Scored across 81 tools
The descriptions are unusually thorough, but the set is dense with overlapping families: get_threat / get_threat_enrichment / get_threat_bundle / get_threat_hunting_bundle, get_cve / get_cve_intelligence, get_actor / get_actor_intelligence, get_ioc_intelligence / get_entity_profile, and the multiple campaign tools. An agent can easily pick a differently-scoped variant and get a different result shape than expected. The detailed caveats are the only thing keeping this from a 1.
The overwhelming majority of tool names follow a clear verb_noun snake_case pattern: get_threat, search_threats, list_debriefs, export_stix, generate_c2_blocklist, explain_correlation, and hunt_schema. Minor deviations like `health` and bare `hunt`, plus the alternation between get/search on very similar resources, keep it from a perfect 5.
81 tools is far beyond a workable MCP surface; the list itself becomes the main cognitive burden for an agent. The many get_*_intelligence and bundle tools show the platform knows fragmentation is a problem, but they add to rather than reduce the raw count.
The threat-intelligence domain is covered remarkably well: threats, actors, malware, tools, campaigns, CVEs, CWEs, IOCs, detections, C2, MITRE, ATT&CK Flows, and correlation evidence all have dedicated lookup and search paths. There are only minor workaroundable gaps such as some endpoints without full pagination and some stored-only enrichment layers.