usom-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| check_urlA | Check whether a URL is listed by USOM (exact, parent-domain, URL path or CIDR match). Call this first when a user asks whether a link is safe. The result carries the match type, record date, source and category of every hit. |
| check_domainA | Check whether a domain is listed by USOM, including when a parent domain is listed. |
| check_ipA | Check whether an IP address is listed by USOM, exactly or inside a listed network. |
| latest_threatsA | Return the most recently added USOM records, newest first. |
| search_threatsC | Search the USOM list by keyword, type, category, source and date range. |
| statsA | Report record counts, newest record date, last sync time and cache status. |
| watch_addB | Add your own domains/IPs/networks to the local watch list. |
| watch_removeB | Remove entries from the local watch list. |
| watch_listA | List everything on the local watch list. |
| watch_checkB | Scan the watch list against USOM. Domains also report listed subdomains below them. Each item shows what is new since the previous check. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 10 tools
Most tools target clearly distinct actions or resource types: check_url, check_domain, and check_ip are well-separated, and the watch_* tools have distinct roles. search_threats and latest_threats overlap somewhat because latest_threats is a specialized recent-record query, but the descriptions make the intended use clear.
All tool names use consistent snake_case with predictable verb/noun or domain-prefixed patterns such as check_url, watch_add, and watch_list. The only minor outlier is stats, which is still readable and consistent with the overall style.
Ten tools is well-scoped for a USOM threat-intelligence and local watch-list server. Each tool covers a distinct lookup, monitoring, or watch-list operation without obvious redundancy.
The surface covers threat search, URL/domain/IP checks, recent records, stats, and full local watch-list lifecycle operations including add, remove, list, and check. This is complete for the apparent domain and supports common agent workflows without dead ends.