Precogly MCP
OfficialClick on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Precogly MCPstart a threat model for our new payment processing service"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Precogly MCP
MCP server for Precogly threat modeling.
Status
Early. Four tools, all read-only:
list_threat_models— threat models in the caller's organizations, most recently updated first, withtotalbeside them. Mounted, that is everything the caller can read; over stdio it is one page of twenty, andtotalis how you tell the difference.search_threat_library,search_countermeasure_library,search_component_library— the shared catalogs installed packs populate, withmatchedandcatalogSizebeside the rows.
Both transports work end to end. A tool reads Precogly through a protocol the mounting application supplies rather than by forwarding the caller's token, which cannot work mounted: a token issued for the MCP endpoint is audience-bound and invalid at Precogly's REST API by construction (0008).
Related MCP server: GauntletCI-MCP
Two transports
Which one you run decides where the credential comes from, and nothing else. The tools, their schemas and their results are identical.
mounted in Precogly | stdio | |
credential | a user authorizes in a browser; the token is the caller's |
|
lifetime | 10 hours, refreshed by the client without a prompt | 60 minutes, re-exported by hand |
acts as | the user who authorized it | whoever the token belongs to |
verified by | the mounting application, against its own tables | not verified; forwarded as-is |
The mounted transport is the product (0008); stdio is what predates it and what the MCP specification prescribes for a server that speaks over a pipe.
Mounted
Precogly serves the endpoint from its own WSGI process at /mcp, and supplies a token
verifier — this package never imports Django. config/mcp_mount.py in the Precogly
repository is the whole of the wiring. A client then needs no configuration beyond the
URL:
{
"mcp": {
"precogly": {
"type": "remote",
"url": "http://localhost:8000/mcp",
"enabled": true
}
}
}For opencode, that is an opencode.json — either in the project
root or in ~/.config/opencode/, which makes the server reachable from any directory —
followed by:
opencode mcp auth precogly # discovery, registration, browser consent
opencode mcp list # ✓ connectedThe client discovers where to authorize from the 401 this endpoint returns, registers itself, and sends the user to Precogly's own login and consent screens (0004, 0009). Nothing is pasted anywhere.
Stdio
Two environment variables, both read by the server process:
| Bearer token for the Precogly API. Required. |
| Base URL of the deployment. Defaults to |
Against a locally seeded instance, a token comes from the login endpoint:
export PRECOGLY_URL=http://localhost:8000
export PRECOGLY_TOKEN=$(curl -s -X POST "$PRECOGLY_URL/api/auth/login/" \
-H 'Content-Type: application/json' \
-d '{"email":"admin@precogly.dev","password":"admin123"}' \
| python3 -c "import sys,json;print(json.load(sys.stdin)['access'])")Either entry point runs it:
uv run precogly-mcp # console script
uv run python -m precogly_mcp.server # equivalentUnder the MCP Inspector, for poking at schemas by hand. --with-editable . is required —
mcp dev runs the file in an ephemeral environment containing only mcp, so without it
nothing in this package imports:
uv run mcp dev src/precogly_mcp/server.py --with-editable .Development
This project uses uv for dependencies and tooling.
uv sync # create .venv and install deps + dev tools
uv run pytest # run tests
uv run ruff check . # lint
uv run ruff format . # format
uv run mypy src # type-check (strict)
uv run pip-audit # scan dependencies for CVEsInstall the git hooks once:
uv run pre-commit installTests need no running Precogly. mcp.client.Client drives the server over in-memory
streams, so tools/list and tools/call are exercised as a client sees them, and
httpx2.MockTransport stands in for the API.
That transport is also their blind spot: every test passed against a version of
tools/call that failed on the first real request, because the fake never enforced the
audience binding a live token carries. A change to how tools reach data, or to what
Precogly's serializers return, wants a run against a seeded stack before it is believed.
Design
0001 — service token model (partially superseded by 0003)
0002 — tool implementation order
0003 — Precogly is the authorization server (resource server superseded by 0008)
0004 — where the user authorizes
0005 — code execution over tools
0006 — catalog search filters here
0007 — re-authenticating at consent
0008 — the MCP server runs inside Precogly
0009 — the authorization pages are built, not copied
0010 — the MCP app owns its resource metadata
Available Tools
1 toollist_threat_modelsList threat modelsARead-onlyIdempotent
List threat models in the caller's organizations, most recently updated first.
Each entry carries what a choice between models turns on: name, description,
criticality, owner, owning team, when it last changed, and the compliance frameworks
it touches. It does not carry a model's contents.
`frameworks` is incidence, not coverage. A framework is listed when at least one
countermeasure maps to at least one of its requirements, so a model addressing a
single control appears identically to one addressing every control. It answers
"which models touch SOC 2 at all", not "which models are SOC 2 compliant".
Returns at most twenty, and cannot reach past the first page. Treat a full page as
"at least twenty" rather than as the whole set.
| Name | Required | Description | Default |
|---|---|---|---|
| organization_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses significant behavioral traits beyond the read-only and idempotent hints: it explains the sort order (most recently updated first), the exact fields in each entry, the nuanced semantics of `frameworks` (incidence vs. coverage, with a concrete example), and the pagination limitation ('cannot reach past the first page' and 'treat a full page as "at least twenty"'). This goes well beyond the annotations and provides critical usage caveats.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three paragraphs but every sentence adds value. It front-loads the main purpose, then details entry fields, clarifies the subtle meaning of `frameworks`, and ends with a critical pagination warning. There is no fluff; the length is appropriate for the tool's complexity. The structure is logical and wastes no words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is highly complete for a read-only list tool: it covers sorting, fields, the nuanced frameworks metric, and pagination behavior. The output schema (though not shown) is complemented by these explanations. The only missing piece is an explicit explanation of `organization_id`, which is a minor gap. Overall, the tool's behavior is almost fully described, making it easy for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has one optional parameter `organization_id` with no description in the schema (0% coverage). The description mentions 'caller's organizations' but does not explain the effect of `organization_id` on the results, nor clarify that omitting it lists all accessible organizations. This is a notable gap for a tool with zero schema coverage, as the description should compensate but only partially implies the parameter's purpose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'List threat models in the caller's organizations, most recently updated first.' It clearly distinguishes the tool's scope by listing what each entry includes and excludes (name, description, criticality, owner, owning team, last changed, frameworks; but not contents). This is more specific than a generic 'list' and provides exact context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context about when to use this tool: to list threat models with metadata and frameworks, not to retrieve model contents. It also mentions pagination limits ('Returns at most twenty, and cannot reach past the first page'), helping users understand the scope. While there are no explicit alternatives mentioned (no sibling tools), the 'does not carry a model's contents' implies that a different tool would be needed for content access. This is clear context without explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
1 tool update
v0.1.0- First observed
list_threat_models
TDQS
With only one tool, there is no possibility of confusion between tools. The tool's purpose is clearly defined as listing threat models.
The single tool name 'list_threat_models' follows a clear verb_noun pattern. While there is no other tool to compare against, the name is unambiguous and well-structured.
A server with only one tool is too thin for a domain like threat models, which typically requires additional operations such as fetching details, creating, updating, or deleting. The single tool feels like a minimal stub rather than a complete server.
The tool surface is severely incomplete for threat model management. It only supports listing models and lacks any way to retrieve a specific model, create a new one, update existing ones, or delete them, leaving agents with a dead-end in the workflow.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
MCP server for building and testing AI agents with multi-model experimentation and insights.
MCP server unifying ERPs, CRMs, APIs and knowledge base for Claude, ChatGPT and Gemini.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceA Model Context Protocol (MCP) server that integrates with the MISP (Malware Information Sharing Platform) to provide threat intelligence capabilities to Large Language Models.12-
- FlicenseBqualityDmaintenanceMCP server that integrates GauntletCI to analyze behavioral change risk in commits, providing findings as text, JSON, or SARIF reports for AI assistants.31-
- AlicenseBqualityBmaintenanceA comprehensive MCP server for structured threat modeling using STRIDE methodology, with automatic code validation and report generation.100100Apache 2.0
- AlicenseNot gradedqualityCmaintenanceServes any STRIDE threat model to MCP-capable LLMs, enabling natural language querying of threat registers and export to the Microsoft Threat Modeling Tool.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/precogly/precogly-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server