OT Intel API
REMOTE · OT-INTEL-API.ONRENDER.COM
OT/ICS threat intel for AI agents: 40 tools, pay per call in USDC on Base via x402.
Available components
Last scanned (1 hour ago)
Scores higher than 47% of remote servers
Reachable. Last reached 23 Oct 2026.
Category Security
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 1 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability67
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 7407 tokens (~185/item across 40 items; 40 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management10
- Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 40 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 41 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 22 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 21 Oct 26 0
- Stability: unverified → 0.03 ▲ functional
- 20 Oct 26 63
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 23 Oct 2026 · Probed https://ot-intel-api.onrender.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=onrender.com | CN=WE1,O=Google Trust Services,C=US | 21 Sept 2026 | 20 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | 6eb1e3fe7d0631ea1337bfa4a321c137 |
| SANs: onrender.com, *.onrender.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of ot-intel-api.onrender.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| onrender.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://ot-intel-api.onrender.com/mcp | Verified | 200 | |
| http (plaintext) | http://ot-intel-api.onrender.com/mcp | HTTPS enforced | 301 | https://ot-intel-api.onrender.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
getActionConformance Remediation Action Risk Gate ~308
Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector/region context. Built on the same capability x opportunity x intent scoring as /ot/threat-score, with auditable rules layered on top — no LLM in the decision path. auto_approve requires vendor_stack; omitting it caps the verdict at human_review regardless of score. Price: $0.12 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| actor | string | yes | ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME |
| asset_context | string | – | Optional free text, e.g. 'shared_infra:cloudflare' — escalates to human_review when shared cloud/CDN infra is detected |
| planned_action | string | yes | The remediation action being gated |
| region | string | yes | Target region e.g. GCC, KSA, UAE, Europe |
| sector | string | yes | Target sector e.g. energy, water, manufacturing |
| vendor_stack | string | – | Comma-separated vendor list e.g. 'Schneider Modicon,Siemens SIMATIC'. REQUIRED for auto_approve to be reachable at all; omitting it caps the verdict at human_review. |
No output schema declared.
No examples provided.
getActorDossier Deep Actor Dossier ~149
Comprehensive intelligence dossier for an ICS threat actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/ioc, /ot/asn, /ot/detection. Returns full profile, infrastructure analysis, IOC table, detection rules, kill chain mapping, and MITRE ATT&CK coverage. Price: $0.35 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| actor | string | yes | Actor name e.g. SANDWORM, XENOTIME, VOLTZITE |
No output schema declared.
No examples provided.
getActorReport Full Threat Actor Report (Markdown) ~187
Synthesised Markdown threat report for an ICS/APT actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/advisory, /ot/detection internally (no extra charge) and synthesises via DeepSeek. Returns executive summary, actor profile, active campaigns, malware families, sector targeting, ATT&CK mappings, recommended actions. TLP: WHITE. Price: $0.25 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| actor | string | yes | Actor name e.g. CHERNOVITE, SANDWORM, VOLTZITE, XENOTIME |
| sector | string | – | Optional sector focus e.g. energy, water, manufacturing |
No output schema declared.
No examples provided.
getActorsBySector Threat Actors by Industrial Sector ~102
All ICS threat actors targeting a specific industrial sector from live MITRE ATT&CK ICS STIX data. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| sector | string | yes | Sector e.g. energy, water, manufacturing, oil-and-gas, chemical, nuclear |
No output schema declared.
No examples provided.
getAdvisories CISA ICS-CERT Advisory Feed ~141
Latest CISA ICS-CERT advisories filtered by vendor or sector. Returns advisory IDs, CVSS scores, CVE lists, OT severity, and direct triage links. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size, default 10 |
| sector | string | – | Sector filter e.g. energy, water, manufacturing |
| vendor | string | – | Vendor filter e.g. siemens, schneider, rockwell |
No output schema declared.
