch feasibility for a CVE in OT/ICS environments. Returns patch availability, OT-safe workarounds, estimated downtime, safe-to-patch-live flag, and risk-"},{"name":"getAssetExposure","description":"Synthesises vendor, model, firmware, sector, and network context into a branchable risk verdict. Returns risk_score (0-100), escalate (boolean), recommended_act"},{"name":"getCampaigns","description":"Active campaigns targeting a specific industrial sector. Returns campaign name, attributed actor, start date, targeted geography, TTPs in use, and CVEs being ex"},{"name":"getSectorDelta","description":"What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes"},{"name":"getMalwareProfile","description":"Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted OT protocols, "},{"name":"getSectorBrief","description":"Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/de"},{"name":"getAsnProfile","description":"Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, Na"},{"name":"getDetectionArtifacts","description":"Returns YARA/Sigma detection rules for an ICS malware family or threat actor. Rules sourced from public corpus (Florian Roth signature-base, CISA advisories) ar"},{"name":"getComplianceMapping","description":"Returns triggered compliance controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA"},{"name":"getComplianceBatch","description":"Rolls up compliance-gap mapping across multiple CVEs/threat actors in a single call. Deterministic per-item table lookup against the same compliance_mappings da"},{"name":"getThreatScore","description":"Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus GDELT geopolitical tension an"},{"name":"getPrecursorTtp","description":"Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disr"},{"name":"getRootCauseLocalization","description":"Ranks which sensors most likely drove a reported anomaly by z-score deviation from each sensor's own baseline, given a caller-supplied telemetry window. Fully d"},{"name":"getThreatHuntControlLoop","description":"Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Fully deterministic keyword-pattern"},{"name":"getInvariantReachability","description":"Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out via conservation of mass. Fully deterministic, "},{"name":"getVendorRisk","description":"OT/ICS supply-chain vendor risk assessment. Returns risk tier, confidence, cited CVEs (KEV/EPSS), threat actors with historical targeting interest, and supply-c"},{"name":"getRiskExposure","description":"Aggregates the same deterministic capability x opportunity x intent scoring used by /ot/threat-score across the actors relevant to a sector+region, ranks them, "},{"name":"getActionConformance","description":"Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector"},{"name":"getAiExposure","description":"AI/agentic copilot exposure lookup for OT/ICS vendors. Returns the vendor's documented AI/agentic copilot, autonomy level (advisory vs agentic — the key risk di"},{"name":"getAiUplift","description":"Assesses how much a general-purpose AI agent lowers the skill/time barrier for an attacker to reach a vendor's OT-adjacent footprint. Grounded in a real-world p"},{"name":"getAiAttackFeasibility","description":"Deterministic lookup against one specific empirical study (Cook, Stoica, Shah & Pezaros, ACM Trans. Priv. Sec. 29, 3, Article 31, June 2026) testing whether off"},{"name":"getClaimReliability","description":"Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against t"},{"name":"getStixCoverage","description":"Deterministic lookup grounded in Hahn, Krief et al., 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXi"},{"name":"getMitigationMap","description":"Prescriptive D3FEND-mapped mitigation guidance for OT/ICS threats. Pass one of actor, cve_id, or technique_id, optionally with vendor_stack. Returns matched ATT"},{"name":"getActorReport","description":"Synthesised Markdown threat report for an ICS/APT actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/advisory, /ot/detection internally (no extra char"},{"name":"getActorDossier","description":"Comprehensive intelligence dossier for an ICS threat actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/ioc, /ot/asn, /ot/detection. Returns full prof"},{"name":"getSectorSitrep","description":"30-day situation report for an industrial sector. Fans out to /ot/actor/sector, /ot/advisory, /ot/campaign, /ot/delta, /ot/compliance. Returns threat landscape,"},{"name":"getCtiArticle","description":"Publication-ready threat intelligence article (~700 words). Fans out to /ot/actor or /ot/cve + /ot/campaign + /ot/malware + /ot/advisory. DeepSeek writes in jou"},{"name":"getLinkedinPost","description":"LinkedIn post for a CTI/ICS security audience. Fans out to /ot/actor or /ot/cve + /ot/advisory. Returns hook line, 3-5 intelligence bullet observations, call to"},{"name":"getXThread","description":"X/Twitter thread for an actor or CVE. Fans out to /ot/actor or /ot/cve. Returns 5-7 posts: hook, intel posts with ATT&CK IDs and affected systems, mitigation po"},{"name":"getAnalystBrief","description":"Human-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector. Same fan-out data as /ot"},{"name":"getVendorRiskDelta","description":"Counterfactual vendor-swap risk comparison. Runs the same assessment used by /ot/vendor-risk on each vendor and returns the risk-tier delta plus per-vendor summ"},{"name":"submitSighting","description":"Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment. Feeds the correlation corpus without storing an org identifier. Written to a "},{"name":"getGccBulletin","description":"Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep. Price: $0.01 USD"}],"toolCount":40,"toolsHash":"f2f9c1594b173d230fc63327712e1a8c12813bcfc82bc051481791ff258d800d","serverName":"ot-intel-api","capabilities":["tools"],"serverVersion":"2.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-22T22:29:07.119Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":574,"error":null,"detail":{"tools":[{"name":"getCveTriage","description":"CVE lookup enriched for ICS/SCADA environments. Returns OT-adjusted severity, cyber-physical impact, affected ICS layer, compensating controls, patch feasibilit"},{"name":"getDeviceExposure","description":"Exposure data for OT devices by vendor and model. Default credential risk, exposed OT protocols (Modbus/502, S7comm/102, DNP3/20000, PCOM/20256), and hardening "},{"name":"getThreatActor","description":"ICS/APT threat actor profiles grounded in published vendor research. MITRE ATT&CK for ICS techniques, known malware, attribution, physical impact, targeted sect"},{"name":"getActorsBySector","description":"All ICS threat actors targeting a specific industrial sector from live MITRE ATT&CK ICS STIX data. Price: $0.03 USDC per call via x402 on Base mainnet. An unpai"},{"name":"getIocEnrichment","description":"IOC enrichment via AlienVault OTX and AbuseIPDB. Returns verdict on whether the IOC is linked to ICS-targeting campaigns. Price: $0.01 USDC per call via x402 on"},{"name":"getAdvisories","description":"Latest CISA ICS-CERT advisories filtered by vendor or sector. Returns advisory IDs, CVSS scores, CVE lists, OT severity, and direct triage links. Price: $0.02 U"},{"name":"getPatchFeasibility","description":"Full patch feasibility for a CVE in OT/ICS environments. Returns patch availability, OT-safe workarounds, estimated downtime, safe-to-patch-live flag, and risk-"},{"name":"getAssetExposure","description":"Synthesises vendor, model, firmware, sector, and network context into a branchable risk verdict. Returns risk_score (0-100), escalate (boolean), recommended_act"},{"name":"getCampaigns","description":"Active campaigns targeting a specific industrial sector. Returns campaign name, attributed actor, start date, targeted geography, TTPs in use, and CVEs being ex"},{"name":"getSectorDelta","description":"What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes"},{"name":"getMalwareProfile","description":"Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted OT protocols, "},{"name":"getSectorBrief","description":"Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/de"},{"name":"getAsnProfile","description":"Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, Na"},{"name":"getDetectionArtifacts","description":"Returns YARA/Sigma detection rules for an ICS malware family or threat actor. Rules sourced from public corpus (Florian Roth signature-base, CISA advisories) ar"},{"name":"getComplianceMapping","description":"Returns triggered compliance controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA"},{"name":"getComplianceBatch","description":"Rolls up compliance-gap mapping across multiple CVEs/threat actors in a single call. Deterministic per-item table lookup against the same compliance_mappings da"},{"name":"getThreatScore","description":"Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus GDELT geopolitical tension an"},{"name":"getPrecursorTtp","description":"Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disr"},{"name":"getRootCauseLocalization","description":"Ranks which sensors most likely drove a reported anomaly by z-score deviation from each sensor's own baseline, given a caller-supplied telemetry window. Fully d"},{"name":"getThreatHuntControlLoop","description":"Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Fully deterministic keyword-pattern"},{"name":"getInvariantReachability","description":"Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out via conservation of mass. Fully deterministic, "},{"name":"getVendorRisk","description":"OT/ICS supply-chain vendor risk assessment. Returns risk tier, confidence, cited