Skip to main content
Glama
KasperskyLab

Kaspersky OpenTIP MCP Server

Official
by KasperskyLab

Server Quality Checklist

67%
Profile completionA complete profile improves this server's visibility in search results.
  • Latest release: v1.0.2

  • Disambiguation4/5

    Most tools have distinct purposes (analyze_file vs search_*), but get_full_analysis_result is ambiguous because it only retrieves results for web portal submissions, not for files submitted via analyze_file. This creates potential confusion about the analysis workflow.

    Naming Consistency5/5

    All tools follow a consistent verb_noun pattern in snake_case (e.g., analyze_file, search_domain). Even the longer get_full_analysis_result maintains the pattern.

    Tool Count5/5

    Six tools is well-scoped for a threat intelligence server, covering file analysis and searches for domains, hashes, IPs, and URLs. The count is neither too few nor too many.

    Completeness3/5

    The search tools cover key indicators, but the file analysis workflow is incomplete: no tool to retrieve results for files submitted via analyze_file, and no update or delete operations. This gap may cause agent failures when expecting a full analysis cycle.

  • Average 3.5/5 across 6 of 6 tools scored. Lowest: 2.9/5.

    See the Tool Scores section below for per-tool breakdowns.

    • No community issues in the last 6 months
    • 0 commits in the last 12 weeks
    • Last stable release on
    • No critical vulnerability alerts
    • No high-severity vulnerability alerts
    • No code scanning findings
    • CI status not available
  • This repository is licensed under Apache 2.0.

  • This repository includes a README.md file.

  • No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.

    Tip: use the "Try in Browser" feature on the server page to seed initial usage.

  • Add a glama.json file to provide metadata about your server.

  • If you are the author, simply .

    If the server belongs to an organization, first add glama.json to the root of your repository:

    {
      "$schema": "https://glama.ai/mcp/schemas/server.json",
      "maintainers": [
        "your-github-username"
      ]
    }

    Then . Browse examples.

  • Add related servers to improve discoverability.

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

  • Behavior3/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    Annotations indicate readOnlyHint=false and openWorldHint=true, matching the submission behavior. Description adds 'basic analysis' but no further behavioral details beyond annotations.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness3/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    Single sentence is efficient but could be more informative without significant added length. Adequate but not optimal.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness2/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    Description is too minimal given tool complexity. Does not explain what 'basic analysis' entails, expected output, or post-submission actions. Output schema exists but description doesn't leverage context.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters1/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    Schema description coverage is 0%; description does not explain the two required parameters (filename, full_file_path) or their usage, failing to add meaning beyond the schema.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose5/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    Clearly states it submits a file for basic analysis using OpenTIP API. Distinguishes from sibling tools like search tools and get_full_analysis_result.

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines2/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    No guidance on when to use this tool vs. alternatives (e.g., search tools for existing data). Does not specify prerequisites or when not to use.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

  • Behavior3/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    Annotations already provide readOnlyHint and openWorldHint. Description adds 'full analysis results' but does not elaborate on potential incompleteness or other behavioral traits. No contradiction but minimal added value.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness3/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    Extremely concise (12 words), but at the expense of parameter explanation. It is well-structured for a simple tool but missing crucial details.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness3/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    The tool has a single parameter and an output schema, so the description does not need to detail return values. However, it does not mention the constraint that the file must have been submitted via the web portal, nor does it compare with sibling tools.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters1/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    Schema description coverage is 0%, and the tool description does not explain the only parameter (file_hash). The description fails to compensate for the lack of schema guidance, leaving the agent without context on how to identify the file.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose5/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    The description clearly states the tool retrieves full analysis results for a file submitted via the web portal. It distinguishes from siblings like analyze_file (submission) and search tools (querying by different criteria).

