No user-submitted related servers found.
Scored across 25 tools
Each tool targets a distinct resource and action, with clear list/get navigation pairs for victims, IOCs, YARA rules, ransom notes, and negotiations. A couple of names are near-permutations (list_ransomnote_groups vs list_group_ransomnotes; list_negotiation_groups vs list_group_negotiations), so an agent could misselect without reading the descriptions.
All tool names are verb-first snake_case (validate, get, list, search, filter, build, decode), giving a predictable overall style. Minor deviations include 'id' vs 'identifier' between build_victim_id and decode_victim_identifier, and the swapped noun order in the list_<type>_groups / list_group_<type> pairs.
25 tools is at the heavy end, but the server spans many distinct intelligence domains (victims, groups, IOCs, YARA, ransom notes, negotiations, press, SEC filings, CSIRT contacts), so the count is justified. It feels slightly over-packed rather than redundant.
The tool surface gives complete read-only coverage of the exposed domain: every artifact type has listing plus retrieval, with navigation helpers (build/decode victim ID, sector/group enumerations) that avoid dead ends. Since this is an intelligence/retrieval API, write operations are not an expected part of the lifecycle.