CVEs (KEV/EPSS), threat actors with historical targeting interest, and supply-c"},{"name":"getRiskExposure","description":"Aggregates the same deterministic capability x opportunity x intent scoring used by /ot/threat-score across the actors relevant to a sector+region, ranks them, "},{"name":"getActionConformance","description":"Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector"},{"name":"getAiExposure","description":"AI/agentic copilot exposure lookup for OT/ICS vendors. Returns the vendor's documented AI/agentic copilot, autonomy level (advisory vs agentic — the key risk di"},{"name":"getAiUplift","description":"Assesses how much a general-purpose AI agent lowers the skill/time barrier for an attacker to reach a vendor's OT-adjacent footprint. Grounded in a real-world p"},{"name":"getAiAttackFeasibility","description":"Deterministic lookup against one specific empirical study (Cook, Stoica, Shah & Pezaros, ACM Trans. Priv. Sec. 29, 3, Article 31, June 2026) testing whether off"},{"name":"getClaimReliability","description":"Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against t"},{"name":"getStixCoverage","description":"Deterministic lookup grounded in Hahn, Krief et al., 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXi"},{"name":"getMitigationMap","description":"Prescriptive D3FEND-mapped mitigation guidance for OT/ICS threats. Pass one of actor, cve_id, or technique_id, optionally with vendor_stack. Returns matched ATT"},{"name":"getActorReport","description":"Synthesised Markdown threat report for an ICS/APT actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/advisory, /ot/detection internally (no extra char"},{"name":"getActorDossier","description":"Comprehensive intelligence dossier for an ICS threat actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/ioc, /ot/asn, /ot/detection. Returns full prof"},{"name":"getSectorSitrep","description":"30-day situation report for an industrial sector. Fans out to /ot/actor/sector, /ot/advisory, /ot/campaign, /ot/delta, /ot/compliance. Returns threat landscape,"},{"name":"getCtiArticle","description":"Publication-ready threat intelligence article (~700 words). Fans out to /ot/actor or /ot/cve + /ot/campaign + /ot/malware + /ot/advisory. DeepSeek writes in jou"},{"name":"getLinkedinPost","description":"LinkedIn post for a CTI/ICS security audience. Fans out to /ot/actor or /ot/cve + /ot/advisory. Returns hook line, 3-5 intelligence bullet observations, call to"},{"name":"getXThread","description":"X/Twitter thread for an actor or CVE. Fans out to /ot/actor or /ot/cve. Returns 5-7 posts: hook, intel posts with ATT&CK IDs and affected systems, mitigation po"},{"name":"getAnalystBrief","description":"Human-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector. Same fan-out data as /ot"},{"name":"getVendorRiskDelta","description":"Counterfactual vendor-swap risk comparison. Runs the same assessment used by /ot/vendor-risk on each vendor and returns the risk-tier delta plus per-vendor summ"},{"name":"submitSighting","description":"Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment. Feeds the correlation corpus without storing an org identifier. Written to a "},{"name":"getGccBulletin","description":"Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep. Price: $0.01 USD"}],"toolCount":40,"toolsHash":"f2f9c1594b173d230fc63327712e1a8c12813bcfc82bc051481791ff258d800d","serverName":"ot-intel-api","capabilities":["tools"],"serverVersion":"2.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-22T16:31:14.222Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":192,"error":null,"detail":{"tools":[{"name":"getCveTriage","description":"CVE lookup enriched for ICS/SCADA environments. Returns OT-adjusted severity, cyber-physical impact, affected ICS layer, compensating controls, patch feasibilit"},{"name":"getDeviceExposure","description":"Exposure data for OT devices by vendor and model. Default credential risk, exposed OT protocols (Modbus/502, S7comm/102, DNP3/20000, PCOM/20256), and hardening "},{"name":"getThreatActor","description":"ICS/APT threat actor profiles grounded in published vendor research. MITRE ATT&CK for ICS techniques, known malware, attribution, physical impact, targeted sect"},{"name":"getActorsBySector","description":"All ICS threat actors targeting a specific industrial sector from live MITRE ATT&CK ICS STIX data. Price: $0.03 USDC per call via x402 on Base mainnet. An unpai"},{"name":"getIocEnrichment","description":"IOC enrichment via AlienVault OTX and AbuseIPDB. Returns verdict on whether the IOC is linked to ICS-targeting campaigns. Price: $0.01 USDC per call via x402 on"},{"name":"getAdvisories","description":"Latest CISA ICS-CERT advisories filtered by vendor or sector. Returns advisory IDs, CVSS scores, CVE lists, OT severity, and direct triage