Skip to main content
Glama
threadlinqs-cmd

Intel Threadlinqs MCP

Known Actor Links

get_actor_relationships
Read-onlyIdempotent

Check which threat-actor relationships are already publicly documented (subgroup, overlaps, similar, linked-to) before claiming novelty. Returns UUIDs, sources, and matches in both directions.

Instructions

The platform's baseline of ALREADY-DOCUMENTED links between threat actors (subgroup / overlaps / similar / linked-to) with both uuids and the source. Call this before claiming any actor-to-actor relationship is new — it is the only surface that says whether a link is public knowledge. CRITICAL: this table is sparse, covering a small minority of the corpus's actor labels (the response carries live coverage numbers). An empty result means the link is UNRECORDED, never that it was disproved or that the actors are unrelated. Use it to rule a claim out of NOVELTY, never to rule a relationship out of EXISTENCE. Matches both slots, so it also returns rows where your actor is the target — get_actor's relationship list does not.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
actorNoOptional: only rows naming this actor on either side (e.g. "Lazarus Group"). Omit to list the whole baseline.
limitNoDefault 50, max 200.
rel_typeNoOptional: filter by relationship type. The response's coverage.rel_types lists what is actually present.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
dataYes
countNo
caveatYesAbsence-is-not-evidence statement. Do not drop it when summarising.
coverageYes
unrecordedNoPresent and true when an `actor` filter matched nothing. Means UNRECORDED, not "no relationships exist".
unrecorded_noteNo
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint, idempotentHint, and destructiveHint annotations, the description discloses that the table is sparse, that empty results mean 'unrecorded' rather than 'disproved', and that live coverage numbers are included in the response. This semantic nuance is essential for avoiding false negative conclusions and is not available from annotations alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and each sentence carries distinct value: scope, novelty semantics, exclusion semantics, sparsity warning, and parameter behavior. It is longer than an average description but every sentence earns its place, and the CRITICAL flag correctly draws attention to the most important interpretive rule.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description fully contextualizes this tool: it tells the agent why it exists, what it cannot prove, what emptiness means, how it differs from an alternative, and what live coverage info will accompany the response. Combined with an output schema, nothing needed for correct invocation or interpretation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so parameters are already documented, but the description adds operational meaning: actor applies to either side, 'Omit to list the whole baseline', and rel_type results can be discovered through the response's coverage.rel_types field. This goes beyond the schema's structural descriptions without being redundant.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource (already-documented actor-to-actor links) with a specific verb (get) and explicitly lists relationship types like subgroup/overlaps/similar/linked-to. It also distinguishes itself from get_actor's relationship list by noting it matches both actor slots, so an agent can tell this tool apart from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says when to call it ('Call this before claiming any actor-to-actor relationship is new') and what not to infer from it ('never to rule a relationship out of EXISTENCE'). It even names the alternative behavior in get_actor that differs, giving the agent clear routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/threadlinqs-cmd/intelthreadlinqs-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server