{"serverId":"mcp-registry/io.github.project-gifted1/pg1-threat-intel","tools":[{"name":"check_agent_card","fixed":{"name":"check_agent_card","description":"PG1 Sovereign Threat Intelligence: checks another agent before you trust it. Fetches its /.well-known/agent-card.json (https only; private addresses and redirects refused): is it a valid A2A agent card, does its name claim a well-known brand the domain does not belong to, how old is the domain, is the hostname on the phishing blocklist or a look-alike. Always free (60/hour per caller). Give url or domain. Returns status flagged / no_flags / unknown; no_flags means no flags found, never \"safe\".","inputSchema":{"type":"object","properties":{"url":{"type":"string","maxLength":2048,"description":"The agent's https URL or its agent card URL."},"domain":{"type":"string","maxLength":253,"description":"Or just the agent's domain."}},"additionalProperties":false},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":225,"tokensAfter":225},{"name":"check_domain_age","fixed":{"name":"check_domain_age","description":"PG1 Sovereign Threat Intelligence: looks up a domain's registration age via RDAP (the IANA-standardized WHOIS successor), resolved through the IANA bootstrap registry for the correct per-TLD RDAP server. No payment required — this tool is always free. SIBLING DIFFERENTIATION: Use for domain registration/age checks only. Do NOT use for reputation/threat-feed lookups (use get_ioc_context) or sanctions screening (use check_wallet_sanctions). BEHAVIOR: Returns { found: true, available: true, registr","inputSchema":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string","description":"Mandatory domain name or URL to check, e.g. 'example.com' or 'https://example.com/path'. The registrable domain is extracted automatically."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":222,"tokensAfter":222},{"name":"check_hostname_reputation","fixed":{"name":"check_hostname_reputation","description":"PG1 Sovereign Threat Intelligence: checks a single hostname against the MetaMask eth-phishing-detect blocklist/allowlist and a lookalike/typosquat detector, synced daily by the sovereign-threat-pipeline. No payment required — this tool is always free. SIBLING DIFFERENTIATION: Use for phishing/lookalike-domain screening of a hostname only. Do NOT use for domain registration age (use check_domain_age), general threat-feed indicator lookups (use get_ioc_context), or wallet sanctions screening (use ","inputSchema":{"type":"object","required":["hostname"],"properties":{"hostname":{"type":"string","description":"Mandatory bare hostname to screen, e.g. 'example.com'. Not a URL — no scheme, path, port, spaces, or wildcards. One hostname per call."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":224,"tokensAfter":224},{"name":"check_ip_abuse","fixed":{"name":"check_ip_abuse","description":"PG1 Sovereign Threat Intelligence: looks up one public IPv4 or IPv6 address in AbuseIPDB using YOUR OWN AbuseIPDB API key (free or paid), and returns its abuse confidence score and report counts with attribution to AbuseIPDB. BRING YOUR OWN KEY: send the key in the X-AbuseIPDB-Key HTTP request header on /api/mcp or /api/a2a - never as a tool argument. PG1 has no AbuseIPDB key of its own; without the header the call returns an MCP tool error (isError: true, code abuseipdb_key_required) and AbuseI","inputSchema":{"type":"object","required":["ip"],"properties":{"ip":{"type":"string","description":"Mandatory single public IPv4 or IPv6 address, e.g. '8.8.8.8' or '2001:4860:4860::8888'. No port, CIDR range, brackets or zone id."},"max_age_in_days":{"type":["integer","null"],"maximum":365,"minimum":1,"description":"Optional reporting window in days, 1 to 365. Only reports from this many days back are counted. Defaults to 90."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":272,"tokensAfter":272},{"name":"check_package","fixed":{"name":"check_package","description":"PG1 Sovereign Threat Intelligence: a pre-install check for one npm or PyPI package - check before you install. No payment required - this tool is always free, and no AI model is involved. SIBLING DIFFERENTIATION: Use before installing or recommending a software package (npm or PyPI) only. Do NOT use for domains (use check_domain_age / check_hostname_reputation), CVE ids (use get_cve_details) or products by vendor name (use get_cve_by_product). BEHAVIOR: Returns { ecosystem, name, version_checked","inputSchema":{"type":"object","required":["ecosystem","name"],"properties":{"name":{"type":"string","description":"Mandatory package name, exactly one, e.g. 'lodash', '@types/node' or 'requests'."},"version":{"type":["string","null"],"description":"Optional exact version to check, e.g. '4.17.21'. No ranges or tags. Defaults to the latest published version."},"ecosystem":{"enum":["npm","pypi"],"type":"string","description":"Mandatory package ecosystem: 'npm' or 'pypi'."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":284,"tokensAfter":284},{"name":"check_wallet_age","fixed":{"name":"check_wallet_age","description":"PG1 Sovereign Threat Intelligence: reports when an EVM wallet address first appeared on a given chain, based on its earliest on-chain transfer history (in or out), plus whether the address is a contract. No payment required — this tool is always free. SIBLING DIFFERENTIATION: Use for wallet age/history only. Do NOT use for sanctions screening (use check_wallet_sanctions), domain age (use check_domain_age), or hostname/phishing reputation (use check_hostname_reputation). BEHAVIOR: Returns { addre","inputSchema":{"type":"object","required":["address"],"properties":{"chain":{"enum":["base","ethereum","arbitrum","optimism","polygon","bsc",null],"type":["string","null"],"default":"base","description":"Optional chain to check: 'base', 'ethereum', 'arbitrum', 'optimism', 'polygon', or 'bsc'. Defaults to 'base'."},"address":{"type":"string","description":"Mandatory EVM wallet address to check, formatted '0x' followed by 40 hex characters (case-insensitive)."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":281,"tokensAfter":281},{"name":"check_wallet_sanctions","fixed":{"name":"check_wallet_sanctions","description":"PG1 Sovereign Threat Intelligence: checks a cryptocurrency wallet address against the OFAC SDN (Specially Designated Nationals) sanctions list, synced daily from US Treasury data. No payment required — this tool is always free. SIBLING DIFFERENTIATION: Use for wallet/address sanctions screening only. Do NOT use for IP/domain/hash/URL threat lookups (use get_ioc_context) or CVE data (use get_cve_details). BEHAVIOR: Returns { listed: true|false, matches, source, list_last_synced }. A listed:false ","inputSchema":{"type":"object","required":["address"],"properties":{"address":{"type":"string","description":"Mandatory wallet address to screen, e.g. an EVM 0x address, a bech32 (bc1/tb1/ltc1...) address, or a base58 address."},"currency":{"type":["string","null"],"description":"Optional currency/chain filter to narrow the match, e.g. 'BTC', 'ETH', 'XMR'."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":254,"tokensAfter":254},{"name":"check_x402_endpoint","fixed":{"name":"check_x402_endpoint","description":"PG1 Sovereign Threat Intelligence: checks an x402-paid URL before you pay it. Fetches the URL once (https only; private addresses and redirects refused) and reads its x402 payment request: each option's network must be a known settlement network and its asset the known USDC contract there; the receiving wallet (payTo) is screened against the OFAC SDN list and its on-chain age read; TLS and the domain's age are checked. Always free (60/hour per caller). Returns status flagged / no_flags / unknown","inputSchema":{"type":"object","required":["url"],"properties":{"url":{"type":"string","maxLength":2048,"description":"The https URL of the paid resource."}},"additionalProperties":false},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":205,"tokensAfter":205},{"name":"get_cve_batch","fixed":{"name":"get_cve_batch","description":"PG1 Sovereign Threat Intelligence: looks up multiple CVE identifiers in a single call, each enriched with NVD description/CVSS and CISA KEV status (plus the FIRST.org EPSS score when this server serves EPSS in paid responses) — same enrichment as get_cve_details, batched. Payment required: $0.01 via x402, sent in params._meta['x402/payment'] (the PAYMENT-SIGNATURE header is also accepted), or a valid Gumroad license key (X-API-KEY header). SIBLING DIFFERENTIATION: Use for looking up several know","inputSchema":{"type":"object","required":["cve_ids"],"properties":{"cve_ids":{"type":"array","items":{"type":"string"},"description":"Array of CVE identifiers, each formatted 'CVE-YYYY-NNNN'. Max 20 per call."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":210,"tokensAfter":210},{"name":"get_cve_by_product","fixed":{"name":"get_cve_by_product","description":"PG1 Sovereign Threat Intelligence: returns CVEs affecting a given vendor/product (optionally a specific version), enriched with CVSS and CISA KEV status (plus EPSS when this server serves EPSS in paid responses), sorted by exploitation risk. Sourced from NVD keyword search. Payment required: $0.01 via x402, sent in params._meta[\"x402/payment\"] (the PAYMENT-SIGNATURE header is also accepted), or a valid Gumroad license key (X-API-KEY header). SIBLING DIFFERENTIATION: Use for discovering CVEs by v","inputSchema":{"type":"object","required":["vendor","product"],"properties":{"vendor":{"type":"string","description":"Vendor name, e.g. 'apache'."},"product":{"type":"string","description":"Product name, e.g. 'log4j'."},"version":{"type":"string","description":"Optional specific version, e.g. '2.14.1'."},"only_kev":{"type":"boolean","description":"If true, only return CVEs on the CISA KEV list."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":264,"tokensAfter":264},{"name":"get_cve_details","fixed":{"name":"get_cve_details","description":"PG1 Sovereign Threat Intelligence: enriched CVE lookup combining NVD (description, CVSS score/vector) and the CISA Known Exploited Vulnerabilities catalog (active wild exploitation status). The epss field (FIRST.org EPSS exploit-probability score and percentile) is present only when this server serves EPSS in paid responses. Payment required: $0.01 via x402, sent in params._meta[\"x402/payment\"] (the PAYMENT-SIGNATURE header is also accepted), or a valid Gumroad license key (X-API-KEY header). SI","inputSchema":{"type":"object","required":["cve_id"],"properties":{"cve_id":{"type":"string","description":"Mandatory official CVE identifier string strictly formatted as 'CVE-YYYY-NNNN' (e.g., 'CVE-2021-44228')."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":212,"tokensAfter":212},{"name":"get_ioc_batch","fixed":{"name":"get_ioc_batch","description":"PG1 Sovereign Threat Intelligence: looks up multiple indicators (IPs, domains, URLs, hashes) in a single call — a batched pre-action safety check for AI agents. Each returns the same aggregated provenance as get_ioc_context from PG1's commercially licensed records, which currently hold only CVE identifiers from NVD (IPs, domains, URLs and hashes return found: false). SIBLING DIFFERENTIATION: Use for checking several indicators at once (e.g. all URLs an agent is about to visit). Do NOT use for a ","inputSchema":{"type":"object","required":["values"],"properties":{"values":{"type":"array","items":{"type":"string"},"description":"Array of indicator values (IPv4 addresses, domains, URLs, or hashes) to look up. Max 20 per call."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":216,"tokensAfter":216},{"name":"get_ioc_context","fixed":{"name":"get_ioc_context","description":"PG1 Sovereign Threat Intelligence: looks up a single specific indicator value (IP, domain, URL, or hash) — the recommended pre-action safety check for AI agents before visiting, downloading, or connecting to something. PG1's commercially licensed records currently hold only CVE identifiers from NVD, so an IP, domain, URL or hash returns found: false (free) until other licensed sources are added. A match returns aggregated provenance — reporting sources, observation count, aggregated confidence s","inputSchema":{"type":"object","required":["value"],"properties":{"value":{"type":"string","description":"Mandatory exact indicator string value to look up, such as an IPv4 address (198.51.100.1), fully qualified domain, complete URL, or SHA-256 hash string."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":224,"tokensAfter":224},{"name":"get_threat_actor_profile","fixed":{"name":"get_threat_actor_profile","description":"PG1 Sovereign Threat Intelligence: returns a dossier for a known threat actor / APT group — aliases, description, associated MITRE ATT&CK techniques, and associated malware/tooling. Sourced from MITRE ATT&CK Enterprise. Payment required: $0.01 via x402, sent in params._meta['x402/payment'] (the PAYMENT-SIGNATURE header is also accepted), or a valid Gumroad license key (X-API-KEY header). SIBLING DIFFERENTIATION: Use for actor/group-level profiling. Do NOT use for single-indicator lookups (use ge","inputSchema":{"type":"object","required":["actor_name"],"properties":{"actor_name":{"type":"string","description":"Group name or known alias, e.g. 'APT29' or 'Cozy Bear'. Matching is case-insensitive against both the group's primary name and its known aliases."