links. Price: $0.02 U"},{"name":"getPatchFeasibility","description":"Full patch feasibility for a CVE in OT/ICS environments. Returns patch availability, OT-safe workarounds, estimated downtime, safe-to-patch-live flag, and risk-"},{"name":"getAssetExposure","description":"Synthesises vendor, model, firmware, sector, and network context into a branchable risk verdict. Returns risk_score (0-100), escalate (boolean), recommended_act"},{"name":"getCampaigns","description":"Active campaigns targeting a specific industrial sector. Returns campaign name, attributed actor, start date, targeted geography, TTPs in use, and CVEs being ex"},{"name":"getSectorDelta","description":"What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes"},{"name":"getMalwareProfile","description":"Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted OT protocols, "},{"name":"getSectorBrief","description":"Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/de"},{"name":"getAsnProfile","description":"Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, Na"},{"name":"getDetectionArtifacts","description":"Returns YARA/Sigma detection rules for an ICS malware family or threat actor. Rules sourced from public corpus (Florian Roth signature-base, CISA advisories) ar"},{"name":"getComplianceMapping","description":"Returns triggered compliance controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA"},{"name":"getComplianceBatch","description":"Rolls up compliance-gap mapping across multiple CVEs/threat actors in a single call. Deterministic per-item table lookup against the same compliance_mappings da"},{"name":"getThreatScore","description":"Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus GDELT geopolitical tension an"},{"name":"getPrecursorTtp","description":"Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disr"},{"name":"getRootCauseLocalization","description":"Ranks which sensors most likely drove a reported anomaly by z-score deviation from each sensor's own baseline, given a caller-supplied telemetry window. Fully d"},{"name":"getThreatHuntControlLoop","description":"Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Fully deterministic keyword-pattern"},{"name":"getInvariantReachability","description":"Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out via conservation of mass. Fully deterministic, "},{"name":"getVendorRisk","description":"OT/ICS supply-chain vendor risk assessment. Returns risk tier, confidence, cited CVEs (KEV/EPSS), threat actors with historical targeting interest, and supply-c"},{"name":"getRiskExposure","description":"Aggregates the same deterministic capability x opportunity x intent scoring used by /ot/threat-score across the actors relevant to a sector+region, ranks them, "},{"name":"getActionConformance","description":"Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector"},{"name":"getAiExposure","description":"AI/agentic copilot exposure lookup for OT/ICS vendors. Returns the vendor's documented AI/agentic copilot, autonomy level (advisory vs agentic — the key risk di"},{"name":"getAiUplift","description":"Assesses how much a general-purpose AI agent lowers the skill/time barrier for an attacker to reach a vendor's OT-adjacent footprint. Grounded in a real-world p"},{"name":"getAiAttackFeasibility","description":"Deterministic lookup against one specific empirical study (Cook, Stoica, Shah & Pezaros, ACM Trans. Priv. Sec. 29, 3, Article 31, June 2026) testing whether off"},{"name":"getClaimReliability","description":"Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against t"},{"name":"getStixCoverage","description":"Deterministic lookup grounded in Hahn, Krief et al., 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXi"},{"name":"getMitigationMap","description":"Prescriptive D3FEND-mapped mitigation guidance for OT/ICS threats. Pass one of actor, cve_id, or technique_id, optionally with vendor_stack. Returns matched ATT"},{"name":"getActorReport","description":"Synthesised Markdown threat report for an ICS/APT actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/advisory, /ot/detection internally (no extra char"},{"name":"getActorDossier","description":"Comprehensive intelligence dossier for an ICS threat actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/ioc, /ot/asn, /ot/detection. Returns full prof"},{"name":"getSectorSitrep","description":"30-day situation report for an industrial sector. Fans out to /ot/actor/sector, /ot/advisory, /ot/campaign, /ot/delta, /ot/compliance. Returns threat landscape,"},{"name":"getCtiArticle","description":"Publication-ready threat intelligence article (~700 words). Fans out to /ot/actor or /ot/cve + /ot/campaign + /ot/malware + /ot/advisory. DeepSeek writes in jou"},{"name":"getLinkedinPost","description":"LinkedIn post for a CTI/ICS security audience. Fans out to /ot/actor or /ot/cve + /ot/advisory. Returns hook line, 3-5 intelligence bullet observations, call to"},{"name":"getXThread","description":"X/Twitter thread for an actor or CVE. Fans out to /ot/actor or /ot/cve. Returns 5-7 posts: hook, intel posts with ATT&CK IDs and affected systems, mitigation po"},{"name":"getAnalystBrief","description":"Human-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector. Same fan-out data as /ot"},{"name":"getVendorRiskDelta","description":"Counterfactual vendor-swap risk comparison. Runs the same assessment used by /ot/vendor-risk on each vendor and returns the risk-tier delta plus per-vendor summ"},{"name":"submitSighting","description":"Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment. Feeds the correlation corpus without storing an org identifier. Written to a "},{"name":"getGccBulletin","description":"Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep. Price: $0.01 USD"}],"toolCount":40,"toolsHash":"f2f9c1594b173d230fc63327712e1a8c12813bcfc82bc051481791ff258d800d","serverName":"ot-intel-api","capabilities":["tools"],"serverVersion":"2.0.0","protocolVersion":"2025-06-18"}}],"tools":[{"name":"getCveTriage","description":"CVE lookup enriched for ICS/SCADA environments. Returns OT-adjusted severity, cyber-physical impact, affected ICS layer, compensating controls, patch feasibilit"},{"name":"getDeviceExposure","description":"Exposure data for OT devices by vendor and model. Default credential risk, exposed OT protocols (Modbus/502, S7comm/102, DNP3/20000, PCOM/20256), and hardening "},{"name":"getThreatActor","description":"ICS/APT threat actor profiles grounded in published vendor research. MITRE ATT&CK for ICS techniques, known malware, attribution, physical impact, targeted sect"},{"name":"getActorsBySector","description":"All ICS threat actors targeting a specific industrial sector from live MITRE ATT&CK ICS STIX data. Price: $0.03 USDC per call via x402 on Base mainnet. An unpai"},{"name":"getIocEnrichment","description":"IOC enrichment via AlienVault OTX and AbuseIPDB. Returns verdict on whether the IOC is linked to ICS-targeting campaigns. Price: $0.01 USDC per call via x402 on"},{"name":"getAdvisories","description":"Latest CISA ICS-CERT advisories filtered by vendor or sector. Returns advisory IDs, CVSS scores, CVE lists, OT severity, and direct triage links. Price: $0.02 U"},{"name":"getPatchFeasibility","description":"Full patch feasibility for a CVE in OT/ICS environments. Returns patch availability, OT-safe workarounds, estimated downtime, safe-to-patch-live flag, and risk-"},{"name":"getAssetExposure","description":"Synthesises vendor, model, firmware, sector, and network context into a branchable risk verdict. Returns risk_score (0-100), escalate (boolean), recommended_act"},{"name":"getCampaigns","description":"Active campaigns targeting a specific industrial sector. Returns campaign name, attributed actor, start date, targeted geography, TTPs in use, and CVEs being ex"},{"name":"getSectorDelta","description":"What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes"},{"name":"getMalwareProfile","description":"Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted OT protocols, "},{"name":"getSectorBrief","description":"Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/de"},{"name":"getAsnProfile","description":"Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, Na"},{"name":"getDetectionArtifacts","description":"Returns YARA/Sigma detection rules for an ICS malware family or threat actor. Rules sourced from public corpus (Florian Roth signature-base, CISA advisories) ar"},{"name":"getComplianceMapping","description":"Returns triggered compliance controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA"},{"name":"getComplianceBatch","description":"Rolls up compliance-gap mapping across multiple CVEs/threat actors in a single call. Deterministic per-item table lookup against the same compliance_mappings da"},{"name":"getThreatScore","description":"Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus GDELT geopolitical tension an"},{"name":"getPrecursorTtp","description":"Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disr"},{"name":"getRootCauseLocalization","description":"Ranks which sensors most likely drove a reported anomaly by z-score deviation from each sensor's own baseline, given a caller-supplied telemetry window. Fully d"},{"name":"getThreatHuntControlLoop","description":"Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Fully deterministic keyword-pattern"},{"name":"getInvariantReachability","description":"Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out via conservation of mass. Fully deterministic, "},{"name":"getVendorRisk","description":"OT/ICS supply-chain vendor risk assessment. Returns risk tier, confidence, cited CVEs (KEV/EPSS), threat