Skip to main content
Glama

OT Intel API

CTI Claim Reliability Scoring

getClaimReliability
Read-only

Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against the paper's three failure modes — spurious correlation, contradictory knowledge, constrained generalization — using intel.db grounding plus DeepSeek synthesis. Returns a reliability score, verdict, corroborating/contradicting evidence, and confidence. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
actorNoOptional actor name to ground the claim against intel.db, e.g. SANDWORM.
claimYesThe CTI claim to assess, e.g. an actor-targeting, attribution, or TTP claim.
cve_idNoOptional CVE ID to ground the claim against intel.db.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.2/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only supply readOnlyHint/openWorldHint; the description goes well beyond them by disclosing the paid model ($0.20 USDC via x402 on Base mainnet), the failure behavior (unpaid call returns a PaymentRequired challenge) and the exact retry protocol (resend identical call with signed payload in _meta['x402/payment']). It also enumerates the return payload (score, verdict, corroborating/contradicting evidence, confidence), which is essential for a no-output-schema tool. No contradiction with the readOnly annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, front-loaded with the methodological grounding, then capability, then return shape, then payment mechanics — a sensible order with little waste. The full paper citation with arXiv version and date is heavier than an agent strictly needs, but it justifies the taxonomy used.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly spells out the returned fields, and it covers the non-obvious payment/retry workflow that an agent must know to succeed. Combined with annotations handling the safety profile, nothing needed to call this tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and each parameter already carries an example-bearing description, so the baseline is 3. The prose adds only the general idea of intel.db grounding, not per-parameter syntax, format, or interaction detail beyond what the schema supplies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Classifies a CTI claim'), names the exact taxonomy applied (spurious correlation, contradictory knowledge, constrained generalization) and the grounding method (intel.db + DeepSeek synthesis). No sibling in the list scores claim reliability, so the agent can distinguish it from getThreatScore or getCveTriage without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied — this is the tool for judging whether a CTI claim holds up — but the description never states when to prefer it over adjacent tools such as getThreatScore or getCveTriage, nor any preconditions or exclusions. The 'e.g.' clause gives example inputs but not routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources