io.github.No3men60/ot-intel-api

Est-ce que io.github.No3men60/ot-intel-api est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.No3men60/ot-intel-api » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 40 outils

• getActionConformance≈ 459 tokens

  Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector/region context. Built on the same capability x opportunity x intent scoring as /ot/threat-score, with auditable rules layered on top — no LLM in the decision path. auto_approve requires vendor_stack; omitting it caps the verdict at human_review regardless of score. Price: $0.12 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (6)

  Paramètres

  • actor · string · requis
    ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME
  • region · string · requis
    Target region e.g. GCC, KSA, UAE, Europe
  • sector · string · requis
    Target sector e.g. energy, water, manufacturing
  • vendor_stack · string · optionnel
    Comma-separated vendor list e.g. 'Schneider Modicon,Siemens SIMATIC'. REQUIRED for auto_approve to be reachable at all; omitting it caps the verdict at human_review.
  • asset_context · string · optionnel
    Optional free text, e.g. 'shared_infra:cloudflare' — escalates to human_review when shared cloud/CDN infra is detected
  • planned_action · string · requis · block_ip | block_domain | quarantine_host | isolate_segment | halt_pipeline | disable_account
    The remediation action being gated

  Exemple d'appel

  {"name": "getActionConformance", "arguments": {"actor": "texte", "region": "texte", "sector": "texte", "planned_action": "block_ip"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getActorDossier≈ 205 tokens

  Comprehensive intelligence dossier for an ICS threat actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/ioc, /ot/asn, /ot/detection. Returns full profile, infrastructure analysis, IOC table, detection rules, kill chain mapping, and MITRE ATT&CK coverage. Price: $0.35 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (1)

  Paramètres

  • actor · string · requis
    Actor name e.g. SANDWORM, XENOTIME, VOLTZITE

  Exemple d'appel

  {"name": "getActorDossier", "arguments": {"actor": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getActorReport≈ 261 tokens

  Synthesised Markdown threat report for an ICS/APT actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/advisory, /ot/detection internally (no extra charge) and synthesises via DeepSeek. Returns executive summary, actor profile, active campaigns, malware families, sector targeting, ATT&CK mappings, recommended actions. TLP: WHITE. Price: $0.25 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (2)

  Paramètres

  • actor · string · requis
    Actor name e.g. CHERNOVITE, SANDWORM, VOLTZITE, XENOTIME
  • sector · string · optionnel
    Optional sector focus e.g. energy, water, manufacturing

  Exemple d'appel

  {"name": "getActorReport", "arguments": {"actor": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getActorsBySector≈ 179 tokens

  All ICS threat actors targeting a specific industrial sector from live MITRE ATT&CK ICS STIX data. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (1)

  Paramètres

  • sector · string · requis
    Sector e.g. energy, water, manufacturing, oil-and-gas, chemical, nuclear

  Exemple d'appel

  {"name": "getActorsBySector", "arguments": {"sector": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getAdvisories≈ 223 tokens

  Latest CISA ICS-CERT advisories filtered by vendor or sector. Returns advisory IDs, CVSS scores, CVE lists, OT severity, and direct triage links. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (3)

  Paramètres

  • limit · integer · optionnel
    Page size, default 10
  • sector · string · optionnel
    Sector filter e.g. energy, water, manufacturing
  • vendor · string · optionnel
    Vendor filter e.g. siemens, schneider, rockwell

  Exemple d'appel

  {"name": "getAdvisories", "arguments": {"limit": 1, "sector": "texte", "vendor": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getAiAttackFeasibility≈ 404 tokens

  Deterministic lookup against one specific empirical study (Cook, Stoica, Shah & Pezaros, ACM Trans. Priv. Sec. 29, 3, Article 31, June 2026) testing whether off-the-shelf general-purpose LLMs can generate working attack code against real PLCs. Only 3 vendors tested (Siemens, Schneider Electric, Rockwell Automation); only Network/Register-Tags techniques ever succeeded (zero for Application Code/Firmware); 1.08% overall end-to-end success rate. Claude models were excluded by the paper's own authors due to stronger safety guardrails. Distinct from /ot/ai-exposure (vendor's own AI copilot) and /ot/ai-uplift (open-ended reconnaissance-uplift synthesis). Deterministic, no LLM in the lookup path. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (3)

