Loading ToolBench
Cyber Threat Intelligence MCP Server for AI Agents with ICS/OT support. Provides IOC lookup, CVE queries, MITRE ATT&CK techniques, CISA ICS advisories, vendor security advisories, and threat intelligence aggregation.
Three tools with clear action verbs and reasonable descriptions (100-200 chars). All have input schemas with type definitions and parameter descriptions. However, output schemas are not explicitly documented in the visible code, responses are inferred from implementation. Error handling exists but lacks actionable recovery guidance. No tool annotations (readOnlyHint, idempotentHint) despite all being read-only operations. Parameter validation is present but not all constraints are documented in descriptions (e.g., ioc_type enum values stated in description but not as formal enum constraint).
Get a concise, human-readable threat summary for an IOC. Combines all available sources into a Markdown report.
Look up detailed CVE vulnerability information from NIST NVD. Returns CVSS scores, description, affected products, and references. No API key required.
Query threat intelligence for an Indicator of Compromise. Queries VirusTotal and AlienVault OTX concurrently and returns an aggregated verdict.
Output schemas not documented. Tool descriptions state what is returned (e.g., 'CVSS scores, description, affected products') but formal response schema is not visible in code. LLMs cannot plan downstream operations without knowing response structure.
Parameter constraints not formalized as enums. ioc_type description lists 'ip', 'domain', 'url', 'hash' as text, but no JSON Schema enum constraint visible. Free-form strings invite hallucinated values.
No tool annotations despite all tools being read-only. readOnlyHint should be set on all three tools to signal to agents that these are safe, non-destructive operations.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | <=2025-11-25 | v2 |
Error responses lack actionable recovery guidance. Code returns {'error': str(exc)} for validation failures, but does not suggest next steps (e.g., 'Invalid ioc_type. Must be one of: ip, domain, url, hash').
No pagination or result limits documented. lookup_ioc and get_threat_summary may return large aggregated results from multiple sources; no limit parameter or documentation of max result size.