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines2/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    No guidance on when to use this tool versus alternatives such as analyze_file or search tools. The description does not mention prerequisites or scenarios where this tool is preferred.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

  • Behavior3/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    Annotations already provide readOnlyHint and openWorldHint; description adds no additional behavioral context (e.g., data sources, rate limits). No contradiction with annotations.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness5/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    Single sentence of 8 words, front-loaded, no redundancy; every word adds value.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness3/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    Tool is simple with one param and output schema exists, but description does not hint at return data or result structure, leaving some ambiguity.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters2/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    With 0% schema coverage, description should clarify the 'domain' parameter format (e.g., FQDN, URL), but only mentions 'web domain' generically.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose5/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    Description clearly states the action ('Get') and resource ('threat intelligence data about a web domain'), which distinguishes it from siblings like search_hash or search_ip.

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines2/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    No guidance on when to use this tool versus alternatives like search_url or search_ip; no mention of prerequisites or exclusions.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

  • Behavior3/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    Annotations already provide readOnlyHint and openWorldHint. The description adds 'threat intelligence data' but doesn't elaborate on behavior beyond that. No contradictions.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness5/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    Single, front-loaded sentence. Every word is necessary for a simple tool. No extraneous content.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness3/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    Adequate for a single-parameter tool with output schema, but lacks details on what specific threat intelligence data is returned or any special considerations.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters2/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    Schema has 0% description coverage for the single 'ip' parameter. The description implies the parameter is an IP address but gives no format, example, or constraints, leaving ambiguity.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose5/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    Description uses specific verb 'Get' and resource 'threat intelligence data about an IP address', clearly distinguishing from sibling tools like search_domain, search_hash, etc. No ambiguity.

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines2/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    No guidance on when to use this tool versus alternatives, no exclusions or context provided. The description simply states what it does without usage advice.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

  • Behavior3/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    Annotations provide readOnlyHint and openWorldHint. Description adds hash types but no additional behavioral context beyond annotations.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness5/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    Single sentence, no extraneous information. Efficiently conveys purpose and parameter details.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness4/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    Covers essential information for a simple hash lookup tool. Output schema exists so return values don't need description. Could mention return format but not necessary.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters4/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    Schema has 0% description coverage. Description adds meaning by listing supported hash types (md5, sha1, sha256), helping the agent format the parameter correctly.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose5/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    Clearly states 'Get threat intelligence information about a file by hash (md5, sha1, sha256)', specifying resource and action. Distinguishes from sibling tools like search_domain and search_ip.

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines3/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    Implies usage for file hash lookups, but no explicit when-to-use or alternatives. Lacks guidance on when not to use.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

  • Behavior3/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    Annotations already declare readOnlyHint=true and openWorldHint=true. The description adds minimal behavioral context beyond confirming it is a data retrieval operation, but does not detail specifics like data freshness or limitations.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness5/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    The description is a single concise sentence of 8 words, front-loading the core purpose with no unnecessary detail.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness4/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    For a simple one-parameter tool with an existing output schema, the description is nearly complete. It could briefly mention encoding or limitations, but it suffices for basic usage.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters4/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    With schema description coverage at 0%, the description adds value by clarifying that the single 'url' parameter is the URL to investigate. This bridges the gap left by the schema's lack of parameter descriptions.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose5/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    The description 'Get threat intelligence data about a URL' uses a specific verb ('Get') and resource ('threat intelligence data about a URL'), clearly distinguishing it from sibling tools that investigate other indicators like domains, hashes, or files.

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines4/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    The description implicitly guides use for URLs, which is sufficient to differentiate from siblings (search_domain, search_hash, etc.). However, no explicit when-not or alternative recommendations are provided.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

  • Confirm that the MCP server is working as expected.
  • Confirm that there are no obvious security issues.
  • Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

threat-intelligence MCP server

Copy to your README.md:

Score Badge

threat-intelligence MCP server

Copy to your README.md:

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/KasperskyLab/threat-intelligence'

If you have feedback or need assistance with the MCP directory API, please join our Discord server