Skip to main content
Glama
180,147 tools. Last updated 2026-06-05 14:58

"Information about Threat Intelligence" matching MCP tools:

  • Returns information about safety features on Makuri, including age verification, content filtering, parental controls, and AI safety guardrails. Use when the user asks about child safety, content moderation, or how Makuri protects minors.
    Connector
  • Active threat campaigns — coordinated attacker activity that exceeds the noise floor. ≥5 distinct actors, ≥3 ASNs, ≤5 destination ports, ≥1h history.
    Connector
  • Returns structured information about what the Recursive platform includes: features, AI model details, supported integrations, and what's included at every tier. Use for systematic feature comparison.
    Connector
  • FREE live threat assessment sample — current threat level, confidence score, event distribution, and scan freshness for a monitored location. Proves data is live and continuously updated. No flagged items or entities (upgrade to get_threat_summary for full detail). Try location='culpeper-town' or browse_catalog path='ThreatIntel' for all locations.
    Connector
  • Query URLhaus for a specific URL and its host. is_malicious is True only when there is ACTIVE evidence — exact URL match with url_status='online' (or unknown) OR host has urls_online > 0. URLhaus retains historical records forever, so a host can have url_count > 0 with urls_online == 0; in that case is_malicious=False, is_stale=True, threat_level='low'. Use for URL-level threat assessment; use threat_intel for domain-level checks. Companion threat-investigation tools: ioc_lookup (multi-source IOC: ThreatFox + URLhaus + Feodo Tracker, auto-detect type), hash_lookup (file-hash malware family, MalwareBazaar), threat_intel (domain-level URLhaus only). Free: 30/hr, Pro: 500/hr. Returns {url, host, is_malicious, is_stale, urlhaus_host:{found,urls_online,url_count}, urlhaus_url:{found,threat,tags,status}, threat_level, summary}.
    Connector
  • List CVEs indexed from MITRE/GHSA BEFORE NVD publication (early-warning, freshest data). By default each result is slim (no description, no cvss_breakdown, no affected_products list, no references) — pass include='full' for the same payload shape as cve_lookup; for drill-down on a single CVE prefer cve_lookup. Use for threat intelligence on emerging CVEs; use cve_search for published NVD data. Verdict (sources_queried, falsifiable_fields, completeness, data_age) is at the response root — applies to the whole batch, not per-row. Response carries a global hint pointing at cve_lookup — drill into any returned cve_id for full detail and chained pivots (exploit_lookup, kev_detail, cwe_lookup). Free: 30/hr, Pro: 500/hr. Returns {count, total, truncated, offset, summary, results, next_offset, verdict, hint}.
    Connector

Matching MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Aggregates real-time threat intelligence from multiple sources including Feodo Tracker, URLhaus, CISA KEV, and ThreatFox, with IP/hash reputation checking via VirusTotal, AbuseIPDB, and Shodan for comprehensive security monitoring.
    Last updated
    11
    27
    MIT
  • F
    license
    -
    quality
    C
    maintenance
    Enables querying threat intelligence data about files, URLs, IPs, and domains from multiple abuse.ch platforms (MalwareBazaar, URLhaus, and ThreatFox) through a unified API. Provides comprehensive security reports and threat analysis data for cybersecurity investigations.
    Last updated
    2

Matching MCP Connectors

  • IMPORTANT: Always use this tool FIRST before working with Vaadin. Returns a comprehensive primer document with current (2025+) information about modern Vaadin development. This addresses common AI misconceptions about Vaadin and provides up-to-date information about Java vs React development models, project structure, components, and best practices. Essential reading to avoid outdated assumptions. For legacy versions (7, 8, 14), returns guidance on version-specific resources.
    Connector
  • Get detailed information about a specific train connection including all intermediate stops, platforms, and occupancy. Use a trip ID from search_connections results.
    Connector
  • Find historical instances of a signal type on an asset over the last N days and compute forward returns (1h/4h/24h), win rate, and Sharpe. Lets an agent reason about EV before trading. Killer feature: turns predmcp from data API into edge-proven intelligence.
    Connector
  • Check connectivity with SafeDep threat intelligence service. Use this ONLY ONCE per session to verify your connection is working. Do not call repeatedly to avoid latency.
    Connector
  • Counterparty risk intelligence for any agent. Returns risk tier (low/moderate/elevated/high/severe/critical), raw trust signals, data coverage, and methodology reference. Designed for marketplace operators and escrow providers setting transaction parameters before a deal. Full methodology: https://rnwy.com/risk-intelligence
    Connector
  • Get information about the authenticated agent, including type, spending limits, approved categories, and configuration. Requires authentication — call 'authenticate' with your sk_buy_* key first.
    Connector
  • Retrieve detailed information about a Baselight user including their profile bio, website, and public datasets. Use this to understand who owns datasets you're interested in.
    Connector
  • Get detailed information about a specific train connection including all intermediate stops, platforms, and occupancy. Use a trip ID from search_connections results.
    Connector
  • Get detailed information about a specific train connection including all intermediate stops, platforms, and occupancy. Use a trip ID from search_connections results.
    Connector
  • As a CTO, assess the exploitability risk of CVEs using EPSS scores and cloud asset exposure data. Input a CVE ID (e.g., CVE-2021-44228) to receive exploitability likelihood, affected cloud services, and threat intelligence context. Returns structured risk metrics for prioritization. Sources: CVE NVD, OpenCVE, GitHub Advisories. Pass async:true to avoid timeout.
    Connector
  • Retrieve state-level land intelligence data covering regulation, climate, solar potential, water access, and building codes. Call this when the user wants general context about a US state before drilling into a specific property. Returns structured multi-mode profiles.
    Connector
  • Look up a MITRE ATT&CK threat group (intrusion set) or software entry by name or ID for authorized penetration testing and threat intelligence. Returns the group or software record: ATT&CK ID, display name, known aliases, type (group vs. software), description, and the techniques it uses with procedure-level context from public ATT&CK reporting. Accepts exact ATT&CK IDs (G0007 for threat groups, S0002 for software) or keyword/name search (e.g., "APT28", "Mimikatz", "Lazarus Group"). Equally useful for defenders building detection coverage around specific adversary tradecraft.
    Connector