{"data":{"name":"io.github.No3men60/ot-intel-api","title":"OT Intel API","description":"OT/ICS threat intel for AI agents: 40 tools, pay per call in USDC on Base via x402.","version":"2.0.0","websiteUrl":"https://ot-intel-api.onrender.com/SKILL.md","repositoryUrl":null,"remotes":[{"url":"https://ot-intel-api.onrender.com/mcp","type":"streamable-http"}],"packages":[],"status":"active","isLatest":true,"publishedAt":"2026-10-20T17:30:47.452Z","updatedAt":"2026-10-20T17:30:47.452Z","source":"official-registry","verification":"official","confidence":100,"stars":null,"sources":[{"stars":null,"title":"OT Intel API","source":"official-registry","sourceId":"io.github.No3men60/ot-intel-api","updatedAt":"2026-10-20T17:30:47.452Z","confidence":100,"websiteUrl":"https://ot-intel-api.onrender.com/SKILL.md","description":"OT/ICS threat intel for AI agents: 40 tools, pay per call in USDC on Base via x402.","verification":"official","repositoryUrl":null}],"toolIndex":{"tools":[{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getActionConformance","title":"Remediation Action Risk Gate","description":"Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector/region context. Built on the same capability x opportunity x intent scoring as /ot/threat-score, with auditable rules layered on top — no LLM in the decision path. auto_approve requires vendor_stack; omitting it caps the verdict at human_review regardless of score. Price: $0.12 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"actor":{"type":"string","description":"ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"},"sector":{"type":"string","description":"Target sector e.g. energy, water, manufacturing"},"region":{"type":"string","description":"Target region e.g. GCC, KSA, UAE, Europe"},"planned_action":{"type":"string","enum":["block_ip","block_domain","quarantine_host","isolate_segment","halt_pipeline","disable_account"],"description":"The remediation action being gated"},"asset_context":{"type":"string","description":"Optional free text, e.g. 'shared_infra:cloudflare' — escalates to human_review when shared cloud/CDN infra is detected"},"vendor_stack":{"type":"string","description":"Comma-separated vendor list e.g. 'Schneider Modicon,Siemens SIMATIC'. REQUIRED for auto_approve to be reachable at all; omitting it caps the verdict at human_review."}},"required":["actor","sector","region","planned_action"],"additionalProperties":false},"annotations":{"title":"Remediation Action Risk Gate","readOnlyHint":true,"openWorldHint":true},"definitionHash":"949440e36ff0606cf0ddb19c28b650db1ae0b11300080d111eedbc9c906d476b","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getActorDossier","title":"Deep Actor Dossier","description":"Comprehensive intelligence dossier for an ICS threat actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/ioc, /ot/asn, /ot/detection. Returns full profile, infrastructure analysis, IOC table, detection rules, kill chain mapping, and MITRE ATT&CK coverage. Price: $0.35 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"actor":{"type":"string","description":"Actor name e.g. SANDWORM, XENOTIME, VOLTZITE"}},"required":["actor"],"additionalProperties":false},"annotations":{"title":"Deep Actor Dossier","readOnlyHint":true,"openWorldHint":true},"definitionHash":"5876c22fdf23b2efa4a16c19e20d55534abba0fb6f8c7b82ca966367e587b977","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getActorReport","title":"Full Threat Actor Report (Markdown)","description":"Synthesised Markdown threat report for an ICS/APT actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/advisory, /ot/detection internally (no extra charge) and synthesises via DeepSeek. Returns executive summary, actor profile, active campaigns, malware families, sector targeting, ATT&CK mappings, recommended actions. TLP: WHITE. Price: $0.25 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"actor":{"type":"string","description":"Actor name e.g. CHERNOVITE, SANDWORM, VOLTZITE, XENOTIME"},"sector":{"type":"string","description":"Optional sector focus e.g. energy, water, manufacturing"}},"required":["actor"],"additionalProperties":false},"annotations":{"title":"Full Threat Actor Report (Markdown)","readOnlyHint":true,"openWorldHint":true},"definitionHash":"880a9a37d14a1a63adcb0771a4f78af72421f87743ecaf86b76a3e0d8e9d18ba","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getActorsBySector","title":"Threat Actors by Industrial Sector","description":"All ICS threat actors targeting a specific industrial sector from live MITRE ATT&CK ICS STIX data. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"sector":{"type":"string","description":"Sector e.g. energy, water, manufacturing, oil-and-gas, chemical, nuclear"}},"required":["sector"],"additionalProperties":false},"annotations":{"title":"Threat Actors by Industrial Sector","readOnlyHint":true,"openWorldHint":true},"definitionHash":"fdb351966cb5786dc157da148839bb22330f9d41f489aca36fe148ad4310b939","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getAdvisories","title":"CISA ICS-CERT Advisory Feed","description":"CISA ICS advisories by vendor or sector from CISA's full CSAF history (since 2010), newest first. CVSS from the advisory, missing scores from NVD. Returns advisory IDs, CVE scores, vendors, CISA sectors, OT severity and triage links. One of vendor or sector is required. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"vendor":{"type":"string","description":"Vendor filter e.g. siemens, schneider, rockwell"},"sector":{"type":"string","description":"Sector filter e.g. energy, water, manufacturing"},"since":{"type":"string","format":"date","description":"Only advisories first published on or after this date (YYYY-MM-DD)"},"model":{"type":"string","description":"Your device model (e.g. s7-1500): advisories naming it first, and asset_match per advisory"},"firmware":{"type":"string","description":"Your firmware version (e.g. 2.9.2), used with model: affected | related_product | not_affected | version_unknown | model_not_listed"},"limit":{"type":"integer","default":10,"maximum":25,"description":"Page size, default 10, max 25"}},"additionalProperties":false},"annotations":{"title":"CISA ICS-CERT Advisory Feed","readOnlyHint":true,"openWorldHint":true},"definitionHash":"037783e3a2d67d07bc9f07f1e6028acb81b2d644c1ae22a394d054a20e299be3","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getAiAttackFeasibility","title":"LLM-Generated ICS Attack Feasibility","description":"Deterministic lookup against one specific empirical study (Cook, Stoica, Shah & Pezaros, ACM Trans. Priv. Sec. 29, 3, Article 31, June 2026) testing whether off-the-shelf general-purpose LLMs can generate working attack code against real PLCs. Only 3 vendors tested (Siemens, Schneider Electric, Rockwell Automation); only Network/Register-Tags techniques ever succeeded (zero for Application Code/Firmware); 1.08% overall end-to-end success rate. Claude models were excluded by the paper's own authors due to stronger safety guardrails. Distinct from /ot/ai-exposure (vendor's own AI copilot) and /ot/ai-uplift (open-ended reconnaissance-uplift synthesis). Deterministic, no LLM in the lookup path. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"technique":{"type":"string","description":"MITRE ICS technique name or ID, e.g. 'Brute Force I/O' or T0806. At least one of technique, vendor, or campaign required."},"vendor":{"type":"string","description":"Siemens, Schneider Electric, or Rockwell Automation — only these three were tested in the study."},"campaign":{"type":"string","description":"Industroyer2, Fuxnet, FrostyGoop, INCONTROLLER, Stuxnet, or Triton."}},"additionalProperties":false},"annotations":{"title":"LLM-Generated ICS Attack Feasibility","readOnlyHint":true,"openWorldHint":true},"definitionHash":"96e48c909d9b78ad376d61edd03263dcf00fe12f47ec80ea8a97758027cf3b93","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getAiExposure","title":"AI/Agentic Copilot Attack Surface Lookup","description":"AI/agentic copilot exposure lookup for OT/ICS vendors. Returns the vendor's documented AI/agentic copilot, autonomy level (advisory vs agentic — the key risk differentiator), access, and applicable MITRE ATLAS techniques. Hand-verified mapping, ATLAS IDs confirmed against the live atlas.mitre.org matrix. Deterministic, no LLM in the lookup path. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"vendor":{"type":"string","description":"OT/ICS vendor name e.g. Siemens, Schneider Electric, Rockwell Automation, ABB, Emerson, Honeywell, Yokogawa, GE Vernova, Omron, Mitsubishi Electric"}},"required":["vendor"],"additionalProperties":false},"annotations":{"title":"AI/Agentic Copilot Attack Surface Lookup","readOnlyHint":true,"openWorldHint":true},"definitionHash":"cdc0a1ff2c1ffed0078579bebd99e53cf48bae54e293f5a7f2c171ededdb8eec","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getAiUplift","title":"Attacker AI-Uplift Exposure","description":"Assesses how much a general-purpose AI agent lowers the skill/time barrier for an attacker to reach a vendor's OT-adjacent footprint. Grounded in a real-world precedent (Dragos, May 2026), not frontier-model governance thresholds. Distinct from /ot/ai-exposure, which covers a vendor's OWN embedded AI copilot. DeepSeek-synthesised, ICD-203 estimative language. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"vendor":{"type":"string","description":"OT/ICS vendor name e.g. Schneider Electric, Siemens, Rockwell Automation"},"product":{"type":"string","description":"Optional product line filter e.g. Modicon, SIMATIC"},"internet_facing":{"type":"string","description":"true, false, or unknown (default)"},"auth_type":{"type":"string","description":"single-factor, mfa, or unknown (default)"},"segmented":{"type":"string","description":"true, false, or unknown (default). If all three deployment-context params are unknown, the tier is capped at informational."}},"required":["vendor"],"additionalProperties":false},"annotations":{"title":"Attacker AI-Uplift Exposure","readOnlyHint":true,"openWorldHint":true},"definitionHash":"42ca31117cfab96c51107b71ad5c988bebb2ed620381e3d0922e134b942207ef","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getAnalystBrief","title":"Analyst Brief (BLUF)","description":"Human-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector. Same fan-out data as /ot/report but synthesised into a short decision-ready brief instead of a full report. Price: $0.12 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"actor":{"type":"string","description":"ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"},"sector":{"type":"string","description":"Optional target sector e.g. energy, water, manufacturing"}},"required":["actor"],"additionalProperties":false},"annotations":{"title":"Analyst Brief (BLUF)","readOnlyHint":true,"openWorldHint":true},"definitionHash":"19116efc3482b4aa7334c5ea917f0a373714aebbd08ebe313583df18b37fe93a","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getAsnProfile","title":"ICS Threat Actor ASN Infrastructure Profiling","description":"Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, NakedPages), bulletproof hosting indicators, abuse categories (c2, staging, phishing), and an OT-specific blocking recommendation with WAF rule hint. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"asn":{"type":"string","description":"ASN identifier e.g. AS215540, AS9009, AS29802"},"org":{"type":"string","description":"Optional org name fragment e.g. hivelocity, m247"}},"required":["asn"],"additionalProperties":false},"annotations":{"title":"ICS Threat Actor ASN Infrastructure Profiling","readOnlyHint":true,"openWorldHint":true},"definitionHash":"0114d751dcb8e187fab359d01769f34e1fdfce08debd30465cf452c32d23e42a","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getAssetExposure","title":"Asset Risk Score and Escalation Verdict","description":"Synthesises vendor, model, firmware, sector, and network context into a branchable risk verdict. Returns risk_score (0-100), escalate (boolean), recommended_action, and contributing threat actors. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"vendor":{"type":"string","description":"e.g. siemens, schneider, rockwell, ge, honeywell"},"model":{"type":"string","description":"e.g. s7-1500, modicon-m340, controllogix"},"sector":{"type":"string","description":"energy | water | manufacturing | oil-and-gas | chemical | nuclear"},"network":{"type":"string","description":"internet-facing | dmz | lan-only | air-gapped"},"firmware":{"type":"string","description":"Firmware version e.g. 2.9.2 — enables firmware-specific CVE matching"}},"required":["vendor","model","sector","network"],"additionalProperties":false},"annotations":{"title":"Asset Risk Score and Escalation Verdict","readOnlyHint":true,"openWorldHint":true},"definitionHash":"6352414545ee83481c160a41427503e6922d8b6284c8df5c76b426f19579404e","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getCampaigns","title":"Active ICS Campaign Tracker","description":"Active campaigns targeting a specific industrial sector. Returns campaign name, attributed actor, start date, targeted geography, TTPs in use, and CVEs being exploited. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"sector":{"type":"string","description":"energy | water | manufacturing | oil-and-gas | electric | nuclear | chemical"},"status":{"type":"string","enum":["active","all"],"default":"active","description":"active (default) or all"}},"required":["sector"],"additionalProperties":false},"annotations":{"title":"Active ICS Campaign Tracker","readOnlyHint":true,"openWorldHint":true},"definitionHash":"cb75c1b414bdbb2d8a8d73a4d8c250522d5208f448c7e306e3ce5038fd2fbcb6","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getClaimReliability","title":"CTI Claim Reliability Scoring","description":"Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against the paper's three failure modes — spurious correlation, contradictory knowledge, constrained generalization — using intel.db grounding plus DeepSeek synthesis. Returns a reliability score, verdict, corroborating/contradicting evidence, and confidence. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"claim":{"type":"string","description":"The CTI claim to assess, e.g. an actor-targeting, attribution, or TTP claim."},"actor":{"type":"string","description":"Optional actor name to ground the claim against intel.db, e.g. SANDWORM."},"cve_id":{"type":"string","description":"Optional CVE ID to ground the claim against intel.db."}},"required":["claim"],"additionalProperties":false},"annotations":{"title":"CTI Claim Reliability Scoring","readOnlyHint":true,"openWorldHint":true},"definitionHash":"ca1be941d52ce5335650c585de4e3af8efbaef0d872a07ea08837d9f6c3cbc57","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getComplianceBatch","title":"Aggregate Compliance Gap Assessment","description":"Rolls up compliance-gap mapping across multiple CVEs/threat actors in a single call. Deterministic per-item table lookup against the same compliance_mappings data as /ot/compliance, deduplicated and rolled up into one aggregate severity rating. LLM only writes the remediation summary prose. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"items":{"type":"string","description":"Comma-separated CVE IDs and/or actor names, max 25, e.g. CVE-2023-38802,CVE-2024-12345,SANDWORM,XENOTIME. Each token auto-detected as a CVE ID or treated as an actor name."},"framework":{"type":"string","enum":["nerc_cip","iec_62443_2_1","iec_62443_2_4","iec_62443_3_2","iec_62443_3_3","iec_62443_4_2","nist_800_82","nist_csf","cisa_cpg","nca_otcc","uae_nesa_ia","all"],"default":"all","description":"Optional filter to one compliance framework."},"entity_sector":{"type":"string","enum":["ENERGY","WATER","TRANSPORTATION","GOVERNMENT"],"description":"Informs the remediation summary's tone/priority framing only — does not filter which controls match."}},"required":["items"],"additionalProperties":false},"annotations":{"title":"Aggregate Compliance Gap Assessment","readOnlyHint":true,"openWorldHint":true},"definitionHash":"e360f12f55571a88a4b4572f1db7f5ac9ce3c0d66e60271f72ebbe640b5472bd","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getComplianceMapping","title":"Multi-Framework Compliance Gap Mapping","description":"Returns triggered compliance controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, and UAE NESA IA. Deterministic table lookup — LLM only adds compensating control prose. Designed for automated compliance reporting agents: call when a new advisory drops, generate gap report, route to compliance team. Price: $0.04 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"cve_id":{"type":"string","description":"CVE identifier e.g. CVE-2023-38802"},"actor":{"type":"string","description":"Threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"},"framework":{"type":"string","enum":["nerc_cip","iec_62443_2_1","iec_62443_2_4","iec_62443_3_2","iec_62443_3_3","iec_62443_4_2","nist_800_82","nist_csf","cisa_cpg","nca_otcc","uae_nesa_ia","all"],"default":"all","description":"Optional filter to one compliance framework. Omit or pass 'all' to return matches across every framework."