Threat Intelligence MCP Server

Server Quality Checklist

Profile completionA complete profile improves this server's visibility in search results.

Latest release: v0.2.0
Disambiguation5/5
Each tool has a clearly distinct purpose with no ambiguity. The tools cover specific threat intelligence operations like checking IPs/hashes, fetching feeds, getting CISA KEVs, retrieving IOCs, and managing cache/stats, all with well-defined boundaries. There is no overlap that would cause misselection.
Naming Consistency5/5
Tool names follow a consistent verb_noun pattern throughout, such as check_bulk_ips, fetch_threat_feed, get_cisa_kev, and clear_threat_cache. All tools use snake_case with clear, descriptive names that align with their functions, making them predictable and readable.
Tool Count5/5
With 11 tools, the count is well-scoped for a threat intelligence server, covering essential operations like reputation checks, feed management, data retrieval, and cache control. Each tool earns its place without feeling excessive or insufficient for the domain.
Completeness5/5
The tool surface provides complete coverage for threat intelligence workflows, including checking various IOCs (IPs, hashes, networks), fetching and managing feeds, retrieving vulnerabilities and recent IOCs, and supporting dashboards and statistics. There are no obvious gaps that would hinder agent operations.
Average 3.2/5 across 11 of 11 tools scored.
See the Tool Scores section below for per-tool breakdowns.
- No community issues in the last 6 months
- 1 commit in the last 12 weeks
- No stable releases found
- No critical vulnerability alerts
- No high-severity vulnerability alerts
- No code scanning findings
- CI status not available
This repository is licensed under MIT License.
This repository includes a README.md file.
No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.
Tip: use the "Try in Browser" feature on the server page to seed initial usage.
Add a glama.json file to provide metadata about your server.
If you are the author, simply .
If the server belongs to an organization, first add glama.json to the root of your repository:
```
{
  "$schema": "https://glama.ai/mcp/schemas/server.json",
  "maintainers": [
    "your-github-username"
  ]
}
```
Then . Browse examples.
Add related servers to improve discoverability.

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions bulk checking against threat feeds but lacks critical behavioral details: it doesn't specify rate limits, authentication needs, data sources, or what happens on errors. For a tool with no annotation coverage, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded, with the core purpose stated first. The 'Args' and 'Returns' sections add structure without redundancy. However, the 'Returns' section could be more concise, as the output schema exists, making some details unnecessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (bulk IP checking), no annotations, and an output schema present, the description is partially complete. It covers the basic purpose and parameter format but lacks usage guidelines, behavioral context, and error handling details. The output schema reduces the need to explain return values, but overall completeness is adequate with clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0%, so the description must compensate. It adds value by explaining that 'ips' accepts a 'JSON array of IP addresses or comma-separated list', which clarifies the input format beyond the schema's 'type: string'. However, it doesn't detail validation rules, IP format requirements, or size limits, leaving some semantics unclear.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Check multiple IP addresses against threat feeds in bulk.' It specifies the verb ('check'), resource ('IP addresses'), and scope ('bulk'), distinguishing it from single-IP tools like 'check_ip_reputation'. However, it doesn't explicitly differentiate from other bulk tools like 'check_network_against_threats', keeping it from a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention when to prefer this over 'check_ip_reputation' for single IPs or how it differs from 'check_network_against_threats' for bulk checks. No exclusions or prerequisites are stated, leaving usage unclear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions 'multiple threat intelligence sources' but doesn't specify which sources, latency, rate limits, authentication needs, or error handling. For a tool that likely queries external APIs, this leaves critical operational details unclear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose, followed by structured 'Args' and 'Returns' sections. It's efficient with minimal waste, though the 'Returns' section could be more specific about the JSON structure instead of just stating 'JSON with reputation data'.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (single parameter, threat intelligence query), the description covers the basics but lacks depth. The output schema exists, so return values needn't be detailed, but behavioral aspects like source reliability or rate limits are missing, making it adequate but incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0%, but the description explicitly documents the single parameter ('ip: IP address to check'), adding essential meaning beyond the bare schema. However, it doesn't provide format details (e.g., IPv4 vs. IPv6) or validation rules, so it only partially compensates for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Check an IP address against multiple threat intelligence sources.' It specifies the verb ('check') and resource ('IP address'), though it doesn't explicitly differentiate from sibling tools like 'check_bulk_ips' or 'check_hash_reputation' beyond the IP focus.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'check_bulk_ips' for multiple IPs or 'check_hash_reputation' for non-IP checks. It lacks context on prerequisites, limitations, or exclusions, leaving the agent to infer usage from tool names alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool checks against threat intelligence and returns JSON with matches, but lacks critical details: whether this is a read-only operation, if it requires authentication, rate limits, what happens on errors, or if it modifies any state (e.g., updates a cache). For a security tool with zero annotation coverage, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded: the first sentence states the core purpose, followed by structured 'Args' and 'Returns' sections. Each sentence earns its place by providing essential information without redundancy. Minor improvements could include integrating the sections more fluidly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (security analysis), no annotations, and an output schema exists (implied by 'Returns: JSON'), the description is moderately complete. It covers the basic operation and parameter semantics but lacks behavioral context (e.g., safety, performance) and usage guidelines. The output schema reduces the need to explain return values, but more context is needed for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0%, so the description must compensate. It adds meaning by specifying that 'scan_results' is a 'JSON string from network scanner with device IPs', which clarifies the parameter's format and content beyond the schema's generic 'string' type. However, it doesn't detail the exact JSON structure or provide examples, leaving some ambiguity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Check network scan results against threat intelligence.' It specifies the verb ('check') and resource ('network scan results'), and distinguishes it from siblings like check_ip_reputation by focusing on bulk scan results rather than individual IPs. However, it doesn't explicitly differentiate from check_bulk_ips, which might be a similar sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like check_bulk_ips or check_ip_reputation. It mentions 'scan results' but doesn't clarify prerequisites (e.g., requires prior network scanning) or exclusions (e.g., not for single IPs). This leaves the agent to infer usage from context alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool fetches and parses a feed, implying a read operation, but doesn't cover critical aspects like authentication needs, rate limits, error handling, or whether it caches results. For a tool with no annotation coverage, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded, with the core purpose stated first. The 'Args' and 'Returns' sections are structured clearly, though they could be integrated more seamlessly. There's minimal waste, but it could be slightly more polished in flow.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema (returns JSON with IOCs), the description doesn't need to explain return values in detail. It covers the basic purpose and parameter semantics adequately. However, with no annotations and incomplete behavioral transparency, it could do more to address gaps like error cases or performance considerations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0%, but the description compensates by explaining the 'feed_name' parameter: 'Name of the feed (feodo_tracker, urlhaus_recent, etc.)'. This adds meaning beyond the bare schema, providing examples and context. However, it doesn't detail all possible feed names or constraints, so it partially addresses the coverage gap but not fully.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Fetch and parse a specific threat intelligence feed.' It specifies the verb ('fetch and parse') and resource ('threat intelligence feed'), distinguishing it from siblings like 'check_ip_reputation' or 'get_recent_iocs' that focus on reputation checks or recent IOCs rather than fetching feeds. However, it doesn't explicitly differentiate from 'get_threat_feeds', which might be similar.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention siblings like 'get_threat_feeds' (which might list available feeds) or 'get_recent_iocs' (which might fetch recent IOCs without specifying a feed), leaving the agent to infer usage context. There's no explicit when/when-not or alternative recommendations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions the return format ('JSON with available feeds and their descriptions'), which adds some context, but lacks details on permissions, rate limits, caching behavior, or whether this is a read-only operation. For a tool with zero annotation coverage, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and front-loaded, stating the purpose in the first sentence and the return format in the second. Both sentences add value, with no wasted words. However, it could be slightly more structured by explicitly separating usage context from output details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema, the description doesn't need to explain return values in detail, which it acknowledges. However, with no annotations and multiple sibling tools, the description lacks context on behavioral traits and usage differentiation. It's minimally adequate but has clear gaps in guiding the agent effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, so no parameter documentation is needed. The description doesn't add parameter details, which is appropriate given the schema's completeness. A baseline of 4 is applied since there are no parameters to document.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and resource 'list of all available threat intelligence feeds', making the purpose understandable. However, it doesn't explicitly differentiate from sibling tools like 'fetch_threat_feed' or 'get_recent_iocs', which might have overlapping functionality. The description is specific about what it returns but lacks sibling distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With siblings like 'fetch_threat_feed' and 'get_recent_iocs', there's no indication of whether this tool is for metadata listing, bulk retrieval, or other contexts. No prerequisites or exclusions are mentioned, leaving usage ambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It states the action ('clear cache') and outcome ('force fresh data fetch'), but lacks critical behavioral details: it doesn't specify permissions required, whether this is destructive (e.g., deletes cached data), rate limits, or side effects on other tools. The mention of 'JSON confirmation' is vague about response structure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is highly concise and well-structured: two brief sentences that front-load the core action and mention the return type without redundancy. Every sentence adds value, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (0 parameters, output schema exists), the description is moderately complete. It covers the basic purpose and return format, but as a mutation tool with no annotations, it should ideally include more behavioral context (e.g., safety, permissions) to be fully helpful for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters with 100% schema description coverage, so no parameter documentation is needed. The description doesn't add param details, which is appropriate, earning a baseline score of 4 for not introducing unnecessary information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Clear') and resource ('threat intelligence cache'), and distinguishes it from siblings by focusing on cache management rather than threat checking or data retrieval. However, it doesn't explicitly differentiate from all siblings (e.g., 'fetch_threat_feed' also involves data fetching).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides minimal guidance: it implies usage when fresh data is needed, but offers no explicit when/when-not rules, prerequisites, or alternatives. It doesn't compare with siblings like 'fetch_threat_feed' or 'get_threat_feeds' that might overlap in data freshness contexts.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool returns aggregated threat data for visualization, but doesn't cover critical aspects such as whether it's a read-only operation, potential rate limits, authentication requirements, data freshness, or any side effects. For a tool with no annotation coverage, this leaves key behavioral traits unspecified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is highly concise and well-structured: two sentences that directly state the purpose and return format without any fluff. The first sentence explains what the tool does, and the second clarifies the output, making it front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 0 parameters, 100% schema coverage, and an output schema exists, the description doesn't need to detail inputs or return values. However, it lacks context on usage scenarios, behavioral traits, and differentiation from siblings, which are important for a tool in a server with multiple threat intelligence tools. The description is minimally adequate but has clear gaps in guidance and transparency.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, so no parameter documentation is needed. The description doesn't add parameter-specific information, which is appropriate here. A baseline of 4 is applied since there are no parameters to document, and the description doesn't introduce any confusion or redundancy regarding inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get a summary of all threat intelligence for dashboard display.' It specifies the verb ('Get') and resource ('summary of all threat intelligence'), and the context ('for dashboard display') provides additional clarity. However, it doesn't explicitly differentiate from sibling tools like 'get_threat_stats' or 'get_recent_iocs', which might also provide aggregated data, so it doesn't reach the highest score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It mentions 'dashboard display' as a context, but doesn't specify scenarios, prerequisites, or exclusions. With sibling tools like 'get_threat_stats' and 'get_recent_iocs' that might overlap, the lack of comparative guidance is a significant gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions that the tool returns 'JSON with recent IOCs' but doesn't specify details like pagination, rate limits, authentication requirements, or error handling. For a tool with potential security implications (IOCs), this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded with the core purpose, followed by clear sections for 'Args' and 'Returns'. Every sentence earns its place by providing essential information without redundancy, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (2 parameters, no annotations, but with an output schema), the description is somewhat complete but has gaps. It covers parameters well and notes the return format, but lacks behavioral context (e.g., auth, rate limits) and doesn't leverage the output schema to detail the JSON structure, leaving room for improvement in overall completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It effectively explains both parameters: 'ioc_type' with its filter options (e.g., 'ip:port', 'domain') and 'limit' with its default and max values. This adds crucial meaning beyond the bare schema, though it could benefit from more detail on format constraints (e.g., URL encoding).