No examples provided.
getAiAttackFeasibility LLM-Generated ICS Attack Feasibility ~328
Deterministic lookup against one specific empirical study (Cook, Stoica, Shah & Pezaros, ACM Trans. Priv. Sec. 29, 3, Article 31, June 2026) testing whether off-the-shelf general-purpose LLMs can generate working attack code against real PLCs. Only 3 vendors tested (Siemens, Schneider Electric, Rockwell Automation); only Network/Register-Tags techniques ever succeeded (zero for Application Code/Firmware); 1.08% overall end-to-end success rate. Claude models were excluded by the paper's own authors due to stronger safety guardrails. Distinct from /ot/ai-exposure (vendor's own AI copilot) and /ot/ai-uplift (open-ended reconnaissance-uplift synthesis). Deterministic, no LLM in the lookup path. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| campaign | string | – | Industroyer2, Fuxnet, FrostyGoop, INCONTROLLER, Stuxnet, or Triton. |
| technique | string | – | MITRE ICS technique name or ID, e.g. 'Brute Force I/O' or T0806. At least one of technique, vendor, or campaign required. |
| vendor | string | – | Siemens, Schneider Electric, or Rockwell Automation — only these three were tested in the study. |
No output schema declared.
No examples provided.
getAiExposure AI/Agentic Copilot Attack Surface Lookup ~181
AI/agentic copilot exposure lookup for OT/ICS vendors. Returns the vendor's documented AI/agentic copilot, autonomy level (advisory vs agentic — the key risk differentiator), access, and applicable MITRE ATLAS techniques. Hand-verified mapping, ATLAS IDs confirmed against the live atlas.mitre.org matrix. Deterministic, no LLM in the lookup path. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| vendor | string | yes | OT/ICS vendor name e.g. Siemens, Schneider Electric, Rockwell Automation, ABB, Emerson, Honeywell, Yokogawa, GE Vernova, Omron, Mitsubishi Electric |
No output schema declared.
No examples provided.
getAiUplift Attacker AI-Uplift Exposure ~250
Assesses how much a general-purpose AI agent lowers the skill/time barrier for an attacker to reach a vendor's OT-adjacent footprint. Grounded in a real-world precedent (Dragos, May 2026), not frontier-model governance thresholds. Distinct from /ot/ai-exposure, which covers a vendor's OWN embedded AI copilot. DeepSeek-synthesised, ICD-203 estimative language. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| auth_type | string | – | single-factor, mfa, or unknown (default) |
| internet_facing | string | – | true, false, or unknown (default) |
| product | string | – | Optional product line filter e.g. Modicon, SIMATIC |
| segmented | string | – | true, false, or unknown (default). If all three deployment-context params are unknown, the tier is capped at informational. |
| vendor | string | yes | OT/ICS vendor name e.g. Schneider Electric, Siemens, Rockwell Automation |
No output schema declared.
No examples provided.
getAnalystBrief Analyst Brief (BLUF) ~152
Human-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector. Same fan-out data as /ot/report but synthesised into a short decision-ready brief instead of a full report. Price: $0.12 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| actor | string | yes | ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME |
| sector | string | – | Optional target sector e.g. energy, water, manufacturing |
No output schema declared.
No examples provided.
getAsnProfile ICS Threat Actor ASN Infrastructure Profiling ~170
Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, NakedPages), bulletproof hosting indicators, abuse categories (c2, staging, phishing), and an OT-specific blocking recommendation with WAF rule hint. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| asn | string | yes | ASN identifier e.g. AS215540, AS9009, AS29802 |
| org | string | – | Optional org name fragment e.g. hivelocity, m247 |
No output schema declared.
No examples provided.
getAssetExposure Asset Risk Score and Escalation Verdict ~208
Synthesises vendor, model, firmware, sector, and network context into a branchable risk verdict. Returns risk_score (0-100), escalate (boolean), recommended_action, and contributing threat actors. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| firmware | string | – | Firmware version e.g. 2.9.2 — enables firmware-specific CVE matching |
| model | string | yes | e.g. s7-1500, modicon-m340, controllogix |
| network | string | yes | internet-facing | dmz | lan-only | air-gapped |
| sector | string | yes | energy | water | manufacturing | oil-and-gas | chemical | nuclear |
| vendor | string | yes | e.g. siemens, schneider, rockwell, ge, honeywell |
No output schema declared.
No examples provided.
getCampaigns Active ICS Campaign Tracker ~124
Active campaigns targeting a specific industrial sector. Returns campaign name, attributed actor, start date, targeted geography, TTPs in use, and CVEs being exploited. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| sector | string | yes | energy | water | manufacturing | oil-and-gas | electric | nuclear | chemical |
| status | string | – | active (default) or all |
No output schema declared.
