Skip to main content
Glama

Whisper

threatintel

whisper_threatintel
Read-only

Threat-intelligence indicator family (candidate apex/CDN/hosting). A family verb: name the sub-verb as "sub" alongside the input. Sub-verbs: candidateCdnApex, candidateMultiTenantApex, candidateSharedHostingIp.. Answers without an API key. Example call: {"skill":"threatintel","sub":"candidateCdnApex","input":5}

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
subYesWhich sub-verb of this family to run. The example runs "candidateCdnApex".
inputYesA row limit. The example passes 5.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, openWorldHint=true, and destructiveHint=false. The description adds the useful behavior that answers require no API key, but it does not discuss rate limits, error handling, or output characteristics. Given the annotation coverage, the added context earns a baseline score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is relatively short but suffers from a typo (double period after candidateSharedHostingIp), awkward phrasing ('family verb'), and a slightly disjointed structure. The purpose is front-loaded, but the overall presentation is mediocre.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The sub-verb list is incomplete (trailing '..') and there are no enums in the schema, leaving the agent uncertain about valid values. With no output schema, the description also does not hint at the return shape, which is a significant gap for a dispatcher tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented. The description clarifies that 'sub' holds a sub-verb and gives an example mapping, but it does not add deeper meaning beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as a threat-intelligence family dispatcher, names specific sub-verbs (candidateCdnApex, candidateMultiTenantApex, candidateSharedHostingIp), and provides a concrete example call. It is easily distinguished from sibling tools like whisper_identify or whisper_lookuptlsfingerprint.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains how to invoke the tool (pass a sub-verb and an input) and mentions that it works without an API key, but it does not explicitly state when to use this tool versus alternatives or what conditions make it the right choice. The no-API-key note is a usage condition, not a full selection guide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.