Related Servers

Most tools map to clearly distinct resources such as victims, groups, cyberattacks, CERT contacts, YARA rules, and Pro-tier intelligence data. The six victim-related tools are distinct filters, but their volume means an agent must read the arguments carefully to avoid selecting the wrong victim query.

The overwhelming majority of tools follow a consistent get_<resource> snake_case pattern, making the set highly predictable. The single exception is search_victims, which uses the verb 'search' rather than 'get', but it still follows a clear verb_noun convention.

At 18 tools, the server is slightly above the typical well-scoped range, but the breadth of ransomware intelligence data justifies the count. Each tool covers a distinct data slice across free and Pro tiers, and there is minimal obvious redundancy.

The server provides broad coverage of public intelligence including victims, groups, attacks, and CERT contacts, plus Pro-tier depth in YARA rules, negotiation chats, ransom notes, IoCs, and MITRE TTPs. The main retrieval dimensions of group, country, sector, date, and keyword are all represented, leaving agents few dead ends.