List your agent

OT Intel API

MCP server · hosted · v2.0.0 · io.github.no3men60/ot-intel-api
Online · tested 1h agoNEW · 2h agoSeen in the registry 1h ago

OT/ICS threat intel for AI agents: 40 tools, pay per call in USDC on Base via x402.

Website ↗How to connect ↓

What it does

OT Intel API is an MCP server, a connector that lets an AI assistant use it as a tool. It is hosted: an assistant connects to it over the internet, nothing to install.

From the publisher's description, Electra Index matched it to one capability: security scanning. That makes it a candidate for tasks such as review pull requests or scan code for vulnerabilities.

Facts come from the Official MCP Registry, as declared by the publisher. Capabilities are matched automatically (low confidence) and are not a test of the tool.

At a glance

Hosted (remote)YES
Local installNO
Version2.0.0
PriceNot in the registry
First seen20 Oct 2026
Last checked1h ago

How to connect

As declared in the Official MCP Registry · hosted endpoint tested by Electra Index 1h ago (live check)

Hosted endpoint

  • https://ot-intel-api.onrender.com/mcp streamable-http

In Claude Code: claude mcp add --transport http ot-intel-api https://ot-intel-api.onrender.com/mcp

MCP settings (Claude Desktop, Cursor and other MCP clients)

{
  "mcpServers": {
    "ot-intel-api": {
      "url": "https://ot-intel-api.onrender.com/mcp"
    }
  }
}

Live check

Electra Index connected to the hosted endpoint 1h ago

ONLINE OT Intel API answered an MCP connection on 20 Oct 2026 and introduced itself as ot-intel-api 2.0.0 (MCP protocol 2025-06-18).