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Get') and resource ('recent IOCs from ThreatFox'), making the purpose understandable. However, it doesn't explicitly differentiate from sibling tools like 'fetch_threat_feed' or 'get_threat_feeds', which might also retrieve threat data, leaving some ambiguity about when to choose this specific tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'fetch_threat_feed' or 'get_threat_feeds'. The description lacks context about prerequisites, such as whether authentication is needed, or any explicit exclusions, leaving the agent to infer usage based on the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions 'cache status' which hints at behavioral aspects related to caching, but doesn't disclose details like whether this is a read-only operation, performance characteristics, or error handling. The description adds some context but lacks comprehensive behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness3/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief with two sentences, but the second sentence 'Returns: JSON with threat intelligence statistics' is redundant given the output schema exists. This wastes space without adding value, reducing efficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (0 parameters, output schema provided), the description is mostly complete. It covers the purpose and hints at cache-related behavior, but could benefit from more usage guidance relative to siblings. The output schema handles return values, so no need to explain them in the description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, so no parameter documentation is needed. The description doesn't add parameter details, which is appropriate here, and the baseline for 0 parameters is 4, as it avoids unnecessary repetition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with the verb 'Get' and resource 'statistics about loaded threat data and cache status', making it easy to understand what the tool does. However, it doesn't explicitly differentiate from sibling tools like 'get_dashboard_summary' or 'get_threat_feeds', which might provide overlapping or related statistics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With siblings like 'get_dashboard_summary' and 'get_threat_feeds' that might offer similar or complementary data, there's no indication of context, prerequisites, or exclusions to help an agent choose appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions the tool checks against threat intelligence, but does not disclose behavioral traits such as rate limits, authentication needs, data sources, or error handling. This leaves significant gaps for a tool that likely queries external services.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded with the core purpose, followed by structured sections for args and returns. It avoids unnecessary details, though the 'Args' and 'Returns' headings could be integrated more seamlessly into the flow.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema (returns JSON with reputation data), the description does not need to explain return values. It covers the basic purpose and parameter semantics adequately, but could improve by adding more behavioral context (e.g., rate limits) to compensate for the lack of annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description adds meaning by specifying the parameter as a 'file hash' and listing supported hash types (MD5/SHA1/SHA256). However, it does not detail format constraints (e.g., length, case sensitivity) or provide examples, leaving some ambiguity beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('check') and resource ('file hash') against a target ('threat intelligence'). It distinguishes from siblings by specifying hash checking (vs. IPs, networks, feeds, etc.) and mentions supported hash types (MD5/SHA1/SHA256), making it unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for checking file hashes against threats, but does not explicitly state when to use this tool versus alternatives like check_ip_reputation or check_bulk_ips. It provides some context (e.g., hash types) but lacks explicit guidance on exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions the tool 'gets' data and returns JSON, but fails to describe critical behaviors such as whether this is a read-only operation (implied but not stated), any rate limits, authentication requirements, or what happens with invalid inputs (e.g., negative days). For a tool with no annotation coverage, this leaves significant gaps in understanding its operational traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded with the core purpose, followed by clear sections for arguments and returns. Every sentence earns its place: the first states what the tool does, the next two explain parameters succinctly, and the last specifies the return format. There is zero waste, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (2 parameters, no nested objects) and the presence of an output schema (which handles return values), the description is largely complete. It covers the purpose, parameters, and return format adequately. However, it lacks details on behavioral aspects like error handling or data freshness, which would be helpful since no annotations are provided to fill those gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description must compensate by explaining parameters, which it does effectively. It clarifies that 'days' retrieves vulnerabilities added in the last N days with a default of 30, and 'vendor' is an optional filter by vendor name. This adds meaningful context beyond the bare schema, covering both parameters' purposes and defaults, though it could benefit from examples or format details (e.g., vendor name casing).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Get') and resource ('CISA Known Exploited Vulnerabilities'), making it immediately understandable. It distinguishes itself from sibling tools like 'get_recent_iocs' or 'get_threat_feeds' by focusing specifically on CISA's KEV database, which is a distinct dataset of known exploited vulnerabilities rather than general indicators or feeds.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage through the mention of filtering by days and vendor, suggesting it's for retrieving recent or vendor-specific vulnerabilities. However, it lacks explicit guidance on when to use this tool versus alternatives like 'get_recent_iocs' (which might overlap in recency) or 'check_network_against_threats' (which could involve KEV data), leaving the agent to infer context without clear exclusions or named alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

Confirm that the MCP server is working as expected.
Confirm that there are no obvious security issues.
Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

Copy to your README.md:

[![world-intel-mcp MCP server](https://glama.ai/mcp/servers/marc-shade/world-intel-mcp/badges/card.svg)](https://glama.ai/mcp/servers/marc-shade/world-intel-mcp)

Score Badge

Copy to your README.md:

[![world-intel-mcp MCP server](https://glama.ai/mcp/servers/marc-shade/world-intel-mcp/badges/score.svg)](https://glama.ai/mcp/servers/marc-shade/world-intel-mcp)

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/marc-shade/world-intel-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server