No examples provided.
getClaimReliability CTI Claim Reliability Scoring ~222
Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against the paper's three failure modes — spurious correlation, contradictory knowledge, constrained generalization — using intel.db grounding plus DeepSeek synthesis. Returns a reliability score, verdict, corroborating/contradicting evidence, and confidence. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| actor | string | – | Optional actor name to ground the claim against intel.db, e.g. SANDWORM. |
| claim | string | yes | The CTI claim to assess, e.g. an actor-targeting, attribution, or TTP claim. |
| cve_id | string | – | Optional CVE ID to ground the claim against intel.db. |
No output schema declared.
No examples provided.
getComplianceBatch Aggregate Compliance Gap Assessment ~218
Rolls up compliance-gap mapping across multiple CVEs/threat actors in a single call. Deterministic per-item table lookup against the same compliance_mappings data as /ot/compliance, deduplicated and rolled up into one aggregate severity rating. LLM only writes the remediation summary prose. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| entity_sector | string | – | Informs the remediation summary's tone/priority framing only — does not filter which controls match. |
| framework | string | – | Optional filter to one compliance framework. |
| items | string | yes | Comma-separated CVE IDs and/or actor names, max 25, e.g. CVE-2023-38802,CVE-2024-12345,SANDWORM,XENOTIME. Each token auto-detected as a CVE ID or treated as an actor name. |
No output schema declared.
No examples provided.
getComplianceMapping Multi-Framework Compliance Gap Mapping ~247
Returns triggered compliance controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, and UAE NESA IA. Deterministic table lookup — LLM only adds compensating control prose. Designed for automated compliance reporting agents: call when a new advisory drops, generate gap report, route to compliance team. Price: $0.04 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| actor | string | – | Threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME |
| cve_id | string | – | CVE identifier e.g. CVE-2023-38802 |
| framework | string | – | Optional filter to one compliance framework. Omit or pass 'all' to return matches across every framework. |
No output schema declared.
No examples provided.
getCtiArticle CTI Article (Publication-Ready) ~191
Publication-ready threat intelligence article (~700 words). Fans out to /ot/actor or /ot/cve + /ot/campaign + /ot/malware + /ot/advisory. DeepSeek writes in journalistic CTI style with headline, lede, body, defanged IOCs, and TLP marking. Suitable for threat intel blog posts or advisories. Price: $0.45 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| actor | string | – | Actor name e.g. CHERNOVITE (required if no cve) |
| cve | string | – | CVE ID e.g. CVE-2024-12345 (required if no actor) |
| sector | string | – | Optional sector context |
No output schema declared.
No examples provided.
getCveTriage OT-Contextualised CVE Triage ~118
CVE lookup enriched for ICS/SCADA environments. Returns OT-adjusted severity, cyber-physical impact, affected ICS layer, compensating controls, patch feasibility, and CISA KEV status. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | CVE identifier e.g. CVE-2023-38802 |
No output schema declared.
No examples provided.
getDetectionArtifacts ICS Detection Artifact Retrieval ~182
Returns YARA/Sigma detection rules for an ICS malware family or threat actor. Rules sourced from public corpus (Florian Roth signature-base, CISA advisories) are marked validated:true and safe for staging. DeepSeek-synthesised rules carry validated:false and require lab testing. Designed for automated threat hunting pipelines that commit rules to SIEMs and EDRs. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Rule format filter (default: all) |
| target | string | yes | Malware or actor name e.g. PIPEDREAM, INDUSTROYER2, TRITON, SANDWORM, CHERNOVITE |
No output schema declared.
No examples provided.
getDeviceExposure Internet-Exposed OT Device Lookup ~160
Exposure data for OT devices by vendor and model. Default credential risk, exposed OT protocols (Modbus/502, S7comm/102, DNP3/20000, PCOM/20256), and hardening recommendations. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| model | string | yes | Device model e.g. s7-1200, modicon-m340, controllogix, vision |
| vendor | string | yes | Vendor e.g. siemens, schneider, rockwell, honeywell, unitronics, ge, beckhoff |
No output schema declared.
No examples provided.
getGccBulletin GCC OT Threat Sitrep (Public Bulletin) ~113
Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep. Price: $0.01 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| issue_date | string | – | Optional YYYY-MM-DD of a past edition; defaults to latest reviewed edition |
No output schema declared.
No examples provided.
getInvariantReachability Physical Invariant Check ~247
Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out via conservation of mass. Fully deterministic, no LLM, no trained model. Inspired by Barbhaya et al. 2025's physical-invariant residual check — flags inconsistency and direction, does not assert a specific cause. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| asset_id | string | yes | Identifier for the tank/vessel being checked |
| dt_seconds | number | yes | Interval duration in seconds, must be > 0 |
| flow_in | number | yes | Metered inflow rate |
| flow_out | number | yes | Metered outflow rate |
| level_end | number | yes | Level reading at end of interval |
| level_start | number | yes | Level reading at start of interval |
| noise_floor | number | – | Residual magnitude below which reading is treated as consistent |
| tank_area | number | yes | Cross-sectional area, must be > 0 |
No output schema declared.
No examples provided.
getIocEnrichment IOC Enrichment with OT Campaign Context ~107
IOC enrichment via AlienVault OTX and AbuseIPDB. Returns verdict on whether the IOC is linked to ICS-targeting campaigns. Price: $0.01 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| type | string | yes | IOC type: ip or domain |
| value | string | yes | IP address or domain |
No output schema declared.
No examples provided.
getLinkedinPost LinkedIn Post for CTI/ICS Audience ~147
LinkedIn post for a CTI/ICS security audience. Fans out to /ot/actor or /ot/cve + /ot/advisory. Returns hook line, 3-5 intelligence bullet observations, call to action, and hashtags. Ready to publish. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| actor | string | – | Actor name e.g. VOLTZITE (required if no cve) |
| cve | string | – | CVE ID (required if no actor) |
No output schema declared.
No examples provided.
getMalwareProfile ICS Malware Encyclopedia ~145
Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted OT protocols, attributed actor, and MITRE ATT&CK for ICS techniques. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Malware name e.g. PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE |
No output schema declared.
No examples provided.
getMitigationMap D3FEND-Mapped Mitigation Guidance ~249
Prescriptive D3FEND-mapped mitigation guidance for OT/ICS threats. Pass one of actor, cve_id, or technique_id, optionally with vendor_stack. Returns matched ATT&CK ICS techniques mapped to D3FEND defensive countermeasures with priority and rationale, plus prescriptive architecture recommendations. DeepSeek-synthesised, ICD-203 estimative language. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| actor | string | – | Threat actor name e.g. SANDWORM. At least one of actor, cve_id, or technique_id is required. |
| cve_id | string | – | CVE identifier. At least one of actor, cve_id, or technique_id is required. |
| technique_id | string | – | MITRE ATT&CK ICS technique ID e.g. T0836. At least one of actor, cve_id, or technique_id is required. |
| vendor_stack | string | – | Optional vendor/product context e.g. Schneider Modicon |
No output schema declared.
No examples provided.
getPatchFeasibility OT Patch Feasibility Assessment ~123
Full patch feasibility for a CVE in OT/ICS environments. Returns patch availability, OT-safe workarounds, estimated downtime, safe-to-patch-live flag, and risk-vs-disruption score (1-10). Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | CVE identifier e.g. CVE-2021-34527 |
No output schema declared.
No examples provided.
getPrecursorTtp Precursor / Dwell-Time TTP Breakdown ~155
Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact). Deterministic tactic-taxonomy lookup against intel.db — no LLM in the classification path. Price: $0.04 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| actor | string | yes | ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME |
No output schema declared.
No examples provided.
getRiskExposure Board/GRC-Level Portfolio Risk Aggregator ~262
Aggregates the same deterministic capability x opportunity x intent scoring used by /ot/threat-score across the actors relevant to a sector+region, ranks them, and returns a DeepSeek-written executive summary (BLUF, ICD-203 language). Portfolio-level companion to /ot/threat-score — for vCISO agents and GRC/board-reporting automation. Price: $0.40 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| compliance_framework | string | – | Optional — framework to note qualitatively in the narrative e.g. NIST_CSF_2_0, IEC_62443_3_2 |
| region | string | yes | Target region e.g. GCC, KSA, UAE, Qatar, Europe |
| sector | string | yes | Target sector e.g. energy, water, manufacturing |
| timeframe | string | – | Optional lookback window, default 90d |
| vendor_stack | string | – | Optional comma-separated vendor list e.g. 'Schneider Modicon,Siemens SIMATIC' — feeds each actor's capability score, same as /ot/threat-score |
No output schema declared.
No examples provided.
getRootCauseLocalization Statistical Anomaly Attribution ~188
Ranks which sensors most likely drove a reported anomaly by z-score deviation from each sensor's own baseline, given a caller-supplied telemetry window. Fully deterministic, no LLM, no trained model. Statistical approximation inspired by Oswal et al. 2025 (kernel SHAP + TCAE) — not a SHAP/TCAE reimplementation. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| anomaly_event_id | string | – | Optional correlation ID, echoed back unchanged |
| top_k | integer | – | How many ranked sensors to return |
| window | string | yes | URL-encoded JSON array, max 20 entries: [{sensor_id, values[], baseline_mean?, baseline_stddev?}] |
No output schema declared.
No examples provided.
getSectorBrief Sector Threat Brief ~146
Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/decreasing), and top 3 recommended actions. One call replaces 5+ chained calls. Price: $0.10 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| period | integer | – | Reporting period in days, default 30 |
| sector | string | yes | Sector e.g. energy, water, manufacturing, oil-and-gas, nuclear |
No output schema declared.
No examples provided.
getSectorDelta Sector Change Feed ~126
What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Lookback window in days, default 7 |
| sector | string | yes | Sector to monitor e.g. energy, water, manufacturing |
No output schema declared.
No examples provided.
getSectorSitrep Sector Situation Report ~158
30-day situation report for an industrial sector. Fans out to /ot/actor/sector, /ot/advisory, /ot/campaign, /ot/delta, /ot/compliance. Returns threat landscape, top active actors, new advisories, what changed, compliance posture impact, and weekly recommended priorities. Price: $0.35 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| period | integer | – | Lookback days, default 30 |
| sector | string | yes | energy | water | manufacturing | oil-and-gas | electric | nuclear | chemical |
No output schema declared.
No examples provided.
getStixCoverage STIX Representability + Actionability Lookup ~300
Deterministic lookup grounded in Hahn, Krief et al., 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXiv:2512.18714v3, Jan 2026). Returns whether STIX 2.1 can represent a given technique/protocol/CVE's artifacts (full/partial/none) and whether public reporting gave enough technical detail to be actionable for detection engineering. No LLM in the lookup path. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| campaign | string | – | Optional filter: Triton, Stuxnet, or Industroyer. |
| cve_id | string | – | CVE ID from the paper's CISA KEV table, e.g. CVE-2023-3595. At least one of technique_id, protocol, or cve_id is required. |
| protocol | string | – | ICS protocol name, e.g. TriStation, S7Comm, CIP. At least one of technique_id, protocol, or cve_id is required. |
| technique_id | string | – | MITRE ATT&CK ICS technique ID, e.g. T0836. At least one of technique_id, protocol, or cve_id is required. |
No output schema declared.
No examples provided.
getThreatActor ICS Threat Actor Profile ~138
ICS/APT threat actor profiles grounded in published vendor research. MITRE ATT&CK for ICS techniques, known malware, attribution, physical impact, targeted sectors. Alias lookup: Volt Typhoon→VOLTZITE, APT44→SANDWORM. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Actor name or alias e.g. SANDWORM, VOLTZITE, XENOTIME, Volt Typhoon |
No output schema declared.
No examples provided.
getThreatHuntControlLoop Advisory Threat Hunt (Control-Loop Recon / RMM-LOTL) ~201
Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Fully deterministic keyword-pattern matching, no LLM. Grounded in CyberAgentX and AgenticCyOps (arXiv 2603.09134). ADVISORY ONLY — never executes containment or any network action. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| observed_commands | string | – | Comma-separated command strings observed. Must not contain literal commas within a command. |
| observed_processes | string | – | Comma-separated process/tool names observed. At least one of observed_processes or observed_commands is required. |
| zone | string | – | Asset zone. Any RMM/LOTL match on OT is always scored HIGH. |
No output schema declared.
No examples provided.
getThreatScore Actor-Target Threat Score (Capability x Opportunity x Intent) ~194
Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus GDELT geopolitical tension and OFAC sanctions pressure. Not LLM-generated. Price: $0.04 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| actor | string | yes | ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME |
| region | string | yes | Target region or country e.g. Europe, GCC, Ukraine |
| sector | string | yes | Target sector e.g. energy, water, manufacturing |
| vendor_stack | string | yes | Comma-separated OT/ICS vendors in the target environment e.g. Siemens,Schneider Electric. Pass 'none' if unknown. |
No output schema declared.
No examples provided.
getVendorRisk OT/ICS Third-Party Vendor Risk Assessment ~147
OT/ICS supply-chain vendor risk assessment. Returns risk tier, confidence, cited CVEs (KEV/EPSS), threat actors with historical targeting interest, and supply-chain mitigation recommendations. DeepSeek-synthesised, ICD-203 language. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| product | string | – | Optional product line filter e.g. Modicon, SIMATIC |
| vendor | string | yes | OT/ICS vendor name e.g. Schneider Electric, Siemens, Rockwell Automation |
No output schema declared.
No examples provided.
getVendorRiskDelta Vendor-Swap Risk Comparison ~169
Counterfactual vendor-swap risk comparison. Runs the same assessment used by /ot/vendor-risk on each vendor and returns the risk-tier delta plus per-vendor summaries, for pre-purchase or migration decisions. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| product_current | string | – | Optional current product line e.g. SIMATIC |
| product_proposed | string | – | Optional proposed product line e.g. Modicon |
| vendor_current | string | yes | Current OT/ICS vendor name e.g. Siemens |
| vendor_proposed | string | yes | Proposed replacement vendor name e.g. Schneider Electric |
No output schema declared.
No examples provided.
getXThread X/Twitter Thread (5-7 Posts) ~151
X/Twitter thread for an actor or CVE. Fans out to /ot/actor or /ot/cve. Returns 5-7 posts: hook, intel posts with ATT&CK IDs and affected systems, mitigation post, and hashtag post. Each post under 280 characters. Price: $0.10 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| actor | string | – | Actor name e.g. XENOTIME (required if no cve) |
| cve | string | – | CVE ID (required if no actor) |
No output schema declared.
No examples provided.
submitSighting Submit OT Sighting ~196
Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment. Feeds the correlation corpus without storing an org identifier. Written to a separate sightings store, not intel.db. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].
| Name | Type | Req | Description |
|---|---|---|---|
| actor_name | string | – | Optional actor name if the sighting is attributed |
| ioc_or_ttp_id | string | yes | CVE ID, MITRE ATT&CK-for-ICS technique ID, or sha256 hash |
| observed_at | string | – | Optional ISO 8601 timestamp of observation |
| region | string | yes | Region where this was observed e.g. KSA, UAE |
| sector | string | yes | Sector where this was observed e.g. energy, water |
No output schema declared.
No examples provided.
How do I install the OT Intel API MCP server?
OT Intel API is a hosted endpoint at https://ot-intel-api.onrender.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · ot-intel-api.onrender.com
claude mcp add --transport http no3men60-ot-intel-api 'https://ot-intel-api.onrender.com/mcp'
What is the OT Intel API MCP server?
OT Intel API is an MCP server listed in the public MCP registry as io.github.No3men60/ot-intel-api. OT/ICS threat intel for AI agents: 40 tools, pay per call in USDC on Base via x402. This page covers its hosted endpoint (https://ot-intel-api.onrender.com/mcp).
Is the OT Intel API MCP server safe to use?
OT Intel API scores 64 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the OT Intel API MCP server expose?
OT Intel API exposes 40 tools: getCveTriage, getDeviceExposure, getThreatActor, getActorsBySector, getIocEnrichment, and 35 more. Their descriptions and schemas cost roughly 7,300 tokens of context every time the server is loaded.
Does the OT Intel API MCP server require authentication?
No. We connected to OT Intel API without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the OT Intel API MCP server still maintained?
OT Intel API is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.