40 tools offered to AI assistants

  • getCveTriage · CVE lookup enriched for ICS/SCADA environments. Returns OT-adjusted severity, cyber-physical impact, affected ICS layer, compensating controls, patch feasibility, and CISA KEV status. Price: $0.02 USDC per call via x402 on Base mainnet. An
  • getDeviceExposure · Exposure data for OT devices by vendor and model. Default credential risk, exposed OT protocols (Modbus/502, S7comm/102, DNP3/20000, PCOM/20256), and hardening recommendations. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid
  • getThreatActor · ICS/APT threat actor profiles grounded in published vendor research. MITRE ATT&CK for ICS techniques, known malware, attribution, physical impact, targeted sectors. Alias lookup: Volt Typhoon→VOLTZITE, APT44→SANDWORM. Price: $0.03 USDC per
  • getActorsBySector · All ICS threat actors targeting a specific industrial sector from live MITRE ATT&CK ICS STIX data. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry the identical call with
  • getIocEnrichment · IOC enrichment via AlienVault OTX and AbuseIPDB. Returns verdict on whether the IOC is linked to ICS-targeting campaigns. Price: $0.01 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequired challenge; retry t
  • getAdvisories · Latest CISA ICS-CERT advisories filtered by vendor or sector. Returns advisory IDs, CVSS scores, CVE lists, OT severity, and direct triage links. Price: $0.02 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentReq
  • getPatchFeasibility · Full patch feasibility for a CVE in OT/ICS environments. Returns patch availability, OT-safe workarounds, estimated downtime, safe-to-patch-live flag, and risk-vs-disruption score (1-10). Price: $0.05 USDC per call via x402 on Base mainnet.
  • getAssetExposure · Synthesises vendor, model, firmware, sector, and network context into a branchable risk verdict. Returns risk_score (0-100), escalate (boolean), recommended_action, and contributing threat actors. Price: $0.05 USDC per call via x402 on Base
  • getCampaigns · Active campaigns targeting a specific industrial sector. Returns campaign name, attributed actor, start date, targeted geography, TTPs in use, and CVEs being exploited. Price: $0.05 USDC per call via x402 on Base mainnet. An unpaid call ret
  • getSectorDelta · What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes. Price: $0.03 USDC per call via x402 on Base mainnet. An unpaid call returns an
  • getMalwareProfile · Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted OT protocols, attributed actor, and MITRE ATT&CK for ICS techniques. Price: $0.02 USDC per cal
  • getSectorBrief · Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/decreasing), and top 3 recommended actions. One call replaces 5+ chained calls. Pr
Show 28 more
  • getAsnProfile · Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, NakedPages), bulletproof hosting indicators, abuse categories (c2, staging, phishi
  • getDetectionArtifacts · Returns YARA/Sigma detection rules for an ICS malware family or threat actor. Rules sourced from public corpus (Florian Roth signature-base, CISA advisories) are marked validated:true and safe for staging. DeepSeek-synthesised rules carry v
  • getComplianceMapping · Returns triggered compliance controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, and UAE NESA IA. Deterministic table lookup — LLM only add
  • getComplianceBatch · Rolls up compliance-gap mapping across multiple CVEs/threat actors in a single call. Deterministic per-item table lookup against the same compliance_mappings data as /ot/compliance, deduplicated and rolled up into one aggregate severity rat
  • getThreatScore · Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus GDELT geopolitical tension and OFAC sanctions pressure. Not LLM-generated. Price: $0.04 USDC per call via x40
  • getPrecursorTtp · Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impa
  • getRootCauseLocalization · Ranks which sensors most likely drove a reported anomaly by z-score deviation from each sensor's own baseline, given a caller-supplied telemetry window. Fully deterministic, no LLM, no trained model. Statistical approximation inspired by Os
  • getThreatHuntControlLoop · Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Fully deterministic keyword-pattern matching, no LLM. Grounded in CyberAgentX and AgenticCyOps (arXiv 2603.09134).
  • getInvariantReachability · Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out via conservation of mass. Fully deterministic, no LLM, no trained model. Inspired by Barbhaya et al. 2025's physical-invariant
  • getVendorRisk · OT/ICS supply-chain vendor risk assessment. Returns risk tier, confidence, cited CVEs (KEV/EPSS), threat actors with historical targeting interest, and supply-chain mitigation recommendations. DeepSeek-synthesised, ICD-203 language. Price:
  • getRiskExposure · Aggregates the same deterministic capability x opportunity x intent scoring used by /ot/threat-score across the actors relevant to a sector+region, ranks them, and returns a DeepSeek-written executive summary (BLUF, ICD-203 language). Portf
  • getActionConformance · Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector/region context. Built on the same capability x opportunity x intent scoring as
  • getAiExposure · AI/agentic copilot exposure lookup for OT/ICS vendors. Returns the vendor's documented AI/agentic copilot, autonomy level (advisory vs agentic — the key risk differentiator), access, and applicable MITRE ATLAS techniques. Hand-verified mapp
  • getAiUplift · Assesses how much a general-purpose AI agent lowers the skill/time barrier for an attacker to reach a vendor's OT-adjacent footprint. Grounded in a real-world precedent (Dragos, May 2026), not frontier-model governance thresholds. Distinct
  • getAiAttackFeasibility · Deterministic lookup against one specific empirical study (Cook, Stoica, Shah & Pezaros, ACM Trans. Priv. Sec. 29, 3, Article 31, June 2026) testing whether off-the-shelf general-purpose LLMs can generate working attack code against real PL
  • getClaimReliability · Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against the paper's three failure modes — spurious correlation, contradictory knowledge,
  • getStixCoverage · Deterministic lookup grounded in Hahn, Krief et al., 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXiv:2512.18714v3, Jan 2026). Returns whether STIX 2.1 can represent a given techni
  • getMitigationMap · Prescriptive D3FEND-mapped mitigation guidance for OT/ICS threats. Pass one of actor, cve_id, or technique_id, optionally with vendor_stack. Returns matched ATT&CK ICS techniques mapped to D3FEND defensive countermeasures with priority and
  • getActorReport · Synthesised Markdown threat report for an ICS/APT actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/advisory, /ot/detection internally (no extra charge) and synthesises via DeepSeek. Returns executive summary, actor profile, acti
  • getActorDossier · Comprehensive intelligence dossier for an ICS threat actor. Fans out to /ot/actor, /ot/campaign, /ot/malware, /ot/ioc, /ot/asn, /ot/detection. Returns full profile, infrastructure analysis, IOC table, detection rules, kill chain mapping, an
  • getSectorSitrep · 30-day situation report for an industrial sector. Fans out to /ot/actor/sector, /ot/advisory, /ot/campaign, /ot/delta, /ot/compliance. Returns threat landscape, top active actors, new advisories, what changed, compliance posture impact, and
  • getCtiArticle · Publication-ready threat intelligence article (~700 words). Fans out to /ot/actor or /ot/cve + /ot/campaign + /ot/malware + /ot/advisory. DeepSeek writes in journalistic CTI style with headline, lede, body, defanged IOCs, and TLP marking. S
  • getLinkedinPost · LinkedIn post for a CTI/ICS security audience. Fans out to /ot/actor or /ot/cve + /ot/advisory. Returns hook line, 3-5 intelligence bullet observations, call to action, and hashtags. Ready to publish. Price: $0.15 USDC per call via x402 on
  • getXThread · X/Twitter thread for an actor or CVE. Fans out to /ot/actor or /ot/cve. Returns 5-7 posts: hook, intel posts with ATT&CK IDs and affected systems, mitigation post, and hashtag post. Each post under 280 characters. Price: $0.10 USDC per call
  • getAnalystBrief · Human-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector. Same fan-out data as /ot/report but synthesised into a short decision-ready brief instead of a full repo
  • getVendorRiskDelta · Counterfactual vendor-swap risk comparison. Runs the same assessment used by /ot/vendor-risk on each vendor and returns the risk-tier delta plus per-vendor summaries, for pre-purchase or migration decisions. Price: $0.20 USDC per call via x
  • submitSighting · Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment. Feeds the correlation corpus without storing an org identifier. Written to a separate sightings store, not intel.db. Price: $0.05 USDC per call via x402 on B
  • getGccBulletin · Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep. Price: $0.01 USDC per call via x402 on Base mainnet. An unpaid call returns an x402 PaymentRequi

What "online" means: the server answered an MCP connection at the time of the check. It is not a guarantee of security, quality or continuous uptime. How we test: we open an MCP session and ask for the tool list, as an AI assistant would. We never run a tool and never send a key. Checked every few days. Method

Tasks it helps with

Share of each task's required capabilities it covers
Review pull requests
Security Scanning
50%
Scan code for vulnerabilities
Security Scanning
50%

Similar tools

Listed for the same task: review pull requests
  • diffpilotREMOTELOCAL
    MCP server for PR code review, commit messages, changelogs, and secret detection
  • MCP Code Review ServerREMOTELOCAL
    Code review as an MCP server — structured reviews with OWASP security scanning
  • StrixREMOTELOCAL
    AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets
  • flowRREMOTELOCAL
    Static dataflow analysis, program slicing, linting, and dependency extraction for R code
  • Fairquery Agent Trust & Data SafetyREMOTELOCAL
    PII/secret redaction, email checks, sanctions screening and OSV vulnerability lookups for AI agents
  • SkillTotalREMOTELOCAL
    Deterministic security scan of MCP servers, agent skills and npm/PyPI packages. Runs locally

Ready-made AI agents

An MCP server is a connector you add to your own assistant. These are finished products that do the same job for you:

Facts & evidence

Each fact shows where it was seen and when.
FactValueEvidenceSourceLast confirmed
Hosted endpointhttps://ot-intel-api.onrender.com/mcpDECLAREDSRC-001 Official MCP Registry1h ago
Local install (package)noDECLAREDSRC-001 Official MCP Registry1h ago
Remote access (hosted)yesDECLAREDSRC-001 Official MCP Registry1h ago
Websitehttps://ot-intel-api.onrender.com/SKILL.mdDECLAREDSRC-001 Official MCP Registry1h ago
Registry statusactiveDECLAREDSRC-001 Official MCP Registry1h ago
Version2.0.0DECLAREDSRC-001 Official MCP Registry1h ago
MCP serveryesDECLAREDSRC-001 Official MCP Registry1h ago

Change history

  • NEW20 Oct 2026
    first seen in the index

Is this page accurate?

Flag it and our robot re-checks the official source. Reports never change a score.

Questions about OT Intel API

How do I connect OT Intel API?

Use the hosted endpoint https://ot-intel-api.onrender.com/mcp in your assistant's MCP settings. The exact settings are in "How to connect" above, as declared in the Official MCP Registry.

What tools does OT Intel API offer?

When Electra Index connected on 20 Oct 2026, it listed 40 tools: getCveTriage, getDeviceExposure, getThreatActor, getActorsBySector, getIocEnrichment, getAdvisories, getPatchFeasibility, getAssetExposure and more. The full list is in "Live check" above.

Is OT Intel API online?

Yes. Its hosted endpoint answered an MCP connection from Electra Index 1h ago.

What can I use OT Intel API for?

Based on its description, it is most relevant to: review pull requests, scan code for vulnerabilities.