A comprehensive threat intelligence aggregation MCP server that provides unified access to multiple threat intelligence sources for security analysis
This server demonstrates significant gaps in definition quality. While all 7 tools are registered with descriptions, most descriptions lack sufficient detail for LLM decision-making, parameter schemas are minimally specified, and there is no structured output documentation. Tool naming is reasonably clear (analyze_*, check_*, scan_*, generate_*), but parameter definitions are sparse. Two tools (analyze_code_security, scan_project_dependencies, analyze_docker_security, scan_kubernetes_config, generate_security_report) have descriptions and parameter hints in Chinese mixed with English, reducing clarity for English-language LLM agents. No explicit output schemas are documented, and error handling guidance is absent. The server relies on returned Dict[str, Any] with no structure definition.
分析代码安全性并提供主动安全建议 这个工具会扫描代码中的安全漏洞,包括硬编码密钥、SQL注入、XSS漏洞等, 并检查代码中的网络指标(IP、域名、URL)是否存在威胁。
分析Dockerfile的安全配置 检查Docker镜像构建文件中的安全问题,包括基础镜像安全性、 用户权限配置、敏感信息泄露等。
Analyze a security indicator (IP address, domain, hash, or URL) across multiple threat intelligence sources. This tool queries various threat intelligence APIs to provide a comprehensive security assessment of the given indicator. It aggregates results from multiple sources and provides an overall reputation score with confidence level.
Check the status of configured threat intelligence API keys and sources. Returns information about which threat intelligence sources are available and properly configured with valid API keys.
生成安全分析的可视化报告 基于安全分析数据生成包含图表和详细信息的综合报告, 支持中英文显示和多种图表类型。
扫描Kubernetes配置的安全问题 分析Kubernetes YAML配置文件中的安全风险,包括Pod安全上下文、 服务配置、网络策略和RBAC权限等。
No documented output schemas. All tools return Dict[str, Any] with no type hints or field documentation. LLMs cannot plan downstream tool calls or extract structured data reliably.
Minimal parameter descriptions. 'code_content', 'dockerfile_content', 'yaml_content' lack format, length, or constraint guidance. 'language' param in analyze_code_security states 'auto/python/javascript/...' but does not use an enum constraint; LLMs may hallucinate unsupported languages.
Descriptions in Chinese for 4 tools (analyze_code_security, scan_project_dependencies, analyze_docker_security, scan_kubernetes_config, generate_security_report). English-language LLM agents struggle with Chinese descriptions and fail to select tools appropriately.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 42 | <=2025-11-25 | v2 |
| 2026-03-09 | F | 11 | - | v1 |
扫描项目依赖包的安全漏洞 支持多种项目类型的依赖文件分析,包括NPM、Python、Maven、Cargo等。 检查已知的恶意包、过时的依赖和安全漏洞。
Missing error handling and recovery guidance. analyze_indicator and check_api_status return generic errors like 'Analysis failed: ...' without actionable guidance on what the LLM should do next (retry, call discovery tool, ask user).
No pagination support. scan_project_dependencies accepts 'project_files' as a dict with no size limits. Large project repositories could exceed context windows or cause timeouts without guidance on batching.
Parameter 'chart_type' in generate_security_report lists options as 'pie/bar/timeline/flowchart/comprehensive' in description but does not enforce them via enum schema. LLMs may pass invalid values.
No tool-level composition guidance. No indication of which tools should be called in sequence (e.g., analyze_indicator → then what?). LLMs cannot reason about multi-step security workflows.