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":228,"tokensAfter":228},{"name":"get_threat_indicators","fixed":{"name":"get_threat_indicators","description":"PG1 Sovereign Threat Intelligence: returns a STIX 2.1 bundle of CVE records from NIST NVD, the only source PG1 may currently redistribute commercially. Today it contains no IP, domain, URL or file-hash indicators: every object is a STIX vulnerability with the CVE id and an NVD reference, without scores (use get_cve_details for CVSS and known-exploited status). FREE (CVE records from NIST NVD); does not use the 5 free paid calls a day; no payment, no licence key (the operator's PG1_FEED_PAID swit","inputSchema":{"type":"object","properties":{"type":{"type":["string","null"],"description":"Indicator category filter. Allowed enum-style values: 'IPv4', 'domain', 'URL', 'FileHash-MD5', 'FileHash-SHA1', or 'FileHash-SHA256'."},"limit":{"type":["integer","null"],"default":500,"description":"Pagination boundary constraint defining the maximum number of indicators to return in a single payload (integer between 1 and 1000, defaulting to 500)."},"since":{"type":["string","null"],"description":"ISO timestamp constraint (e.g., 2026-09-20T00:00:00Z); strictly filters and returns only indicators last seen after this exact timestamp."},"min_score":{"type":["integer","null"],"description":"Confidence score threshold integer ranging inclusively from 0 to 100 to filter low-confidence noise."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":374,"tokensAfter":374},{"name":"get_usage_status","fixed":{"name":"get_usage_status","description":"PG1 Sovereign Threat Intelligence: returns your remaining free-tier calls for today and current Gumroad license status. No payment required — this tool is always free.","inputSchema":{"type":"object","properties":{"identifier":{"type":"string","description":"Optional — the X-API-KEY or identifier to check usage for; defaults to the calling identifier if omitted."},"license_key":{"type":"string","description":"Optional — check Gumroad license status alongside free-tier usage."}}},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":147,"tokensAfter":147},{"name":"preflight_check","fixed":{"name":"preflight_check","description":"PG1 Sovereign Threat Intelligence: ONE call before an agent acts. Give the action you are about to take and its target; PG1 runs every relevant check in parallel and returns one decision: no_flags, flagged or unknown, with merged reasons, per-check results and latency. no_flags means no flags found in the checks run, never \"safe\". Fail closed: any check that does not finish makes the decision unknown, never no_flags. Actions: pay (a wallet address: sanctions + wallet age; or an https x402 URL: t","inputSchema":{"type":"object","required":["action","target"],"properties":{"chain":{"enum":["base","ethereum","arbitrum","optimism","polygon","bsc"],"type":"string","description":"For pay to a wallet: the chain (default base)."},"action":{"enum":["pay","open","install","patch","trust_agent"],"type":"string","description":"What you are about to do."},"target":{"type":"string","maxLength":300,"description":"What you are about to do it to: a wallet address, URL, hostname, package name (name or name@version), CVE id or \"vendor product version\", or an agent URL/domain."},"ecosystem":{"enum":["npm","pypi"],"type":"string","description":"For install: the package registry."}},"additionalProperties":false},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":349,"tokensAfter":349},{"name":"submit_indicator","fixed":{"name":"submit_indicator","description":"PG1 Sovereign Threat Intelligence: submit an observed indicator for validation and possible inclusion in future query results. Requires a valid Gumroad license key (X-API-KEY header) — this tool is NOT available via per-query x402. Submissions are staged for review, not immediately added to the live feed.","inputSchema":{"type":"object","required":["indicator","indicator_type"],"properties":{"indicator":{"type":"string"},"confidence":{"type":"integer","description":"Submitter's own confidence, 0-100."},"source_note":{"type":"string","description":"Optional free-text on how this was observed."},"indicator_type":{"type":"string"},"malware_family":{"type":"string","description":"Optional."}}},"annotations":{"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: false, destructiveHint: false, idempotentHint: false (inferred from the name).","verify":true}],"tokensBefore":206,"tokensAfter":206}],"toolsChanged":18,"tokensSaved":0,"todo":[{"tool":"hosting_advisor","params":["workload_type"]},{"tool":"submit_indicator","params":["indicator","indicator_type"]}],"note":"Deterministic fixes. Changes marked verify need a human look before shipping (renames, inferred annotations, inferred types, removed text). Parameter descriptions in `todo` need to be written by someone who knows the API."}