Skip to main content
Glama

PG1 Sovereign Threat Intelligence

by io.github.Project-Gifted1
OverviewDiscussionsAdmin

get_threat_indicators

PG1 Sovereign Threat Intelligence: returns a STIX 2.1 bundle of verified threat indicators (IPs, domains, URLs, file hashes) sourced from NVD; only sources PG1 may redistribute commercially are served. Payment required: $0.01 via x402, sent in params._meta["x402/payment"] (the PAYMENT-SIGNATURE header is also accepted), or a valid Gumroad license key (X-API-KEY header). SIBLING DIFFERENTIATION: Use ONLY for bulk feed synchronizations. Do NOT use for single-item lookups (use get_ioc_context) or CVE analysis (use get_cve_details). USAGE EXCLUSIONS: Does not provide historical query archival beyond the active ingestion window. BEHAVIOR: Pagination is handled via the limit parameter (max 1000). If payment is missing or fails, returns a normal tool result with isError: true, the x402 v2 PaymentRequired object in structuredContent and the same JSON in content[0].text; on success the settlement receipt is in result._meta["x402/payment-response"].

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
typeNoIndicator category filter. Allowed enum-style values: 'IPv4', 'domain', 'URL', 'FileHash-MD5', 'FileHash-SHA1', or 'FileHash-SHA256'.
limitNoPagination boundary constraint defining the maximum number of indicators to return in a single payload (integer between 1 and 1000, defaulting to 500).
sinceNoISO timestamp constraint (e.g., 2026-09-20T00:00:00Z); strictly filters and returns only indicators last seen after this exact timestamp.
min_scoreNoConfidence score threshold integer ranging inclusively from 0 to 100 to filter low-confidence noise.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / properties / type / description
      Previous value: -"Indicator category filter. Allowed enum-style values: 'IPv4', 'domain', 'URL', or 'hash'."New value: +"Indicator category filter. Allowed enum-style values: 'IPv4', 'domain', 'URL', 'FileHash-MD5', 'FileHash-SHA1', or 'FileHash-SHA256'."
  2. Changed8 schema fields changed
    • changedInput schema / properties / limit / description
      Previous value: -"Max indicators to return (1-1000, default 500)."New value: +"Pagination boundary constraint defining the maximum number of indicators to return in a single payload (integer between 1 and 1000, defaulting to 500)."
    • changedInput schema / properties / limit / type
      Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]
    • changedInput schema / properties / min_score / description
      Previous value: -"Minimum confidence score threshold (0-100)."New value: +"Confidence score threshold integer ranging inclusively from 0 to 100 to filter low-confidence noise."
    • changedInput schema / properties / min_score / type
      Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]
    • changedInput schema / properties / since / description
      Previous value: -"ISO timestamp; only return indicators last seen after this time (e.g. 2026-09-20T00:00:00Z)."New value: +"ISO timestamp constraint (e.g., 2026-09-20T00:00:00Z); strictly filters and returns only indicators last seen after this exact timestamp."
    • changedInput schema / properties / since / type
      Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
    • changedInput schema / properties / type / description
      Previous value: -"Filter by indicator_type, e.g. 'IPv4', 'domain', 'URL'."New value: +"Indicator category filter. Allowed enum-style values: 'IPv4', 'domain', 'URL', or 'hash'."
    • changedInput schema / properties / type / type
      Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
  3. Changed4 schema fields changed
    • addedInput schema / properties / limit / default
      Added value: +500
    • changedInput schema / properties / limit / description
      Previous value: -"Max indicators to return (default 500, max 1000)."New value: +"Max indicators to return (1-1000, default 500)."
    • changedInput schema / properties / min_score / description
      Previous value: -"Minimum confidence score (0-100)."New value: +"Minimum confidence score threshold (0-100)."
    • changedInput schema / properties / since / description
      Previous value: -"ISO timestamp; only return indicators last seen after this time."New value: +"ISO timestamp; only return indicators last seen after this time (e.g. 2026-09-20T00:00:00Z)."
  4. Changed2 schema fields changed
    • changedInput schema / properties / limit / type
      Previous value: -"string"New value: +"integer"
    • changedInput schema / properties / min_score / type
      Previous value: -"string"New value: +"integer"
  5. First observed

TDQS

Score is being calculated.

All PG1 Sovereign Threat Intelligence toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources