OT Intel API

할 수 있는 일

이 서버는 아직 쉬운 말로 된 요약을 쓰지 못했어요. 아래는 레지스트리에서 읽어 온 사실이에요.

• 연결 방식: 클라우드에서 실행
• 전송 방식: Streamable HTTP
• 카테고리: 사이버 보안

설치

쓰고 있는 AI 앱을 고른 다음 설정을 복사하세요.

필요한 것

• 클라우드에서 실행설치할 것 없음. 인터넷으로 연결돼요

어떤 앱을 쓰세요?

https://ot-intel-api.onrender.com/mcp

claude mcp add --transport http ot-intel-api https://ot-intel-api.onrender.com/mcp

{
  "mcpServers": {
    "ot-intel-api": {
      "url": "https://ot-intel-api.onrender.com/mcp"
    }
  }
}

{
  "servers": {
    "ot-intel-api": {
      "type": "http",
      "url": "https://ot-intel-api.onrender.com/mcp"
    }
  }
}

https://ot-intel-api.onrender.com/mcp

선택한 앱은 이 기기의 쿠키에만 저장돼요. 계정은 필요 없어요.

이 설정은 제작자의 레지스트리 정보로 만들었어요. README와 다르면 README를 따르세요.

할 수 있는 일

도구 이름과 설명은 서버가 2026년 11월 7일에 알려 준 그대로예요. 우리가 아니라 제작자가 쓴 글이고, 일반 텍스트로만 보여 드려요.

• getCveTriage

  CVE lookup enriched for ICS/SCADA environments. Returns OT-adjusted severity, cyber-physical impact, affected ICS layer, compensating controls, patch feasibility, and CISA KEV status. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequi

• getDeviceExposure

  Security profile for an OT device: its NVD CVEs (newest first), its CISA ICS advisories (full CSAF history), and a model-written hardening profile (default-credential risk, OT protocols at risk, hardening steps; labelled by profile_provenance). Not an internet exposure scan. Pric

• getThreatActor

  ICS/APT threat actor profiles grounded in published vendor research. MITRE ATT&CK for ICS techniques, known malware, attribution, physical impact, targeted sectors. Alias lookup: Volt Typhoon→VOLTZITE, APT44→SANDWORM. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid

• getActorsBySector

  All ICS threat actors targeting a specific industrial sector from live MITRE ATT&CK ICS STIX data. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payload in _meta["x402/paymen

• getIocEnrichment

  IOC enrichment via AlienVault OTX and AbuseIPDB. Returns verdict on whether the IOC is linked to ICS-targeting campaigns. Price: $0.01 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with the signed payloa

• getAdvisories

  CISA ICS advisories by vendor or sector from CISA's full CSAF history (since 2010), newest first. CVSS from the advisory, missing scores from NVD. Returns advisory IDs, CVE scores, vendors, CISA sectors, OT severity and triage links. One of vendor or sector is required. Price: $0

• getPatchFeasibility

  Full patch feasibility for a CVE in OT/ICS environments. Returns patch availability, OT-safe workarounds, estimated downtime, safe-to-patch-live flag, and risk-vs-disruption score (1-10). Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentR

• getAssetExposure

  Synthesises vendor, model, firmware, sector, and network context into a branchable risk verdict. Returns risk_score (0-100), escalate (boolean), recommended_action, and contributing threat actors. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402

• getCampaigns

  Active campaigns targeting a specific industrial sector. Returns campaign name, attributed actor, start date, targeted geography, TTPs in use, and CVEs being exploited. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge;

• getSectorDelta

  What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry t

• getMalwareProfile

  Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted OT protocols, attributed actor, and MITRE ATT&CK for ICS techniques. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid ca

• getSectorBrief

  Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/decreasing), and top 3 recommended actions. One call replaces 5+ chained calls. Price: $0.10 USDC per call via x402 on Bas

• getAsnProfile

  Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, NakedPages), bulletproof hosting indicators, abuse categories (c2, staging, phishing), and an OT-specific blocking recomme

• getDetectionArtifacts

  Returns YARA/Sigma detection rules for an ICS malware family or threat actor. Rules sourced from public corpus (Florian Roth signature-base, CISA advisories) are marked validated:true and safe for staging. DeepSeek-synthesised rules carry validated:false and require lab testing.

