Skip to main content
Glama
Sign In
vulnerability-exposure-mcp

vulnerability-exposure-mcp

by MRFrazer25
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

Threat lists check

threat_lists_check
Read-onlyIdempotent

Check a public IP against Spamhaus DROP and GreyNoise to identify criminal or hijacked networks and internet scanners without API keys.

Instructions

Keyless reputation for a public IP: Spamhaus DROP (networks hijacked or run by criminals) and GreyNoise (whether it scans the internet, or is a known business service). Already run for an IP target. GreyNoise allows a limited number of lookups without GREYNOISE_API_KEY.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "ip_address": "<ip_address>"
    },
    "name": "threat_lists_check"
  }
}

Input Schema

NameRequiredDescriptionDefault
ip_addressYesA public IPv4 or IPv6 address, e.g. '8.8.8.8'.
investigation_idNoThe investigation_id from investigate_target. Pass it so the result counts toward that investigation's evidence, budget and key facts; without it the lookup runs on its own.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv1.0.1
    • addedInput schema / properties / investigation_id / description
      Added value: +"The investigation_id from investigate_target. Pass it so the result counts toward that investigation's evidence, budget and key facts; without it the lookup runs on its own."
    • addedInput schema / properties / ip_address / description
      Added value: +"A public IPv4 or IPv6 address, e.g. '8.8.8.8'."
  2. First observedv0.1.0

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only, idempotent, non-destructive, open-world behavior. The description adds meaningful context beyond that: the specific sources used, keyless operation, and the GreyNoise lookup limit without an API key.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded and the description is short, with useful source and keying details packed in. The sentence 'Already run for an IP target' is slightly unclear and keeps it from being maximally crisp.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter read-only lookup with rich annotations and full schema coverage, the description supplies enough context to call the tool correctly. The main omission is sibling-tool routing, which is not strictly required for invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already well documented in the schema. The description reinforces that the input must be a public IP but does not add syntax or usage details beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies a specific resource and action: reputation lookup for a public IP using Spamhaus DROP and GreyNoise. It does not explicitly distinguish this tool from sibling reputation checks such as abuseipdb_check or virustotal_check, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for public-IP reputation but gives no explicit when-to-use guidance, exclusions, or comparison to sibling tools. The note about limited GreyNoise lookups is useful context but not routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools