PatrowlIntelMCP
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PATROWL_INTEL_API_KEY | No | Reserved for the future authenticated tier. | |
| PATROWL_INTEL_TIMEOUT | No | Per-request timeout (seconds). | 15 |
| PATROWL_INTEL_API_BASE | No | Backend API base URL. | https://intel.patrowl.io |
| PATROWL_INTEL_WEB_BASE | No | Public site base used for CVE citation links. Defaults to API base. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| search_cvesA | Search the PatrowlIntel CVE feed with rich filters and return compact, ranked results. Use it to triage by risk (min_score / min_epss), surface KEV or exploited CVEs, or scope a vendor/technology. For the full record of one CVE, follow up with get_cve. |
| get_cveA | Fetch full intelligence for a single CVE: CVSS, EPSS, CISA KEV status and dates, CISA SSVC decision, public exploit links, affected technologies, weaknesses and references. |
| list_trending_attacksA | List trending attacks / actively-discussed threats from the Patrowl feed, most recent first. Use min_severity=3 to focus on High and Critical. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 3 tools
Each tool has a clearly distinct purpose: get_cve retrieves full details for a single CVE, list_trending_attacks shows trending threats, and search_cves provides filtered search. No ambiguity between them.
All tool names follow a consistent verb_noun snake_case pattern (get_cve, list_trending_attacks, search_cves), making them predictable and easy to understand.
Three tools is appropriate for a focused threat intelligence server. Each tool serves a distinct, essential function (detail retrieval, trending list, search) without being too few or too many.
The tool set covers the core needs: fetching CVE details, searching with filters, and viewing trending threats. Minor gaps exist, such as lacking a direct tool for bulk listing or subscription features, but the set is largely complete for typical use cases.