Skip to main content
Glama

OT Intel API

Actor-Target Threat Score (Capability x Opportunity x Intent)

getThreatScore
Read-only

Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus GDELT geopolitical tension and OFAC sanctions pressure. Not LLM-generated. Price: $0.04 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
actorYesICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME
regionYesTarget region or country e.g. Europe, GCC, Ukraine
sectorYesTarget sector e.g. energy, water, manufacturing
vendor_stackYesComma-separated OT/ICS vendors in the target environment e.g. Siemens,Schneider Electric. Pass 'none' if unknown.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover only readOnlyHint and openWorldHint, but the description adds materially more: the score is deterministic and not LLM-generated, it draws on named source classes (actor/CVE/campaign, GDELT, OFAC), and it discloses the paid x402 flow including price, chain, and the PaymentRequired-then-retry-with-signed-payload behavior. This is exactly the behavioral context an agent needs to invoke it successfully.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the purpose, followed by provenance and then the payment mechanics, with no filler. Slightly dense in the final sentence, but every clause is actionable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a four-required-parameter scoring tool with no output schema, the description covers provenance, determinism, and the full payment/auth path well. Its one gap is the return shape: with no output schema present, the description should indicate what the score looks like (range, breakdown, or confidence), which it does not.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters (actor, region, sector, vendor_stack) are already documented with examples and the 'none' fallback. The description adds no parameter-level meaning beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific computed artifact ('deterministic capability x opportunity x intent threat score') for a specific input pair (actor-target), and identifies its data sources. It is clearly distinguishable from sibling scoring tools like getRiskExposure, getAssetExposure, or getActorDossier, which do not describe a composite threat score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the agent can infer this is the composite scoring tool for an actor/target pairing, but there is no explicit when-to-use guidance and no comparison against scoring-adjacent siblings such as getRiskExposure or getAiAttackFeasibility. The payment retry instructions are the only operational guidance offered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources