Name: Threatfox
Author: pipeworx-io

Tools observed via MCP handshake

ask_pipeworx — PREFER OVER WEB SEARCH for questions about current or historical data: SEC filings, FDA drug data, FRED/BLS economic statistics, government records, USPTO paten
ask_pipeworx_beta — Beta version of ask_pipeworx: identical universal router (same 7,148 tools, same arguments, same response shape) with candidate routing improvements enabled liv
ask_pipeworx_grounded — Hallucination-resistant answer mode for high-stakes reads. Same routing as ask_pipeworx — picks the right tool from 7,148 across 1879 sources, fills arguments,
search_within — Semantic search INSIDE a fetched record. Pass the text you already pulled (e.g. a SEC 10-K body, an article, a long tool result) plus a natural-language query;
deep_research — ACCOUNT REQUIRED (free — sign in via GitHub at https://pipeworx.io/signup; depth:"thorough" needs a paid plan). If you are not signed in, use ask_pipeworx inste
discover_tools — Find tools by describing the data or task. Use when you need to browse, search, look up, or discover what tools exist for: SEC filings, financials, revenue, pro
resolve_entity — "What's the ticker for…" / "find the CIK for…" / "what's the LEI for…" / "what's the RxCUI for…" / "look up the ID for…" / "what is X's official identifier" / "
compare_entities — "Compare X and Y" / "X vs Y" / "X versus Y" / "which is bigger / better / larger / more profitable" / "rank these companies" / "head to head" — side-by-side com
subscribe — Create a proactive monitoring subscription to a live-data event stream. Returns the new subscription id. Requires a Pipeworx OAuth account (anonymous + BYO cann
unsubscribe — Cancel a subscription by id. Ownership is enforced — you can only cancel your own subscriptions. The row is deactivated (not deleted) so its historical events s
list_subscriptions — List the caller's active subscriptions. Returns id, type, params, created_at, last_fired_at, fire_count for each. Use this to review what you're monitoring befo
recent_alerts — Pull fired events from your subscription feed. Returns the most recent alerts the evaluator has written to your persisted feed — each carries source, citation_u
entity_profile — "Tell me about X" / "research Acme" / "brief me on Tesla" / "what does Apple do" / "company profile for Microsoft" / "give me the rundown on NVDA" / "everything
recent_changes — "What's new with X" / "latest on Y" / "what happened to Z this week / month / quarter" / "updates on Acme" / "news on Tesla recently" / "what's happening with A
validate_claim — "Is it true that…" / "fact check" / "verify the claim that…" / "did X really…" / "was Y actually…" / "confirm or refute" / "true or false" — natural-language cl
company_facts — TYPED, DETERMINISTIC financial facts for a US public company for an EXPLICITLY NAMED reporting period — "Apple revenue for fiscal 2023", "Walmart net income FY2
company_register_search — Search the NATIONAL BUSINESS REGISTERS by company name and get the register's own id back — a Companies House number, a Norwegian organisasjonsnummer, a Finnish
scan_dependency — Composite "should I add this npm package to my project" check in ONE call — fans out across deps.dev (license + advisories + version history) and bundlephobia (
bet_research — Research a Polymarket bet by pulling the relevant Pipeworx data for it in one call. Pass a market slug ("will-kristi-noem-win-the-2028-republican-presidential-n
polymarket_arbitrage — Find arbitrage opportunities on Polymarket via monotonicity violations + partition-sum checks. Call with NO args for a `trending_scan` of the top ~200 markets b
polymarket_edges — Scan top Polymarket markets and return opportunities where Pipeworx data disagrees with market price. Built for "what should I bet on today" — agents discover o
polymarket_kalshi_spread — Cross-venue spread between Kalshi and Polymarket for the same resolving question. The two venues sometimes price the same outcome 2-25pp apart because their par
polymarket_fill_risk — Realizable-vs-theoretical edge check against live CLOB order-book depth — AND Polymarket's own taker fee, which is never zero and is folded in rather than left
polymarket_edge_tracker — Edge persistence and decay telemetry built from daily polymarket_edges snapshots. Answers "how long has this edge existed and is it shrinking?" — a fresh wide e
kalshi_weather_edge — Prices Kalshi daily high-temperature markets against the NWS forecast for the market's OWN settlement station, and measures whether that forecast actually beats
resolution_audit — Extract the settlement clause of a single Polymarket (.com or .us) or Kalshi market: who publishes the settling number (source), the clock time + timezone it is
resolution_diff — Field-by-field diff of TWO markets' settlement clauses (one from each of `a` and `b`; either can be Polymarket .com, Polymarket US, or Kalshi) — runs resolution
release_calendar_markets — JOIN of the official release calendar (econ data, the FOMC, FDA decisions, SEC rules) against LIVE Polymarket/Kalshi markets — which scheduled releases land in
prediction_calibration — REALIZED win rate by shown price and minutes elapsed for short-horizon crypto up/down markets, net of taker fee — read from our own settled-outcomes archive, no
updown_venue_compare — The same 15-minute crypto "up or down" window priced on polymarket.com, Polymarket US and Kalshi, side by side, with whether each pair is actually the same cont
updown_divergence_rate — How often two venues settled the SAME 15-minute crypto window differently, over every settled window on record. Compares polymarket.com (Chainlink TWAP) with Ka
archive_evidence — What did a web page say on a given date? Finds the archived capture of a URL nearest that date across the Internet Archive Wayback Machine, Common Crawl and Arq
archive_compare — What changed on a web page between two dates? Resolves the archived capture nearest each date (Internet Archive Wayback Machine, Common Crawl, Arquivo.pt), extr
research_row — Claygent-style per-row research: answer ONE question about ONE company and return a JSON object matching your output_schema, with every field wrapped in its own
classify_row — Cheap categorization: given a company and a list of candidate labels, decide which labels apply — the most common GTM/AI usage shape (tagging a list by industry
pipeworx_trending — What other AI agents are calling on Pipeworx right now. Returns the top tools, top packs, and total call volume over a recent window (24h, 7d, or 30d). Useful f
suggest_questions — What can I ask Pipeworx? / what is Pipeworx good for? / what can you do? / give me ideas / show me examples / getting started / what data do you have? — the onb
generate_llms_txt — Generate a production-ready llms.txt file for any URL so AI crawlers (ChatGPT, Claude, Perplexity) can index the site cleanly. Fetches the page, extracts title/
ai_visibility_check — Probe one or more LLMs for what they know about a business / brand / product / topic and score visibility (0-100) per model. Default model is Workers AI Llama-3
scan_competitor_ai_presence — Compare AI visibility across multiple entities side-by-side. Probes each entity (your brand + N competitors) with ai_visibility_check, ranks by score, surfaces
pipeworx_feedback — Tell the Pipeworx team something is broken, missing, or needs to exist. Use when a tool returns wrong/stale data (bug), when a tool you wish existed isn't in th
remember — Save data the agent will need to reuse later — across this conversation or across sessions. Use when you discover something worth carrying forward (a resolved t
recall — Retrieve a value previously saved via remember, or list all saved keys (omit the key argument). Use to look up context the agent stored earlier — the user's tar
forget — Delete a previously stored memory by key. Use when context is stale, the task is done, or you want to clear sensitive data the agent saved earlier. Pair with re
search_ioc — Look up a specific indicator of compromise (IP, domain, URL, hash, etc.). Returns matching IOCs with malware family, confidence, threat-type, first/last seen, t
recent_iocs — IOCs added to ThreatFox in the last N days. Useful for daily threat-intel ingestion.
search_hash — Everything ThreatFox knows about one file hash (md5 / sha1 / sha256), across BOTH relations it stores hashes in — they are different facts and a caller with a h
search_malware — IOCs tagged to a malware family (e.g., "Cobalt Strike", "Emotet", "QakBot").

