io.github.No3men60/ot-intel-api

up checked 2026-11-11T08:38:43.268Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided title

OT Intel API

Publisher-provided description

OT/ICS threat intel for AI agents: 40 tools, pay per call in USDC on Base via x402.

Summary by lookupd

Provides OT/ICS threat intelligence lookups, CVE triage, and remediation verdicts for AI agents, paid per call in USDC via x402.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http ot-intel-api https://ot-intel-api.onrender.com/mcp

Codex, remote (streamable-http)

codex mcp add ot-intel-api --url https://ot-intel-api.onrender.com/mcp

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "ot-intel-api": {
      "url": "https://ot-intel-api.onrender.com/mcp"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (showing 30 of 40)

Publisher-provided text

• getCveTriage CVE lookup enriched for ICS/SCADA environments. Returns OT-adjusted severity, cyber-physical impact, affected ICS layer, compensating controls, patch feasibilit
• getDeviceExposure Security profile for an OT device: its NVD CVEs (newest first), its CISA ICS advisories (full CSAF history), and a model-written hardening profile (default-cred
• getThreatActor ICS/APT threat actor profiles grounded in published vendor research. MITRE ATT&CK for ICS techniques, known malware, attribution, physical impact, targeted sect
• getActorsBySector All ICS threat actors targeting a specific industrial sector from live MITRE ATT&CK ICS STIX data. Price: $0.03 USDC per call via x402 on Base mainnet. An unpai
• getIocEnrichment IOC enrichment via AlienVault OTX and AbuseIPDB. Returns verdict on whether the IOC is linked to ICS-targeting campaigns. Price: $0.01 USDC per call via x402 on
• getAdvisories CISA ICS advisories by vendor or sector from CISA's full CSAF history (since 2010), newest first. CVSS from the advisory, missing scores from NVD. Returns advis
• getPatchFeasibility Full patch feasibility for a CVE in OT/ICS environments. Returns patch availability, OT-safe workarounds, estimated downtime, safe-to-patch-live flag, and risk-
• getAssetExposure Synthesises vendor, model, firmware, sector, and network context into a branchable risk verdict. Returns risk_score (0-100), escalate (boolean), recommended_act
• getCampaigns Active campaigns targeting a specific industrial sector. Returns campaign name, attributed actor, start date, targeted geography, TTPs in use, and CVEs being ex
• getSectorDelta What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes
• getMalwareProfile Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted OT protocols,
• getSectorBrief Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/de
• getAsnProfile Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, Na
• getDetectionArtifacts Returns YARA/Sigma detection rules for an ICS malware family or threat actor. Rules sourced from public corpus (Florian Roth signature-base, CISA advisories) ar
• getComplianceMapping Returns triggered compliance controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA
• getComplianceBatch Rolls up compliance-gap mapping across multiple CVEs/threat actors in a single call. Deterministic per-item table lookup against the same compliance_mappings da
• getThreatScore Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus GDELT geopolitical tension an
• getPrecursorTtp Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disr
• getRootCauseLocalization Ranks which sensors most likely drove a reported anomaly by z-score deviation from each sensor's own baseline, given a caller-supplied telemetry window. Fully d
• getThreatHuntControlLoop Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Fully deterministic keyword-pattern
• getInvariantReachability Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out via conservation of mass. Fully deterministic,
• getVendorRisk OT/ICS supply-chain vendor risk assessment. Returns risk tier, confidence, cited CVEs (KEV/EPSS), threat actors with historical targeting interest, and supply-c
• getRiskExposure Aggregates the same deterministic capability x opportunity x intent scoring used by /ot/threat-score across the actors relevant to a sector+region, ranks them,
• getActionConformance Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector
• getAiExposure AI/agentic copilot exposure lookup for OT/ICS vendors. Returns the vendor's documented AI/agentic copilot, autonomy level (advisory vs agentic — the key risk di
• getAiUplift Assesses how much a general-purpose AI agent lowers the skill/time barrier for an attacker to reach a vendor's OT-adjacent footprint. Grounded in a real-world p
• getAiAttackFeasibility Deterministic lookup against one specific empirical study (Cook, Stoica, Shah & Pezaros, ACM Trans. Priv. Sec. 29, 3, Article 31, June 2026) testing whether off
• getClaimReliability Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against t
• getStixCoverage Deterministic lookup grounded in Hahn, Krief et al., 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXi
• getMitigationMap Prescriptive D3FEND-mapped mitigation guidance for OT/ICS threats. Pass one of actor, cve_id, or technique_id, optionally with vendor_stack. Returns matched ATT

Details

• Version: 2.0.0
• Transports: streamable-http
• Uptime (7 days): 100%
• Median latency: 551 ms
• First indexed: 2026-11-01T09:12:53.648Z
• Last seen in registry: 2026-11-01T09:12:53.648Z
• Website: https://ot-intel-api.onrender.com/SKILL.md

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/io.github.No3men60/ot-intel-api.svg)](https://lookupd.com/servers/io.github.No3men60/ot-intel-api)

• 62071 servers
• Last crawl: 2026-11-11T16:39:06.253Z
• API base: https://api.lookupd.com
• MCP URL: https://api.lookupd.com/mcp