list_threat_profiles
Retrieve a list of Threat Profiles to filter Google's threat intelligence by target industry or region, focusing on threats relevant to your organization.
Instructions
List your Threat Profiles at Google Threat Intelligence.
Threat Profiles filter all of Google TI's threat intelligence so you can focus only on the threats that matter most to your organization.
Threat Profiles let you apply top-level filters for Target Industries and Target Regions to immediately provide a more focused view of relevant threats.
When searching for threats, we must use this tool first to check
if there is any Threat Profile that matches the user query
before peforming a general search using the search_threats tool.
Recommendations from Threat Profiles are more relevants to users than generic search threats. Use them as long as they match user's query.
Returns: List of Threat Profiles.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| api_key | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |
Implementation Reference
- gti_mcp/tools/threat_profiles.py:22-51 (handler)Handler function for the 'list_threat_profiles' tool. Decorated with @server.tool(), it uses the VirusTotal client to fetch threat profiles from the /threat_profiles endpoint via consume_vt_iterator, then sanitizes the response.
@server.tool() async def list_threat_profiles( ctx: Context, limit: int = 10, api_key: str = None ) -> typing.List[typing.Dict[str, typing.Any]]: """List your Threat Profiles at Google Threat Intelligence. Threat Profiles filter all of Google TI's threat intelligence so you can focus only on the threats that matter most to your organization. Threat Profiles let you apply top-level filters for Target Industries and Target Regions to immediately provide a more focused view of relevant threats. When searching for threats, we must use this tool first to check if there is any Threat Profile that matches the user query before peforming a general search using the `search_threats` tool. Recommendations from Threat Profiles are more relevants to users than generic search threats. Use them as long as they match user's query. Returns: List of Threat Profiles. """ async with vt_client(ctx, api_key=api_key) as client: res = await utils.consume_vt_iterator( client, "/threat_profiles", limit=limit ) return utils.sanitize_response([o.to_dict() for o in res]) - gti_mcp/tools/threat_profiles.py:22-22 (registration)Registration via the @server.tool() decorator on the list_threat_profiles async function. The 'server' is a FastMCP instance defined in gti_mcp/server.py. Registration is triggered by the import chain: server.py imports gti_mcp.tools, and __init__.py imports threat_profiles, which causes the decorator to execute.
@server.tool() - gti_mcp/server.py:73-73 (registration)Top-level registration trigger: 'from gti_mcp.tools import *' causes all tool modules (including threat_profiles) to be imported, executing the @server.tool() decorators.
from gti_mcp.tools import * - gti_mcp/tools/__init__.py:18-19 (registration)Imports threat_profiles module, causing its @server.tool() decorators to register tools on the FastMCP server instance.
from .threat_profiles import * from .urls import * - gti_mcp/utils.py:20-26 (helper)consume_vt_iterator helper: iterates over a VirusTotal API endpoint with a limit and returns objects. Used by list_threat_profiles to fetch /threat_profiles.
async def consume_vt_iterator( vt_client: vt.Client, endpoint: str, params: dict | None = None, limit: int = 10): """Consumes a vt.Iterator iterator and return the list of objects.""" res = [] async for obj in vt_client.iterator(endpoint, params=params, limit=limit): res.append(obj) return res