Skip to main content
Glama

Jeevesus — DugganUSA threat-intel MCP

Summarize the STIX feed

stix-feed-summary
Read-only

Summarizes what is in the feed right now: useful for "what's active this week", feed freshness, or planning SIEM / blocklist ingestion.

Shape report on the most recent 5,000 indicators in the DugganUSA STIX 2.1 feed, bounded to a 1-7 day window. Returns how many of those fall in the window (capped at 5,000), the top malware families or list labels (feeds such as Spamhaus DROP label by list, not family), top source feeds, a breakdown by indicator type, and top countries when the records carry one.

Useful before pulling the full STIX bundle, to gauge feed depth and freshness, plan a SIEM ingestion budget, or check that a campaign is in the corpus.

Does not return the full bundle (STIX 2.1 / TAXII 2.1), which is at bundle_url in the response and needs an API key.

Public read (no auth), cached for 10 minutes. The full bundle needs a free API key.

Example: {"days": 7} returns the last week's feed shape — useful for capacity planning and spot-checking recent ingest tags.

Input Schema

NameRequiredDescriptionDefault
daysNoLookback window in days (1–7). Default 1.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint/openWorldHint annotations, the description discloses the hard cap of 5,000 indicators, the 1–7 day bounding window, a 10-minute cache, and that the call is public/no-auth while the underlying bundle requires a free API key. It also points to bundle_url for the data this tool deliberately omits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The opening sentence is well front-loaded, but the usefulness rationale is stated twice — 'feed freshness' in the first paragraph and 'gauge feed depth and freshness' in the third, plus a nearly identical closing example sentence. Roughly one paragraph of the five is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries the return-value burden and does so thoroughly: window counts, top families vs. list labels, source feeds, indicator-type breakdown, countries, and bundle_url. An agent knows exactly what it will get back and what it will not.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With one parameter at 100% schema description coverage, the schema already carries the bounds and default, so the baseline applies. The description reinforces the 1–7 day window semantics and provides an example call (`{"days": 7}`), but adds no syntax or interpretation beyond that.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — a shape report over the most recent 5,000 indicators in the DugganUSA STIX 2.1 feed — and enumerates the outputs (counts, top families/labels, source feeds, type breakdown, countries). It clearly distinguishes itself from a full bundle download, though it never names or contrasts with the sibling tools (search, enrich-ioc, check-package).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete use cases: gauging feed depth/freshness, planning SIEM or blocklist ingestion budgets, spot-checking that a campaign is in the corpus, and using it *before* pulling the full bundle. It also sets a boundary (does not return the bundle), but stops short of saying when another tool would be the better choice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources