CEV-OS Data API

Global threat-level heuristic (TRIPWIRE)

get_threat_level

Read-onlyIdempotent

Use this when you need TRIPWIRE's single global 5-to-1 threat-level heuristic (calm to critical) with every component and reason — not official DEFCON. Free. License: cleared_with_attribution. Attribution required: Tripwire threat level, not official DEFCON. A heuristic composite of open, commercial-safe feeds. Inputs: GDELT; UCDP (CC BY 4.0); GDACS (not for life-safety use); NOAA NTWC/PTWC and SWPC; CISA KEV (CC0; no CISA logo or endorsement); US Department of State; UK FCDO (Open Government Licence v3.0); CDC (no endorsement).

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "get_threat_level"
  }
}

Input Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

AddedNov 4, 2026

TDQS

A3.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, idempotent, and open-world behavior, so the description's added value is meaningful: it discloses the output composition ('every component and reason'), the 5-to-1 scale direction with endpoint labels (calm to critical), the cost ('Free'), and an attribution obligation that constrains downstream use. The provenance list of upstream feeds further explains why the number may differ from official assessments.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is front-loaded well, leading with the when-to-use and the scale before any boilerplate. The second half, however, is a dense licensing/attribution run-on that repeats 'not official DEFCON' already stated in sentence one and buries the genuinely useful 'not for life-safety use' caveat inside a parenthetical about an upstream feed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no parameters, the description must convey what comes back, and it does: a value on a 5-to-1 calm-to-critical scale plus each component and its reason. Attribution and provenance obligations — which materially affect how an agent may reuse the output — are also present, leaving only the exact response shape unspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to disambiguate and the baseline applies. The description correctly does not invent parameter guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'TRIPWIRE's single global 5-to-1 threat-level heuristic (calm to critical) with every component and reason'. The word 'global' and 'heuristic' implicitly separate it from country-scoped siblings like get_country_risk and get_inform_severity, though no sibling is named explicitly. The 'not official DEFCON' clause sharply bounds what the value means.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The opening 'Use this when you need ...' gives a clear positive trigger, and 'not official DEFCON' clarifies the semantic boundary. However, there is no negative guidance (e.g., 'for country-level risk use get_country_risk') and no mention of when the heuristic is inappropriate — the only safety caveat, 'not for life-safety use', is attached to the GDACS input rather than the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All CEV-OS Data API tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?