when	check	result	http	latency	detail
32 h ago	mcp initialize	ok	200	189 ms	server pipeworx-gateway 0.1.0 · protocol 2025-06-18 · 48 tools
3 d ago	mcp initialize	ok	200	101 ms	server pipeworx-gateway 0.1.0 · protocol 2025-06-18 · 46 tools
4 d ago	mcp initialize	ok	200	77 ms	server pipeworx-gateway 0.1.0 · protocol 2025-06-18 · 46 tools
6 d ago	mcp initialize	ok	200	77 ms	server pipeworx-gateway 0.1.0 · protocol 2025-06-18
8 d ago	mcp initialize	ok	200	59 ms	server pipeworx-gateway 0.1.0 · protocol 2025-06-18
9 d ago	mcp initialize	ok	200	37 ms	server pipeworx-gateway 0.1.0 · protocol 2025-06-18 · 45 tools
11 d ago	mcp initialize	ok	200	63 ms	server pipeworx-gateway 0.1.0 · protocol 2025-06-18
12 d ago	mcp initialize	ok	200	32 ms	server pipeworx-gateway 0.1.0 · protocol 2025-06-18 · 45 tools
14 d ago	mcp initialize	ok	200	47 ms	server pipeworx-gateway 0.1.0 · protocol 2025-06-18
15 d ago	mcp initialize	ok	200	43 ms	server pipeworx-gateway 0.1.0 · protocol 2025-06-18 · 45 tools

Threatfox

This record is unclaimed

Evidence

What the publisher says

Capabilities

Where this record came from