Security & Testing
ot-intel-api.onrender.com
Provides ICS/OT security threat intelligence, including CVE triage, device exposure, threat actor profiles, and IOC enrichment.
ENDPOINT 1
https://ot-intel-api.onrender.com/mcp
MCP server metadata
- Name
- ot-intel-api
- Version
- 2.0.0
OT/ICS threat intelligence. Every tool is a paid call priced in USDC on Base mainnet via x402. Call a tool without payment to receive an x402 PaymentRequired challenge (isError:true, structuredContent). Sign it with an x402 client and retry the identical call (same arguments) with the payload in params._meta["x402/payment"]. The settlement receipt is returned in result._meta["x402/payment-response"]. Full schema: https://ot-intel-api.onrender.com/openapi.json
Known tools 40
getThreatActorICS/APT threat actor profiles grounded in published vendor research.
Inferred read-onlygetActorsBySectorAll ICS threat actors targeting a specific industrial sector from live MITRE ATT&CK ICS STIX data.
Inferred read-onlygetAssetExposureSynthesises vendor, model, firmware, sector, and network context into a branchable risk verdict.
Inferred read-onlygetSectorDeltaWhat is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity.
Inferred read-onlygetMalwareProfileStructured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY.
Inferred read-onlygetDetectionArtifactsReturns YARA/Sigma detection rules for an ICS malware family or threat actor.
Inferred read-onlygetComplianceMappingReturns triggered compliance controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.
Inferred read-onlygetComplianceBatchRolls up compliance-gap mapping across multiple CVEs/threat actors in a single call.
Inferred read-onlygetThreatScoreDeterministic capability x opportunity x intent threat score for an actor-target pairing.
Inferred read-onlygetPrecursorTtpBuckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact).
Potential side effectsgetRootCauseLocalizationRanks which sensors most likely drove a reported anomaly by z-score deviation from each sensor's own baseline, given a caller-supplied telemetry window.
Inferred read-onlygetThreatHuntControlLoopFlags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations.
Potential side effectsgetInvariantReachabilityChecks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out via conservation of mass.
Inferred read-onlygetRiskExposureAggregates the same deterministic capability x opportunity x intent scoring used by /ot/threat-score across the actors relevant to a sector+region, ranks them, and returns a DeepSeek-written executive summary (BLUF, ICD-203 language).
Inferred read-onlygetActionConformanceDeterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.
Inferred read-onlygetAiUpliftAssesses how much a general-purpose AI agent lowers the skill/time barrier for an attacker to reach a vendor's OT-adjacent footprint.
Inferred read-onlygetAiAttackFeasibilityDeterministic lookup against one specific empirical study (Cook, Stoica, Shah & Pezaros, ACM Trans.
Inferred read-onlygetMitigationMapPrescriptive D3FEND-mapped mitigation guidance for OT/ICS threats.
Inferred read-onlygetAnalystBriefHuman-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector.
Inferred read-onlysubmitSightingSubmit an anonymized IOC/TTP sighting observed in the caller's own OT environment.
Inferred read-onlygetGccBulletinRecurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish, sourced from the same intel.
Potential side effectsCONNECT WITH APPROVAL
Client installation
Review this server and its permissions before adding it. Secret placeholders must be set locally.
Codex
~/.codex/config.toml
[mcp_servers.ot-intel-api]
url = "https://ot-intel-api.onrender.com/mcp"
enabled = trueClaude Code
.mcp.json
{
"mcpServers": {
"ot-intel-api": {
"type": "http",
"url": "https://ot-intel-api.onrender.com/mcp"
}
}
}Claude Desktop
Settings → Connectors → Add custom connector
Name: ot-intel-api
Remote MCP URL: https://ot-intel-api.onrender.com/mcpAdd this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.
Cursor
.cursor/mcp.json
{
"mcpServers": {
"ot-intel-api": {
"url": "https://ot-intel-api.onrender.com/mcp"
}
}
}Visual Studio Code
.vscode/mcp.json
Add to Visual Studio Code{
"servers": {
"ot-intel-api": {
"type": "http",
"url": "https://ot-intel-api.onrender.com/mcp"
}
}
}Generic MCP
Client-specific MCP configuration
{
"name": "ot-intel-api",
"transport": "streamable-http",
"url": "https://ot-intel-api.onrender.com/mcp"
}MCP Inspector
Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.
TRUST AND VERIFICATION EVIDENCE
Trust Data Available
BuiltWith Trust API v2 evidence for onrender.com was fetched 2026-09-27T04:50:32.253Z.
onrender.com is assessed as Trusted: Domain has an established technology history spanning over a year.
Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.