• getComplianceMapping

  Returns triggered compliance controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, and UAE NESA IA. Deterministic table lookup — LLM only adds compensating control prose. Designed f

• getComplianceBatch

  Rolls up compliance-gap mapping across multiple CVEs/threat actors in a single call. Deterministic per-item table lookup against the same compliance_mappings data as /ot/compliance, deduplicated and rolled up into one aggregate severity rating. LLM only writes the remediation sum

• getThreatScore

  Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus GDELT geopolitical tension and OFAC sanctions pressure. Not LLM-generated. Price: $0.04 USDC per call via x402 on Base mainnet. An unpaid call return

• getPrecursorTtp

  Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact). Deterministic tactic-taxonomy looku

• getRootCauseLocalization

  Ranks which sensors most likely drove a reported anomaly by z-score deviation from each sensor's own baseline, given a caller-supplied telemetry window. Fully deterministic, no LLM, no trained model. Statistical approximation inspired by Oswal et al. 2025 (kernel SHAP + TCAE) — n

• getThreatHuntControlLoop

  Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Fully deterministic keyword-pattern matching, no LLM. Grounded in CyberAgentX and AgenticCyOps (arXiv 2603.09134). ADVISORY ONLY — never executes containme

• getInvariantReachability

  Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out via conservation of mass. Fully deterministic, no LLM, no trained model. Inspired by Barbhaya et al. 2025's physical-invariant residual check — flags inconsistency and

• getVendorRisk

  OT/ICS supply-chain vendor risk assessment. Returns risk tier, confidence, cited CVEs (KEV/EPSS), threat actors with historical targeting interest, and supply-chain mitigation recommendations. DeepSeek-synthesised, ICD-203 language. Price: $0.15 USDC per call via x402 on Base mai

• getRiskExposure

  Aggregates the same deterministic capability x opportunity x intent scoring used by /ot/threat-score across the actors relevant to a sector+region, ranks them, and returns a DeepSeek-written executive summary (BLUF, ICD-203 language). Portfolio-level companion to /ot/threat-score

• getActionConformance

  Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector/region context. Built on the same capability x opportunity x intent scoring as /ot/threat-score, with auditable rules l

• getAiExposure

  AI/agentic copilot exposure lookup for OT/ICS vendors. Returns the vendor's documented AI/agentic copilot, autonomy level (advisory vs agentic — the key risk differentiator), access, and applicable MITRE ATLAS techniques. Hand-verified mapping, ATLAS IDs confirmed against the liv

• getAiUplift

  Assesses how much a general-purpose AI agent lowers the skill/time barrier for an attacker to reach a vendor's OT-adjacent footprint. Grounded in a real-world precedent (Dragos, May 2026), not frontier-model governance thresholds. Distinct from /ot/ai-exposure, which covers a ven

• getAiAttackFeasibility

  Deterministic lookup against one specific empirical study (Cook, Stoica, Shah & Pezaros, ACM Trans. Priv. Sec. 29, 3, Article 31, June 2026) testing whether off-the-shelf general-purpose LLMs can generate working attack code against real PLCs. Only 3 vendors tested (Siemens, Schn

• getClaimReliability

  Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against the paper's three failure modes — spurious correlation, contradictory knowledge, constrained generalization — using intel

• getStixCoverage

  Deterministic lookup grounded in Hahn, Krief et al., 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXiv:2512.18714v3, Jan 2026). Returns whether STIX 2.1 can represent a given technique/protocol/CVE's artifacts (full/parti

• getMitigationMap

  Prescriptive D3FEND-mapped mitigation guidance for OT/ICS threats. Pass one of actor, cve_id, or technique_id, optionally with vendor_stack. Returns matched ATT&CK ICS techniques mapped to D3FEND defensive countermeasures with priority and rationale, plus prescriptive architectur

• getActorReport

  Synthesised Markdown threat report for an ICS/APT actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/advisory, /ot/detection internally (no extra charge) and synthesises via DeepSeek. Returns executive summary, actor profile, active campaigns, malware families, sector t

