No user-submitted related servers found.
Scored across 28 tools
Most tools are neatly separated by STIX entity type via the search_<entity> family, so an agent can usually pick the right one. However, search_threat_intel broadly overlaps with every specific search, and lookup_ioc vs. lookup_hash creates ambiguity for hash lookups.
Tool names consistently follow a lowercase snake_case verb_noun structure, with search_<entity> dominating the set. The mix of search, lookup, get, list, and force verbs is mostly predictable, though force_reconnect and the generic search_threat_intel are minor deviations from the clearer noun patterns.
At 28 tools this is on the heavy side, but the count is largely driven by comprehensive coverage of OpenCTI's many STIX entity types. Several operational tools like get_cache_stats and get_network_status add bulk and could be trimmed, yet each search tool has a distinct target.
For a read-only threat intelligence investigation server, the surface is quite complete: it covers major STIX entities, IOC lookup, generic entity details, relationships, recent indicators, and health/connector status. It lacks create/update/delete operations, but the tool names suggest the server is intentionally query-focused, so this is a minor gap rather than a critical one.