actors with historical targeting interest, and supply-c"},{"name":"getRiskExposure","description":"Aggregates the same deterministic capability x opportunity x intent scoring used by /ot/threat-score across the actors relevant to a sector+region, ranks them, "},{"name":"getActionConformance","description":"Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector"},{"name":"getAiExposure","description":"AI/agentic copilot exposure lookup for OT/ICS vendors. Returns the vendor's documented AI/agentic copilot, autonomy level (advisory vs agentic — the key risk di"},{"name":"getAiUplift","description":"Assesses how much a general-purpose AI agent lowers the skill/time barrier for an attacker to reach a vendor's OT-adjacent footprint. Grounded in a real-world p"},{"name":"getAiAttackFeasibility","description":"Deterministic lookup against one specific empirical study (Cook, Stoica, Shah & Pezaros, ACM Trans. Priv. Sec. 29, 3, Article 31, June 2026) testing whether off"},{"name":"getClaimReliability","description":"Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against t"},{"name":"getStixCoverage","description":"Deterministic lookup grounded in Hahn, Krief et al., 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXi"},{"name":"getMitigationMap","description":"Prescriptive D3FEND-mapped mitigation guidance for OT/ICS threats. Pass one of actor, cve_id, or technique_id, optionally with vendor_stack. Returns matched ATT"},{"name":"getActorReport","description":"Synthesised Markdown threat report for an ICS/APT actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/advisory, /ot/detection internally (no extra char"},{"name":"getActorDossier","description":"Comprehensive intelligence dossier for an ICS threat actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/ioc, /ot/asn, /ot/detection. Returns full prof"},{"name":"getSectorSitrep","description":"30-day situation report for an industrial sector. Fans out to /ot/actor/sector, /ot/advisory, /ot/campaign, /ot/delta, /ot/compliance. Returns threat landscape,"},{"name":"getCtiArticle","description":"Publication-ready threat intelligence article (~700 words). Fans out to /ot/actor or /ot/cve + /ot/campaign + /ot/malware + /ot/advisory. DeepSeek writes in jou"},{"name":"getLinkedinPost","description":"LinkedIn post for a CTI/ICS security audience. Fans out to /ot/actor or /ot/cve + /ot/advisory. Returns hook line, 3-5 intelligence bullet observations, call to"},{"name":"getXThread","description":"X/Twitter thread for an actor or CVE. Fans out to /ot/actor or /ot/cve. Returns 5-7 posts: hook, intel posts with ATT&CK IDs and affected systems, mitigation po"},{"name":"getAnalystBrief","description":"Human-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector. Same fan-out data as /ot"},{"name":"getVendorRiskDelta","description":"Counterfactual vendor-swap risk comparison. Runs the same assessment used by /ot/vendor-risk on each vendor and returns the risk-tier delta plus per-vendor summ"},{"name":"submitSighting","description":"Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment. Feeds the correlation corpus without storing an org identifier. Written to a "},{"name":"getGccBulletin","description":"Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep. Price: $0.01 USD"}],"package":null,"toolSurface":{"id":"ts_fumpn3hxrezc","endpointId":"ep_2ek32msrmkpx","hash":"f2f9c1594b173d230fc63327712e1a8c12813bcfc82bc051481791ff258d800d","toolCount":40,"serverName":"ot-intel-api","serverVersion":"2.0.0","protocolVersion":"2025-06-18","firstSeenAt":"2026-10-22T16:31:14.225Z","lastSeenAt":"2026-10-23T04:27:39.471Z","observations":3,"toolNames":["getCveTriage","getDeviceExposure","getThreatActor","getActorsBySector","getIocEnrichment","getAdvisories","getPatchFeasibility","getAssetExposure","getCampaigns","getSectorDelta","getMalwareProfile","getSectorBrief","getAsnProfile","getDetectionArtifacts","getComplianceMapping","getComplianceBatch","getThreatScore","getPrecursorTtp","getRootCauseLocalization","getThreatHuntControlLoop","getInvariantReachability","getVendorRisk","getRiskExposure","getActionConformance","getAiExposure","getAiUplift","getAiAttackFeasibility","getClaimReliability","getStixCoverage","getMitigationMap","getActorReport","getActorDossier","getSectorSitrep","getCtiArticle","getLinkedinPost","getXThread","getAnalystBrief","getVendorRiskDelta","submitSighting","getGccBulletin"],"distinctSurfaces":1},"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"mcp_registry","key":"io.github.No3men60/ot-intel-api","url":"https://registry.modelcontextprotocol.io/v0/servers/io.github.No3men60%2Fot-intel-api","firstSeenAt":"2026-10-22T16:20:38.460Z","fetchedAt":"2026-10-22T16:20:38.460Z","normalizedAt":"2026-10-22T16:20:38.460Z"}]},"firstSeenAt":"2026-10-22T16:20:38.460Z","updatedAt":"2026-10-23T04:31:40.321Z"}