  Paramètres

  • vendor · string · optionnel
    Siemens, Schneider Electric, or Rockwell Automation — only these three were tested in the study.
  • campaign · string · optionnel
    Industroyer2, Fuxnet, FrostyGoop, INCONTROLLER, Stuxnet, or Triton.
  • technique · string · optionnel
    MITRE ICS technique name or ID, e.g. 'Brute Force I/O' or T0806. At least one of technique, vendor, or campaign required.

  Exemple d'appel

  {"name": "getAiAttackFeasibility", "arguments": {"vendor": "texte", "campaign": "texte", "technique": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getAiExposure≈ 262 tokens

  AI/agentic copilot exposure lookup for OT/ICS vendors. Returns the vendor's documented AI/agentic copilot, autonomy level (advisory vs agentic — the key risk differentiator), access, and applicable MITRE ATLAS techniques. Hand-verified mapping, ATLAS IDs confirmed against the live atlas.mitre.org matrix. Deterministic, no LLM in the lookup path. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (1)

  Paramètres

  • vendor · string · requis
    OT/ICS vendor name e.g. Siemens, Schneider Electric, Rockwell Automation, ABB, Emerson, Honeywell, Yokogawa, GE Vernova, Omron, Mitsubishi Electric

  Exemple d'appel

  {"name": "getAiExposure", "arguments": {"vendor": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getAiUplift≈ 354 tokens

  Assesses how much a general-purpose AI agent lowers the skill/time barrier for an attacker to reach a vendor's OT-adjacent footprint. Grounded in a real-world precedent (Dragos, May 2026), not frontier-model governance thresholds. Distinct from /ot/ai-exposure, which covers a vendor's OWN embedded AI copilot. DeepSeek-synthesised, ICD-203 estimative language. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (5)

  Paramètres

  • vendor · string · requis
    OT/ICS vendor name e.g. Schneider Electric, Siemens, Rockwell Automation
  • product · string · optionnel
    Optional product line filter e.g. Modicon, SIMATIC
  • auth_type · string · optionnel
    single-factor, mfa, or unknown (default)
  • segmented · string · optionnel
    true, false, or unknown (default). If all three deployment-context params are unknown, the tier is capped at informational.
  • internet_facing · string · optionnel
    true, false, or unknown (default)

  Exemple d'appel

  {"name": "getAiUplift", "arguments": {"vendor": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getAnalystBrief≈ 230 tokens

  Human-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector. Same fan-out data as /ot/report but synthesised into a short decision-ready brief instead of a full report. Price: $0.12 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (2)

  Paramètres

  • actor · string · requis
    ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME
  • sector · string · optionnel
    Optional target sector e.g. energy, water, manufacturing

  Exemple d'appel

  {"name": "getAnalystBrief", "arguments": {"actor": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getAsnProfile≈ 251 tokens

  Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, NakedPages), bulletproof hosting indicators, abuse categories (c2, staging, phishing), and an OT-specific blocking recommendation with WAF rule hint. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (2)

  Paramètres

  • asn · string · requis
    ASN identifier e.g. AS215540, AS9009, AS29802
  • org · string · optionnel
    Optional org name fragment e.g. hivelocity, m247

  Exemple d'appel

  {"name": "getAsnProfile", "arguments": {"asn": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getAssetExposure≈ 312 tokens

  Synthesises vendor, model, firmware, sector, and network context into a branchable risk verdict. Returns risk_score (0-100), escalate (boolean), recommended_action, and contributing threat actors. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (5)

  Paramètres

  • model · string · requis
    e.g. s7-1500, modicon-m340, controllogix
  • sector · string · requis
    energy | water | manufacturing | oil-and-gas | chemical | nuclear
  • vendor · string · requis
    e.g. siemens, schneider, rockwell, ge, honeywell
  • network · string · requis
    internet-facing | dmz | lan-only | air-gapped
  • firmware · string · optionnel
    Firmware version e.g. 2.9.2 — enables firmware-specific CVE matching

  Exemple d'appel

  {"name": "getAssetExposure", "arguments": {"model": "texte", "sector": "texte", "vendor": "texte", "network": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getCampaigns≈ 223 tokens

  Active campaigns targeting a specific industrial sector. Returns campaign name, attributed actor, start date, targeted geography, TTPs in use, and CVEs being exploited. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (2)

  Paramètres

  • sector · string · requis
    energy | water | manufacturing | oil-and-gas | electric | nuclear | chemical
  • status · string · optionnel · active | all
    active (default) or all

  Exemple d'appel

  {"name": "getCampaigns", "arguments": {"sector": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getClaimReliability≈ 311 tokens

  Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against the paper's three failure modes — spurious correlation, contradictory knowledge, constrained generalization — using intel.db grounding plus DeepSeek synthesis. Returns a reliability score, verdict, corroborating/contradicting evidence, and confidence. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (3)

  Paramètres

  • actor · string · optionnel
    Optional actor name to ground the claim against intel.db, e.g. SANDWORM.
  • claim · string · requis
    The CTI claim to assess, e.g. an actor-targeting, attribution, or TTP claim.
  • cve_id · string · optionnel
    Optional CVE ID to ground the claim against intel.db.

  Exemple d'appel

  {"name": "getClaimReliability", "arguments": {"claim": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getComplianceBatch≈ 380 tokens

  Rolls up compliance-gap mapping across multiple CVEs/threat actors in a single call. Deterministic per-item table lookup against the same compliance_mappings data as /ot/compliance, deduplicated and rolled up into one aggregate severity rating. LLM only writes the remediation summary prose. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (3)

  Paramètres

  • items · string · requis
    Comma-separated CVE IDs and/or actor names, max 25, e.g. CVE-2023-38802,CVE-2024-12345,SANDWORM,XENOTIME. Each token auto-detected as a CVE ID or treated as an actor name.
  • framework · string · optionnel · nerc_cip | iec_62443_2_1 | iec_62443_2_4 | iec_62443_3_2 | iec_62443_3_3 | iec_62443_4_2 | nist_800_82 | nist_csf
    Optional filter to one compliance framework.
  • entity_sector · string · optionnel · ENERGY | WATER | TRANSPORTATION | GOVERNMENT
    Informs the remediation summary's tone/priority framing only — does not filter which controls match.

  Exemple d'appel

  {"name": "getComplianceBatch", "arguments": {"items": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getComplianceMapping≈ 356 tokens

  Returns triggered compliance controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, and UAE NESA IA. Deterministic table lookup — LLM only adds compensating control prose. Designed for automated compliance reporting agents: call when a new advisory drops, generate gap report, route to compliance team. Price: $0.04 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (3)

  Paramètres

  • actor · string · optionnel
    Threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME
  • cve_id · string · optionnel
    CVE identifier e.g. CVE-2023-38802
  • framework · string · optionnel · nerc_cip | iec_62443_2_1 | iec_62443_2_4 | iec_62443_3_2 | iec_62443_3_3 | iec_62443_4_2 | nist_800_82 | nist_csf
    Optional filter to one compliance framework. Omit or pass 'all' to return matches across every framework.

  Exemple d'appel

  {"name": "getComplianceMapping", "arguments": {"actor": "texte", "cve_id": "texte", "framework": "nerc_cip"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getCtiArticle≈ 254 tokens

  Publication-ready threat intelligence article (~700 words). Fans out to /ot/actor or /ot/cve + /ot/campaign + /ot/malware + /ot/advisory. DeepSeek writes in journalistic CTI style with headline, lede, body, defanged IOCs, and TLP marking. Suitable for threat intel blog posts or advisories. Price: $0.45 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (3)

  Paramètres

  • cve · string · optionnel
    CVE ID e.g. CVE-2024-12345 (required if no actor)
  • actor · string · optionnel
    Actor name e.g. CHERNOVITE (required if no cve)
  • sector · string · optionnel
    Optional sector context

  Exemple d'appel

  {"name": "getCtiArticle", "arguments": {"cve": "texte", "actor": "texte", "sector": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getCveTriage≈ 185 tokens

  CVE lookup enriched for ICS/SCADA environments. Returns OT-adjusted severity, cyber-physical impact, affected ICS layer, compensating controls, patch feasibility, and CISA KEV status. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    CVE identifier e.g. CVE-2023-38802

  Exemple d'appel

  {"name": "getCveTriage", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getDetectionArtifacts≈ 284 tokens

  Returns YARA/Sigma detection rules for an ICS malware family or threat actor. Rules sourced from public corpus (Florian Roth signature-base, CISA advisories) are marked validated:true and safe for staging. DeepSeek-synthesised rules carry validated:false and require lab testing. Designed for automated threat hunting pipelines that commit rules to SIEMs and EDRs. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (2)

  Paramètres

  • format · string · optionnel · yara | sigma | snort | all
    Rule format filter (default: all)
  • target · string · requis
    Malware or actor name e.g. PIPEDREAM, INDUSTROYER2, TRITON, SANDWORM, CHERNOVITE

  Exemple d'appel

  {"name": "getDetectionArtifacts", "arguments": {"target": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getDeviceExposure≈ 229 tokens

  Exposure data for OT devices by vendor and model. Default credential risk, exposed OT protocols (Modbus/502, S7comm/102, DNP3/20000, PCOM/20256), and hardening recommendations. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (2)

  Paramètres

  • model · string · requis
    Device model e.g. s7-1200, modicon-m340, controllogix, vision
  • vendor · string · requis
    Vendor e.g. siemens, schneider, rockwell, honeywell, unitronics, ge, beckhoff

  Exemple d'appel

  {"name": "getDeviceExposure", "arguments": {"model": "texte", "vendor": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getGccBulletin≈ 187 tokens

  Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep. Price: $0.01 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (1)

  Paramètres

  • issue_date · string · optionnel
    Optional YYYY-MM-DD of a past edition; defaults to latest reviewed edition

  Exemple d'appel

  {"name": "getGccBulletin", "arguments": {"issue_date": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getInvariantReachability≈ 402 tokens

  Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out via conservation of mass. Fully deterministic, no LLM, no trained model. Inspired by Barbhaya et al. 2025's physical-invariant residual check — flags inconsistency and direction, does not assert a specific cause. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (8)

  Paramètres

  • flow_in · number · requis
    Metered inflow rate
  • asset_id · string · requis
    Identifier for the tank/vessel being checked
  • flow_out · number · requis
    Metered outflow rate
  • level_end · number · requis
    Level reading at end of interval
  • tank_area · number · requis
    Cross-sectional area, must be > 0
  • dt_seconds · number · requis
    Interval duration in seconds, must be > 0
  • level_start · number · requis
    Level reading at start of interval
  • noise_floor · number · optionnel
    Residual magnitude below which reading is treated as consistent

  Exemple d'appel

  {"name": "getInvariantReachability", "arguments": {"flow_in": 1, "asset_id": "texte", "flow_out": 1, "level_end": 1, "tank_area": 1, "dt_seconds": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getIocEnrichment≈ 200 tokens

  IOC enrichment via AlienVault OTX and AbuseIPDB. Returns verdict on whether the IOC is linked to ICS-targeting campaigns. Price: $0.01 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (2)

  Paramètres

  • type · string · requis · ip | domain
    IOC type: ip or domain
  • value · string · requis
    IP address or domain

  Exemple d'appel

  {"name": "getIocEnrichment", "arguments": {"type": "ip", "value": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getLinkedinPost≈ 210 tokens

  LinkedIn post for a CTI/ICS security audience. Fans out to /ot/actor or /ot/cve + /ot/advisory. Returns hook line, 3-5 intelligence bullet observations, call to action, and hashtags. Ready to publish. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (2)

  Paramètres

  • cve · string · optionnel
    CVE ID (required if no actor)
  • actor · string · optionnel
    Actor name e.g. VOLTZITE (required if no cve)

  Exemple d'appel

  {"name": "getLinkedinPost", "arguments": {"cve": "texte", "actor": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getMalwareProfile≈ 200 tokens

  Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted OT protocols, attributed actor, and MITRE ATT&CK for ICS techniques. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (1)

  Paramètres

  • name · string · requis
    Malware name e.g. PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE

  Exemple d'appel

  {"name": "getMalwareProfile", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getMitigationMap≈ 337 tokens

  Prescriptive D3FEND-mapped mitigation guidance for OT/ICS threats. Pass one of actor, cve_id, or technique_id, optionally with vendor_stack. Returns matched ATT&CK ICS techniques mapped to D3FEND defensive countermeasures with priority and rationale, plus prescriptive architecture recommendations. DeepSeek-synthesised, ICD-203 estimative language. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (4)

  Paramètres

  • actor · string · optionnel
    Threat actor name e.g. SANDWORM. At least one of actor, cve_id, or technique_id is required.
  • cve_id · string · optionnel
    CVE identifier. At least one of actor, cve_id, or technique_id is required.
  • technique_id · string · optionnel
    MITRE ATT&CK ICS technique ID e.g. T0836. At least one of actor, cve_id, or technique_id is required.
  • vendor_stack · string · optionnel
    Optional vendor/product context e.g. Schneider Modicon

  Exemple d'appel

  {"name": "getMitigationMap", "arguments": {"actor": "texte", "cve_id": "texte", "technique_id": "texte", "vendor_stack": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getPatchFeasibility≈ 189 tokens

  Full patch feasibility for a CVE in OT/ICS environments. Returns patch availability, OT-safe workarounds, estimated downtime, safe-to-patch-live flag, and risk-vs-disruption score (1-10). Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    CVE identifier e.g. CVE-2021-34527

  Exemple d'appel

  {"name": "getPatchFeasibility", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getPrecursorTtp≈ 234 tokens

  Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact). Deterministic tactic-taxonomy lookup against intel.db — no LLM in the classification path. Price: $0.04 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (1)

  Paramètres

  • actor · string · requis
    ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME

  Exemple d'appel

  {"name": "getPrecursorTtp", "arguments": {"actor": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getRiskExposure≈ 376 tokens

  Aggregates the same deterministic capability x opportunity x intent scoring used by /ot/threat-score across the actors relevant to a sector+region, ranks them, and returns a DeepSeek-written executive summary (BLUF, ICD-203 language). Portfolio-level companion to /ot/threat-score — for vCISO agents and GRC/board-reporting automation. Price: $0.40 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (5)

  Paramètres

  • region · string · requis
    Target region e.g. GCC, KSA, UAE, Qatar, Europe
  • sector · string · requis
    Target sector e.g. energy, water, manufacturing
  • timeframe · string · optionnel
    Optional lookback window, default 90d
  • vendor_stack · string · optionnel
    Optional comma-separated vendor list e.g. 'Schneider Modicon,Siemens SIMATIC' — feeds each actor's capability score, same as /ot/threat-score
  • compliance_framework · string · optionnel
    Optional — framework to note qualitatively in the narrative e.g. NIST_CSF_2_0, IEC_62443_3_2

  Exemple d'appel

  {"name": "getRiskExposure", "arguments": {"region": "texte", "sector": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getRootCauseLocalization≈ 290 tokens

  Ranks which sensors most likely drove a reported anomaly by z-score deviation from each sensor's own baseline, given a caller-supplied telemetry window. Fully deterministic, no LLM, no trained model. Statistical approximation inspired by Oswal et al. 2025 (kernel SHAP + TCAE) — not a SHAP/TCAE reimplementation. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (3)

  Paramètres

  • top_k · integer · optionnel
    How many ranked sensors to return
  • window · string · requis
    URL-encoded JSON array, max 20 entries: [{sensor_id, values[], baseline_mean?, baseline_stddev?}]
  • anomaly_event_id · string · optionnel
    Optional correlation ID, echoed back unchanged

  Exemple d'appel

  {"name": "getRootCauseLocalization", "arguments": {"window": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getSectorBrief≈ 228 tokens

  Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/decreasing), and top 3 recommended actions. One call replaces 5+ chained calls. Price: $0.10 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (2)

  Paramètres

  • period · integer · optionnel
    Reporting period in days, default 30
  • sector · string · requis
    Sector e.g. energy, water, manufacturing, oil-and-gas, nuclear

  Exemple d'appel

  {"name": "getSectorBrief", "arguments": {"sector": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getSectorDelta≈ 209 tokens

  What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (2)

  Paramètres

  • days · integer · optionnel
    Lookback window in days, default 7
  • sector · string · requis
    Sector to monitor e.g. energy, water, manufacturing

  Exemple d'appel

  {"name": "getSectorDelta", "arguments": {"sector": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getSectorSitrep≈ 240 tokens

  30-day situation report for an industrial sector. Fans out to /ot/actor/sector, /ot/advisory, /ot/campaign, /ot/delta, /ot/compliance. Returns threat landscape, top active actors, new advisories, what changed, compliance posture impact, and weekly recommended priorities. Price: $0.35 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (2)

  Paramètres

  • period · integer · optionnel
    Lookback days, default 30
  • sector · string · requis
    energy | water | manufacturing | oil-and-gas | electric | nuclear | chemical

  Exemple d'appel

  {"name": "getSectorSitrep", "arguments": {"sector": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getStixCoverage≈ 376 tokens

  Deterministic lookup grounded in Hahn, Krief et al., 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXiv:2512.18714v3, Jan 2026). Returns whether STIX 2.1 can represent a given technique/protocol/CVE's artifacts (full/partial/none) and whether public reporting gave enough technical detail to be actionable for detection engineering. No LLM in the lookup path. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (4)

  Paramètres

  • cve_id · string · optionnel
    CVE ID from the paper's CISA KEV table, e.g. CVE-2023-3595. At least one of technique_id, protocol, or cve_id is required.
  • campaign · string · optionnel
    Optional filter: Triton, Stuxnet, or Industroyer.
  • protocol · string · optionnel
    ICS protocol name, e.g. TriStation, S7Comm, CIP. At least one of technique_id, protocol, or cve_id is required.
  • technique_id · string · optionnel
    MITRE ATT&CK ICS technique ID, e.g. T0836. At least one of technique_id, protocol, or cve_id is required.

  Exemple d'appel

  {"name": "getStixCoverage", "arguments": {"cve_id": "texte", "campaign": "texte", "protocol": "texte", "technique_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getThreatActor≈ 201 tokens

  ICS/APT threat actor profiles grounded in published vendor research. MITRE ATT&CK for ICS techniques, known malware, attribution, physical impact, targeted sectors. Alias lookup: Volt Typhoon→VOLTZITE, APT44→SANDWORM. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (1)

  Paramètres

  • name · string · requis
    Actor name or alias e.g. SANDWORM, VOLTZITE, XENOTIME, Volt Typhoon

  Exemple d'appel

  {"name": "getThreatActor", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getThreatHuntControlLoop≈ 320 tokens

  Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Fully deterministic keyword-pattern matching, no LLM. Grounded in CyberAgentX and AgenticCyOps (arXiv 2603.09134). ADVISORY ONLY — never executes containment or any network action. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (3)

  Paramètres

  • zone · string · optionnel · OT | IT | DMZ
    Asset zone. Any RMM/LOTL match on OT is always scored HIGH.
  • observed_commands · string · optionnel
    Comma-separated command strings observed. Must not contain literal commas within a command.
  • observed_processes · string · optionnel
    Comma-separated process/tool names observed. At least one of observed_processes or observed_commands is required.

  Exemple d'appel

  {"name": "getThreatHuntControlLoop", "arguments": {"zone": "OT", "observed_commands": "texte", "observed_processes": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getThreatScore≈ 314 tokens

  Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus GDELT geopolitical tension and OFAC sanctions pressure. Not LLM-generated. Price: $0.04 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (4)

  Paramètres

  • actor · string · requis
    ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME
  • region · string · requis
    Target region or country e.g. Europe, GCC, Ukraine
  • sector · string · requis
    Target sector e.g. energy, water, manufacturing
  • vendor_stack · string · requis
    Comma-separated OT/ICS vendors in the target environment e.g. Siemens,Schneider Electric. Pass 'none' if unknown.

  Exemple d'appel

  {"name": "getThreatScore", "arguments": {"actor": "texte", "region": "texte", "sector": "texte", "vendor_stack": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getVendorRisk≈ 240 tokens

  OT/ICS supply-chain vendor risk assessment. Returns risk tier, confidence, cited CVEs (KEV/EPSS), threat actors with historical targeting interest, and supply-chain mitigation recommendations. DeepSeek-synthesised, ICD-203 language. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (2)

  Paramètres

  • vendor · string · requis
    OT/ICS vendor name e.g. Schneider Electric, Siemens, Rockwell Automation
  • product · string · optionnel
    Optional product line filter e.g. Modicon, SIMATIC

  Exemple d'appel

  {"name": "getVendorRisk", "arguments": {"vendor": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getVendorRiskDelta≈ 283 tokens

  Counterfactual vendor-swap risk comparison. Runs the same assessment used by /ot/vendor-risk on each vendor and returns the risk-tier delta plus per-vendor summaries, for pre-purchase or migration decisions. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (4)

  Paramètres

  • vendor_current · string · requis
    Current OT/ICS vendor name e.g. Siemens
  • product_current · string · optionnel
    Optional current product line e.g. SIMATIC
  • vendor_proposed · string · requis
    Proposed replacement vendor name e.g. Schneider Electric
  • product_proposed · string · optionnel
    Optional proposed product line e.g. Modicon

  Exemple d'appel

  {"name": "getVendorRiskDelta", "arguments": {"vendor_current": "texte", "vendor_proposed": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• getXThread≈ 209 tokens

  X/Twitter thread for an actor or CVE. Fans out to /ot/actor or /ot/cve. Returns 5-7 posts: hook, intel posts with ATT&CK IDs and affected systems, mitigation post, and hashtag post. Each post under 280 characters. Price: $0.10 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (2)

  Paramètres

  • cve · string · optionnel
    CVE ID (required if no actor)
  • actor · string · optionnel
    Actor name e.g. XENOTIME (required if no cve)

  Exemple d'appel

  {"name": "getXThread", "arguments": {"cve": "texte", "actor": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• submitSighting≈ 298 tokens

  Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment. Feeds the correlation corpus without storing an org identifier. Written to a separate sightings store, not intel.db. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/payment"].

  Paramètres, retour & exemple (5)

  Paramètres

  • region · string · requis
    Region where this was observed e.g. KSA, UAE
  • sector · string · requis
    Sector where this was observed e.g. energy, water
  • actor_name · string · optionnel
    Optional actor name if the sighting is attributed
  • observed_at · string · optionnel
    Optional ISO 8601 timestamp of observation
  • ioc_or_ttp_id · string · requis
    CVE ID, MITRE ATT&CK-for-ICS technique ID, or sha256 hash

  Exemple d'appel

  {"name": "submitSighting", "arguments": {"region": "texte", "sector": "texte", "ioc_or_ttp_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://ot-intel-api.onrender.com/mcp