ThreatWatch MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| OTX_API_KEY | No | AlienVault OTX API key (optional, recommended) | |
| IPINFO_API_KEY | No | IPinfo API key (optional) | |
| ABUSEIPDB_API_KEY | No | AbuseIPDB API key (optional) | |
| VIRUSTOTAL_API_KEY | No | VirusTotal API key (optional, recommended for richer data) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| analyze_iocB | Analyse a single Indicator of Compromise (IOC) across all available threat intelligence sources. Supports: IPv4/IPv6 addresses, domain names, URLs, MD5/SHA1/SHA256 hashes. |
| bulk_analyzeB | Analyse multiple IOCs concurrently and return a consolidated summary. |
| add_watchA | Add an IOC to the real-time watch-list. ThreatWatch will periodically re-scan it and flag changes in threat status. |
| remove_watchC | Remove an IOC from the real-time watch-list. |
| list_watchesA | List all IOCs currently on the watch-list with their last-known status. Returns: Markdown table of watched IOCs. |
| get_alertsC | Retrieve alerts generated by the real-time monitor for watched IOCs. |
| run_monitor_cycleA | Manually trigger a monitoring cycle — re-scans all watched IOCs immediately rather than waiting for the next scheduled interval. Returns: Summary of how many IOCs were checked and how many triggered alerts. |
| detect_iocs_in_textA | Extract all IOCs (IPs, domains, URLs, hashes) from freeform text such as log files, incident reports, or paste-bin content. |
| server_statusA | Return the current ThreatWatch server status including configured API sources, watch-list size, and pending alert count. Returns: A Markdown status card. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 9 tools
Each tool has a clearly distinct purpose: status, single analysis, bulk analysis, watch management, alert retrieval, manual monitor, and text extraction. No overlap between tools; an agent can easily select the right one based on the action and resource.
All tool names follow a consistent verb_noun pattern (e.g., analyze_ioc, add_watch, get_alerts) or noun_status pattern (server_status), with clear and predictable naming throughout.
With 9 tools, the set is well-scoped for a threat intelligence watch server, covering analysis, watch-list management, monitoring, and alerting without redundancy.
The tool surface provides complete lifecycle coverage: analyze IOCs (single/bulk), manage watch-list (add/remove/list), monitor (manual/automatic), retrieve alerts, and extract IOCs. No obvious gaps for the stated purpose.