}},"additionalProperties":false},"annotations":{"title":"Multi-Framework Compliance Gap Mapping","readOnlyHint":true,"openWorldHint":true},"definitionHash":"8ceb3ff62ba5039617371f9c9ad13b6730ccfbcdc004a551f4b7bb32ff58af45","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getCtiArticle","title":"CTI Article (Publication-Ready)","description":"Publication-ready threat intelligence article (~700 words). Fans out to /ot/actor or /ot/cve + /ot/campaign + /ot/malware + /ot/advisory. DeepSeek writes in journalistic CTI style with headline, lede, body, defanged IOCs, and TLP marking. Suitable for threat intel blog posts or advisories. Price: $0.45 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"actor":{"type":"string","description":"Actor name e.g. CHERNOVITE (required if no cve)"},"cve":{"type":"string","description":"CVE ID e.g. CVE-2024-12345 (required if no actor)"},"sector":{"type":"string","description":"Optional sector context"}},"additionalProperties":false},"annotations":{"title":"CTI Article (Publication-Ready)","readOnlyHint":true,"openWorldHint":true},"definitionHash":"0114f2dbc9a69fe1359ee622fcbea858fdf2885d24c722fec32d7f187556b875","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getCveTriage","title":"OT-Contextualised CVE Triage","description":"CVE lookup enriched for ICS/SCADA environments. Returns OT-adjusted severity, cyber-physical impact, affected ICS layer, compensating controls, patch feasibility, and CISA KEV status. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"id":{"type":"string","description":"CVE identifier e.g. CVE-2023-38802"}},"required":["id"],"additionalProperties":false},"annotations":{"title":"OT-Contextualised CVE Triage","readOnlyHint":true,"openWorldHint":true},"definitionHash":"2a5cebce030fb49c00ca9c01e1541f22fd1f763997d0ff427d37ad1671c9a9f5","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getDetectionArtifacts","title":"ICS Detection Artifact Retrieval","description":"Returns YARA/Sigma detection rules for an ICS malware family or threat actor. Rules sourced from public corpus (Florian Roth signature-base, CISA advisories) are marked validated:true and safe for staging. DeepSeek-synthesised rules carry validated:false and require lab testing. Designed for automated threat hunting pipelines that commit rules to SIEMs and EDRs. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"target":{"type":"string","description":"Malware or actor name e.g. PIPEDREAM, INDUSTROYER2, TRITON, SANDWORM, CHERNOVITE"},"format":{"type":"string","enum":["yara","sigma","snort","all"],"default":"all","description":"Rule format filter (default: all)"}},"required":["target"],"additionalProperties":false},"annotations":{"title":"ICS Detection Artifact Retrieval","readOnlyHint":true,"openWorldHint":true},"definitionHash":"9054ab9cd8f47c006f08625af49966ee4fd644d331c9e49840fb650bb38384a7","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getDeviceExposure","title":"OT Device Security Profile","description":"Security profile for an OT device: its NVD CVEs (newest first), its CISA ICS advisories (full CSAF history), and a model-written hardening profile (default-credential risk, OT protocols at risk, hardening steps; labelled by profile_provenance). Not an internet exposure scan. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"vendor":{"type":"string","description":"Vendor e.g. siemens, schneider, rockwell, honeywell, unitronics, ge, beckhoff"},"model":{"type":"string","description":"Device model e.g. s7-1200, modicon-m340, controllogix, vision. With a model, NVD is searched for the model name"}},"required":["vendor"],"additionalProperties":false},"annotations":{"title":"OT Device Security Profile","readOnlyHint":true,"openWorldHint":true},"definitionHash":"f16f2a328d84bcfd3da54272b32e87e0866140a6f4cedcf108fa379fc19d1b0e","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getGccBulletin","title":"GCC OT Threat Sitrep (Public Bulletin)","description":"Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep. Price: $0.01 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"issue_date":{"type":"string","description":"Optional YYYY-MM-DD of a past edition; defaults to latest reviewed edition"}},"additionalProperties":false},"annotations":{"title":"GCC OT Threat Sitrep (Public Bulletin)","readOnlyHint":true,"openWorldHint":true},"definitionHash":"49fd7cc7feda282bdd75923028ac8731ee150e9b51b85975b00cafed439e3e70","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getInvariantReachability","title":"Physical Invariant Check","description":"Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out via conservation of mass. Fully deterministic, no LLM, no trained model. Inspired by Barbhaya et al. 2025's physical-invariant residual check — flags inconsistency and direction, does not assert a specific cause. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"asset_id":{"type":"string","description":"Identifier for the tank/vessel being checked"},"flow_in":{"type":"number","description":"Metered inflow rate"},"flow_out":{"type":"number","description":"Metered outflow rate"},"level_start":{"type":"number","description":"Level reading at start of interval"},"level_end":{"type":"number","description":"Level reading at end of interval"},"dt_seconds":{"type":"number","description":"Interval duration in seconds, must be > 0"},"tank_area":{"type":"number","description":"Cross-sectional area, must be > 0"},"noise_floor":{"type":"number","default":0.5,"description":"Residual magnitude below which reading is treated as consistent"}},"required":["asset_id","flow_in","flow_out","level_start","level_end","dt_seconds","tank_area"],"additionalProperties":false},"annotations":{"title":"Physical Invariant Check","readOnlyHint":true,"openWorldHint":true},"definitionHash":"2c6e5e9c60ab3a9e5f82dd5a8a28ee5c0e2ff708c19270045aebee216a370ece","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getIocEnrichment","title":"IOC Enrichment with OT Campaign Context","description":"IOC enrichment via AlienVault OTX and AbuseIPDB. Returns verdict on whether the IOC is linked to ICS-targeting campaigns. Price: $0.01 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"value":{"type":"string","description":"IP address or domain"},"type":{"type":"string","enum":["ip","domain"],"description":"IOC type: ip or domain"}},"required":["value","type"],"additionalProperties":false},"annotations":{"title":"IOC Enrichment with OT Campaign Context","readOnlyHint":true,"openWorldHint":true},"definitionHash":"e6999e0f045886d7b8f282b4e2d15d111c2898e64b544d7e1a0213b545408ca1","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getLinkedinPost","title":"LinkedIn Post for CTI/ICS Audience","description":"LinkedIn post for a CTI/ICS security audience. Fans out to /ot/actor or /ot/cve + /ot/advisory. Returns hook line, 3-5 intelligence bullet observations, call to action, and hashtags. Ready to publish. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"actor":{"type":"string","description":"Actor name e.g. VOLTZITE (required if no cve)"},"cve":{"type":"string","description":"CVE ID (required if no actor)"}},"additionalProperties":false},"annotations":{"title":"LinkedIn Post for CTI/ICS Audience","readOnlyHint":true,"openWorldHint":true},"definitionHash":"2f350a593daf16108f9835b53e12e08d367eaf3a78e52a752f47988c7fbd6a7e","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getMalwareProfile","title":"ICS Malware Encyclopedia","description":"Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted OT protocols, attributed actor, and MITRE ATT&CK for ICS techniques. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"name":{"type":"string","description":"Malware name e.g. PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE"}},"required":["name"],"additionalProperties":false},"annotations":{"title":"ICS Malware Encyclopedia","readOnlyHint":true,"openWorldHint":true},"definitionHash":"2e58ee9333c95490899d4d895503af37ba9aaf018ad6fda4c1f0c4cec672e4a3","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"},{"serverName":"io.github.No3men60/ot-intel-api","endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","name":"getMitigationMap","title":"D3FEND-Mapped Mitigation Guidance","description":"Prescriptive D3FEND-mapped mitigation guidance for OT/ICS threats. Pass one of actor, cve_id, or technique_id, optionally with vendor_stack. Returns matched ATT&CK ICS techniques mapped to D3FEND defensive countermeasures with priority and rationale, plus prescriptive architecture recommendations. DeepSeek-synthesised, ICD-203 estimative language. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta[\"x402/payment\"].","inputSchema":{"type":"object","properties":{"actor":{"type":"string","description":"Threat actor name e.g. SANDWORM. At least one of actor, cve_id, or technique_id is required."},"cve_id":{"type":"string","description":"CVE identifier. At least one of actor, cve_id, or technique_id is required."},"technique_id":{"type":"string","description":"MITRE ATT&CK ICS technique ID e.g. T0836. At least one of actor, cve_id, or technique_id is required."},"vendor_stack":{"type":"string","description":"Optional vendor/product context e.g. Schneider Modicon"}},"additionalProperties":false},"annotations":{"title":"D3FEND-Mapped Mitigation Guidance","readOnlyHint":true,"openWorldHint":true},"definitionHash":"f737852b46cee57dccd196bd327000c5cb25f580dd61759100680cac19ae7e83","schemaStatus":"valid","origin":"official-registry","observedAt":"2026-11-01T18:46:19.189Z","metadataTrust":"untrusted"}],"endpoints":[{"endpointFingerprint":"bcf928bc0e3dd43b3a26ddb66d262ba4cf3b28b58cf6589509b4feb44fb48a25","protocol":"streamable-http","status":"indexed","toolCount":40,"observedAt":"2026-11-01T18:46:19.189Z"}],"authentication":"unknown"},"connectionConfigurations":{"status":"ready","authentication":"not embedded","clients":{"Claude Desktop":{"mcpServers":{"io.github.No3men60/ot-intel-api":{"url":"https://ot-intel-api.onrender.com/mcp"}}},"Cursor":{"mcpServers":{"io.github.No3men60/ot-intel-api":{"url":"https://ot-intel-api.onrender.com/mcp"}}},"VS Code":{"servers":{"io.github.No3men60/ot-intel-api":{"type":"http","url":"https://ot-intel-api.onrender.com/mcp"}}}}},"resourceType":"mcp-server","callable":true,"runtime":{"callable":true,"protocols":["mcp"]},"interfaces":[{"protocol":"mcp","transport":"streamable-http","url":"https://ot-intel-api.onrender.com/mcp"}],"profile":{"apiVersion":"1","schemaVersion":"1","id":"mcp-server:io.github.No3men60%2Fot-intel-api","resourceType":"mcp-server","canonicalUrl":"https://www.agentsjunction.com/api/v1/servers/io.github.No3men60%2Fot-intel-api","name":"io.github.No3men60/ot-intel-api","description":"OT/ICS threat intel for AI agents: 40 tools, pay per call in USDC on Base via x402.","interfaces":[{"protocol":"mcp","transport":"streamable-http","url":"https://ot-intel-api.onrender.com/mcp"}],"capabilities":[],"identity":{"source":"official-registry","websiteUrl":"https://ot-intel-api.onrender.com/SKILL.md","repositoryUrl":null,"version":"2.0.0"},"verification":{"state":"official","confidence":100},"operations":{"resourceType":"mcp-server","name":"io.github.No3men60/ot-intel-api","status":"online","lastCheckedAt":"2026-11-03T18:18:25.610Z","lastSuccessfulCheck":"2026-11-03T18:18:25.610Z","latencyMs":155,"consecutiveFailures":0,"isStale":false,"checks":{"endpointReachable":true,"protocolValid":true,"agentCardValid":null,"mcpHandshakeValid":true},"lastSeen":null,"lastSuccessfulInteraction":null,"lastHealthCheck":"2026-11-03T18:18:25.610Z","source":{"type":"health-check","url":null},"observedAt":"2026-11-03T18:18:25.610Z"},"security":null,"timestamps":{"createdAt":"2026-10-20T17:30:47.452Z","updatedAt":"2026-10-20T17:30:47.452Z","observedAt":"2026-11-03T18:18:25.610Z"},"compatibility":{"serverVersion":"2.0.0","protocolVersions":[{"protocol":"mcp","version":null}]}}}}