• getActorDossier

  Comprehensive intelligence dossier for an ICS threat actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/ioc, /ot/asn, /ot/detection. Returns full profile, infrastructure analysis, IOC table, detection rules, kill chain mapping, and MITRE ATT&CK coverage. Price: $0.35 US

• getSectorSitrep

  30-day situation report for an industrial sector. Fans out to /ot/actor/sector, /ot/advisory, /ot/campaign, /ot/delta, /ot/compliance. Returns threat landscape, top active actors, new advisories, what changed, compliance posture impact, and weekly recommended priorities. Price: $

• getCtiArticle

  Publication-ready threat intelligence article (~700 words). Fans out to /ot/actor or /ot/cve + /ot/campaign + /ot/malware + /ot/advisory. DeepSeek writes in journalistic CTI style with headline, lede, body, defanged IOCs, and TLP marking. Suitable for threat intel blog posts or a

• getLinkedinPost

  LinkedIn post for a CTI/ICS security audience. Fans out to /ot/actor or /ot/cve + /ot/advisory. Returns hook line, 3-5 intelligence bullet observations, call to action, and hashtags. Ready to publish. Price: $0.15 USDC per call via x402 on Base mainnet. An unpaid call returns an

• getXThread

  X/Twitter thread for an actor or CVE. Fans out to /ot/actor or /ot/cve. Returns 5-7 posts: hook, intel posts with ATT&CK IDs and affected systems, mitigation post, and hashtag post. Each post under 280 characters. Price: $0.10 USDC per call via x402 on Base mainnet. An unpaid cal

• getAnalystBrief

  Human-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector. Same fan-out data as /ot/report but synthesised into a short decision-ready brief instead of a full report. Price: $0.12 USDC per call via x402

• getVendorRiskDelta

  Counterfactual vendor-swap risk comparison. Runs the same assessment used by /ot/vendor-risk on each vendor and returns the risk-tier delta plus per-vendor summaries, for pre-purchase or migration decisions. Price: $0.20 USDC per call via x402 on Base mainnet. An unpaid call retu

• submitSighting

  Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment. Feeds the correlation corpus without storing an org identifier. Written to a separate sightings store, not intel.db. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call returns an x

• getGccBulletin

  Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep. Price: $0.01 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call

기본 점검i

누구나 볼 수 있는 정보를 점검했고, 코드는 읽지 않았어요. 해당하지 않는 항목은 개수에서 뺐어요. · 2026년 11월 9일 점검

• ! 주의

  제작자와 저장소 일치

  게시자(No3men60)가 저장소 소유자(No3men60)가 아니에요. 다른 사람이 등록했을 수 있어요

• … 아직 점검 안 함

  계속 관리되고 있음

  아직 GitHub에서 이 저장소를 읽어 오지 않았어요

• … 아직 점검 안 함

  라이선스 있음

  아직 GitHub에서 이 저장소를 읽어 오지 않았어요

• ✓ 통과

  엔드포인트 응답

  559ms 만에 응답(HTTP 200)

• – 해당 없음

  OAuth로 로그인

  로그인 필요 없음

• ✓ 통과

  도구 설명에 숨겨진 지시 없음

  도구 설명 40개를 읽었고, AI에게 보내는 숨겨진 지시는 없었어요

사이버 보안 카테고리의 다른 서버와 비교i

• 이 카테고리의 다른 서버 1003개 중 0%보다 스타가 많아요
• 이 카테고리의 다른 서버 1003개 중 67%보다 최근에 레지스트리에 공개됐어요
• 기본 점검 결과가 이 카테고리의 다른 서버 1003개 중 33%와 같거나 더 좋아요

레지스트리에서 이 카테고리의 활성 서버 전체와 비교했어요. 스타는 게시자가 저장소를 소유한 경우에만 세요.

대안

같은 카테고리에서 다른 제작자가 만든 서버예요. 스타 순으로 정렬했어요.

카드 보는 법:↓ 주간 다운로드i★ GitHub 스타i세 기둥: 리뷰 · 점검 · 사용 정도i업데이트 = 최신 버전을 레지스트리에 공개한 날i

제작자의 README

저장소에서 README를 찾지 못했어요