Skip to main content
Glama
precogly

Precogly MCP

Official
by precogly

Precogly MCP

MCP server for Precogly threat modeling.

Status

Early. Four tools, all read-only:

  • list_threat_models — threat models in the caller's organizations, most recently updated first, with total beside them. Mounted, that is everything the caller can read; over stdio it is one page of twenty, and total is how you tell the difference.

  • search_threat_library, search_countermeasure_library, search_component_library — the shared catalogs installed packs populate, with matched and catalogSize beside the rows.

Both transports work end to end. A tool reads Precogly through a protocol the mounting application supplies rather than by forwarding the caller's token, which cannot work mounted: a token issued for the MCP endpoint is audience-bound and invalid at Precogly's REST API by construction (0008).

Related MCP server: GauntletCI-MCP

Two transports

Which one you run decides where the credential comes from, and nothing else. The tools, their schemas and their results are identical.

mounted in Precogly

stdio

credential

a user authorizes in a browser; the token is the caller's

PRECOGLY_TOKEN from the environment

lifetime

10 hours, refreshed by the client without a prompt

60 minutes, re-exported by hand

acts as

the user who authorized it

whoever the token belongs to

verified by

the mounting application, against its own tables

not verified; forwarded as-is

The mounted transport is the product (0008); stdio is what predates it and what the MCP specification prescribes for a server that speaks over a pipe.

Mounted

Precogly serves the endpoint from its own WSGI process at /mcp, and supplies a token verifier — this package never imports Django. config/mcp_mount.py in the Precogly repository is the whole of the wiring. A client then needs no configuration beyond the URL:

{
  "mcp": {
    "precogly": {
      "type": "remote",
      "url": "http://localhost:8000/mcp",
      "enabled": true
    }
  }
}

For opencode, that is an opencode.json — either in the project root or in ~/.config/opencode/, which makes the server reachable from any directory — followed by:

opencode mcp auth precogly     # discovery, registration, browser consent
opencode mcp list              # ✓ connected

The client discovers where to authorize from the 401 this endpoint returns, registers itself, and sends the user to Precogly's own login and consent screens (0004, 0009). Nothing is pasted anywhere.

Stdio

Two environment variables, both read by the server process:

PRECOGLY_TOKEN

Bearer token for the Precogly API. Required.

PRECOGLY_URL

Base URL of the deployment. Defaults to http://localhost:8000.

Against a locally seeded instance, a token comes from the login endpoint:

export PRECOGLY_URL=http://localhost:8000
export PRECOGLY_TOKEN=$(curl -s -X POST "$PRECOGLY_URL/api/auth/login/" \
  -H 'Content-Type: application/json' \
  -d '{"email":"admin@precogly.dev","password":"admin123"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['access'])")

Either entry point runs it:

uv run precogly-mcp                  # console script
uv run python -m precogly_mcp.server # equivalent

Under the MCP Inspector, for poking at schemas by hand. --with-editable . is required — mcp dev runs the file in an ephemeral environment containing only mcp, so without it nothing in this package imports:

uv run mcp dev src/precogly_mcp/server.py --with-editable .

Development

This project uses uv for dependencies and tooling.

uv sync                    # create .venv and install deps + dev tools
uv run pytest              # run tests
uv run ruff check .        # lint
uv run ruff format .       # format
uv run mypy src            # type-check (strict)
uv run pip-audit           # scan dependencies for CVEs

Install the git hooks once:

uv run pre-commit install

Tests need no running Precogly. mcp.client.Client drives the server over in-memory streams, so tools/list and tools/call are exercised as a client sees them, and httpx2.MockTransport stands in for the API.

That transport is also their blind spot: every test passed against a version of tools/call that failed on the first real request, because the fake never enforced the audience binding a live token carries. A change to how tools reach data, or to what Precogly's serializers return, wants a run against a seeded stack before it is believed.

Design

  • 0001 — service token model (partially superseded by 0003)

  • 0002 — tool implementation order

  • 0003 — Precogly is the authorization server (resource server superseded by 0008)

  • 0004 — where the user authorizes

  • 0005 — code execution over tools

  • 0006 — catalog search filters here

  • 0007 — re-authenticating at consent

  • 0008 — the MCP server runs inside Precogly

  • 0009 — the authorization pages are built, not copied

  • 0010 — the MCP app owns its resource metadata

Available Tools

1 tool
list_threat_modelsList threat modelsA
Read-onlyIdempotent

List threat models in the caller's organizations, most recently updated first.

Each entry carries what a choice between models turns on: name, description,
criticality, owner, owning team, when it last changed, and the compliance frameworks
it touches. It does not carry a model's contents.

`frameworks` is incidence, not coverage. A framework is listed when at least one
countermeasure maps to at least one of its requirements, so a model addressing a
single control appears identically to one addressing every control. It answers
"which models touch SOC 2 at all", not "which models are SOC 2 compliant".

Returns at most twenty, and cannot reach past the first page. Treat a full page as
"at least twenty" rather than as the whole set.
ParametersJSON Schema
NameRequiredDescriptionDefault
organization_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses significant behavioral traits beyond the read-only and idempotent hints: it explains the sort order (most recently updated first), the exact fields in each entry, the nuanced semantics of `frameworks` (incidence vs. coverage, with a concrete example), and the pagination limitation ('cannot reach past the first page' and 'treat a full page as "at least twenty"'). This goes well beyond the annotations and provides critical usage caveats.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three paragraphs but every sentence adds value. It front-loads the main purpose, then details entry fields, clarifies the subtle meaning of `frameworks`, and ends with a critical pagination warning. There is no fluff; the length is appropriate for the tool's complexity. The structure is logical and wastes no words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is highly complete for a read-only list tool: it covers sorting, fields, the nuanced frameworks metric, and pagination behavior. The output schema (though not shown) is complemented by these explanations. The only missing piece is an explicit explanation of `organization_id`, which is a minor gap. Overall, the tool's behavior is almost fully described, making it easy for an agent to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has one optional parameter `organization_id` with no description in the schema (0% coverage). The description mentions 'caller's organizations' but does not explain the effect of `organization_id` on the results, nor clarify that omitting it lists all accessible organizations. This is a notable gap for a tool with zero schema coverage, as the description should compensate but only partially implies the parameter's purpose.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'List threat models in the caller's organizations, most recently updated first.' It clearly distinguishes the tool's scope by listing what each entry includes and excludes (name, description, criticality, owner, owning team, last changed, frameworks; but not contents). This is more specific than a generic 'list' and provides exact context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context about when to use this tool: to list threat models with metadata and frameworks, not to retrieve model contents. It also mentions pagination limits ('Returns at most twenty, and cannot reach past the first page'), helping users understand the scope. While there are no explicit alternatives mentioned (no sibling tools), the 'does not carry a model's contents' implies that a different tool would be needed for content access. This is clear context without explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 1 tool updatev0.1.0
    • First observedlist_threat_models

TDQS

A4/5.0
Disambiguation5/5

With only one tool, there is no possibility of confusion between tools. The tool's purpose is clearly defined as listing threat models.

Naming Consistency5/5

The single tool name 'list_threat_models' follows a clear verb_noun pattern. While there is no other tool to compare against, the name is unambiguous and well-structured.

Tool Count2/5

A server with only one tool is too thin for a domain like threat models, which typically requires additional operations such as fetching details, creating, updating, or deleting. The single tool feels like a minimal stub rather than a complete server.

Completeness1/5

The tool surface is severely incomplete for threat model management. It only supports listing models and lacks any way to retrieve a specific model, create a new one, update existing ones, or delete them, leaving agents with a dead-end in the workflow.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    D
    maintenance
    A Model Context Protocol (MCP) server that integrates with the MISP (Malware Information Sharing Platform) to provide threat intelligence capabilities to Large Language Models.
    12
    -
  • A
    license
    B
    quality
    B
    maintenance
    A comprehensive MCP server for structured threat modeling using STRIDE methodology, with automatic code validation and report generation.
    100
    100
    Apache 2.0
  • A
    license
    Not graded
    quality
    C
    maintenance
    Serves any STRIDE threat model to MCP-capable LLMs, enabling natural language querying of threat registers and export to the Microsoft Threat Modeling Tool.
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/precogly/precogly-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server