Skip to main content
Glama
threadlinqs-cmd

Intel Threadlinqs MCP

Entity Aliases (reverse)

get_entity_aliases
Read-onlyIdempotent

Resolve any alias to its canonical entity and list all other aliases that map to it, revealing where distinct names collide into one actor.

Instructions

Every alias the reference set maps to ONE entity — the reverse of resolve_entity, which only walks a single alias forward. Use it to check alias collision: the commonest reason two "different actors" turn out to be one. IMPORTANT: the source (MISP) OVER-MERGES — it folds subgroups into their parent, so "andariel" and "bluenoroff" both appear under "Lazarus Group". An alias entry is a MAPPING, not an assertion of identity. Each alias therefore carries relation (canonical|subgroup|alias), other_entities (how many other entities claim the same label) and corpus_threats (how many threats this platform files under that exact label); corpus_uses_separately lists labels the corpus treats as their own actor despite the merge. Accepts a name or a uuid.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nameNoName or alias to expand (e.g. "andariel"). Resolved exact-then-fuzzy, same ladder as resolve_entity.
typeNoOptional: actor|malware|tool|sector|region|technique|campaign — narrows name resolution.
uuidNoEntity uuid, if you already have one from resolve_entity. Skips resolution.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
uuidNo
caveatNoOver-merge warning. Do not drop it when summarising.
aliasesNo
clusterNo
matchedYes
canonicalNo
alias_countNo
entity_typeNo
matched_viaNouuid | exact | fuzzy
corpus_uses_separatelyNo
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare a safe read, but the description adds material behavior: the data source over-merges subgroups, alias entries are mappings not identity assertions, and relation/other_entities/corpus_uses_separately carry distinguishing semantic meaning. This is valuable context the annotation schema cannot convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence earns its place: reverse relationship, usage guidance, data-quality warning, key output semantics, and accepted inputs. The structure front-loads the differentiating relationship and remains dense without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists, the description need not restate return formats; instead it provides the conceptual semantics that make the results interpretable, plus the over-merge warning that affects correct reasoning. It is complete for an agent deciding whether and how to invoke this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3 and the schema already documents name, type, and uuid well. The description matches the input fields but adds no meaningful parameter details beyond what the schema states; its extra content is about output semantics and caveats.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence gives a specific verb and resource ('Every alias the reference set maps to ONE entity') and explicitly contrasts it with resolve_entity, which 'only walks a single alias forward.' This immediately distinguishes it from a close sibling and makes the reverse-relationship clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It names the exact use case ('Use it to check alias collision') and the alternative tool (resolve_entity), while explaining how this tool differs and the common failure it addresses. The MISP over-merging caveat also tells the agent when the data may be misleading.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/threadlinqs-cmd/intelthreadlinqs-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server