Skip to main content
Glama

PG1 Sovereign Threat Intelligence

by io.github.Project-Gifted1
OverviewDiscussionsAdmin

get_ioc_context

PG1 Sovereign Threat Intelligence: looks up a single specific indicator value (IP, domain, URL, or hash) — the recommended pre-action safety check for AI agents before visiting, downloading, or connecting to something. Returns aggregated provenance from OTX — reporting sources, observation count, aggregated confidence score, known malware families, tags, and first/last seen timestamps. SIBLING DIFFERENTIATION: Use ONLY for point-lookup enrichment of a single indicator. Do NOT use for bulk intelligence downloads (use get_threat_indicators), multiple indicators at once (use get_ioc_batch), or software vulnerability analysis (use get_cve_details). BEHAVIOR: Returns a normal result shaped { found: true, indicator_type, provenance } or { found: false } — never an error for 'not found'. A found:false result means nothing bad is recorded in PG1's sources; it does NOT mean the indicator is safe, only that it isn't in this dataset. Lookups that return found:false are FREE — no payment or free-tier quota is consumed. Payment (x402 via params._meta['x402/payment'], with the PAYMENT-SIGNATURE header also accepted, or a Gumroad X-API-KEY license) is only required when a real record is found. If payment is required but missing or fails, the result has isError: true with the x402 v2 PaymentRequired object in structuredContent.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
valueYesMandatory exact indicator string value to look up, such as an IPv4 address (198.51.100.1), fully qualified domain, complete URL, or SHA-256 hash string.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / properties / value / description
      Previous value: -"The exact indicator value to look up, e.g. an IP address (198.51.100.1), domain, URL, or SHA-256 hash."New value: +"Mandatory exact indicator string value to look up, such as an IPv4 address (198.51.100.1), fully qualified domain, complete URL, or SHA-256 hash string."
  2. Changed1 schema field changed
    • changedInput schema / properties / value / description
      Previous value: -"The exact indicator value to look up, e.g. an IP address, domain, URL, or file hash."New value: +"The exact indicator value to look up, e.g. an IP address (198.51.100.1), domain, URL, or SHA-256 hash."
  3. Added

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so: it discloses the exact return shapes ({found:true,...} vs {found:false}), that not-found never errors, that found:false does NOT mean safe, that such lookups are free, and the payment paths (x402 params._meta, PAYMENT-SIGNATURE header, Gumroad X-API-KEY) plus the error shape (isError + PaymentRequired object). This is unusually rich behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then clearly sectioned into SIBLING DIFFERENTIATION and BEHAVIOR. It is long, but the payment and found:false semantics justify the length; only minor trimming (e.g., payment path enumeration) could tighten it.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 1-param tool with no annotations and no output schema, the description supplies everything an agent needs: return shape, error/free-vs-paid behavior, and routing to siblings. Nothing material is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and there is only one parameter, so the schema already documents 'value' thoroughly. The description reinforces that it must be a single indicator (not a list) but adds no syntax or format detail beyond the schema; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: 'looks up a single specific indicator value (IP, domain, URL, or hash)' and positions it as the pre-action safety check. It explicitly names the siblings it is NOT for (get_threat_indicators, get_ioc_batch, get_cve_details), so an agent can distinguish it without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ('recommended pre-action safety check before visiting, downloading, or connecting') and when-not-to-use with named alternatives for each exclusion (bulk, multi-indicator, vulnerability). Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All PG1 Sovereign Threat Intelligence toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources