Intel Threadlinqs MCP

Actor Intelligence

get_actor_intelligence

Read-onlyIdempotent

Uncover which threat actors overlap with a given actor and why—combining actor profile, relationships, and cross-actor attribution ranked by shared malware, infrastructure, or TTPs.

Instructions

Composite intelligence picture for a threat actor: the actor profile (threats, MITRE, IOC counts, CVEs, tooling, targets), the known actor_relationships baseline, plus cross-actor attribution SCOPED TO THIS ACTOR — only shared entities whose actor list names it or one of its aliases, ranked by attribution belief (shared malware/infrastructure outranks commodity TTPs). Use it to answer "who else does this actor overlap with, and on what evidence".

Input Schema

TableJSON Schema

Name	Required	Description	Default
`name`	Yes	Threat-actor name or alias (e.g. "APT29")

Output Schema

TableJSON Schema

Name	Required	Description	Default
`cves`	No
`actor`	No
`mitre`	No
`tools`	No
`threats`	No
`actor_relationships`	No
`cross_actor_attribution`	No

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

Changed5 schema fields changedv8.2.1Aug 24, 2026

addedOutput schema / properties / actor_relationships

Added value: +{
+  "items": {
+    "additionalProperties": true,
+    "properties": {
+      "rel_type": {
+        "type": "string"
+      },
+      "related_name": {
+        "type": "string"
+      }
+    },
+    "type": "object"
+  },
+  "type": "array"
+}

addedOutput schema / properties / cross_actor_attribution / additionalProperties
```
Added value: +true
```

removedOutput schema / properties / cross_actor_attribution / description

Removed value: -"Shared entities across actors, or null when the attribution engine has nothing."

addedOutput schema / properties / cross_actor_attribution / properties

Added value: +{
+  "co_actors": {
+    "items": {
+      "additionalProperties": true,
+      "properties": {
+        "actor": {
+          "description": "Pass to get_actor / get_actor_intelligence.",
+          "type": "string"
+        },
+        "by_type": {
+          "additionalProperties": true,
+          "properties": {},
+          "type": "object"
+        },
+        "max_belief": {
+          "type": "number"
+        },
+        "shared_entities": {
+          "type": "integer"
+        },
+        "strongest": {
+          "additionalProperties": true,
+          "properties": {
+            "belief_label": {
+              "type": "string"
+            },
+            "entity_type": {
+              "type": "string"
+            },
+            "entity_value": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        }
+      },
+      "type": "object"
+    },
+    "type": "array"
+  },
+  "corpus": {
+    "additionalProperties": true,
+    "properties": {
+      "total_shared": {
+        "type": "integer"
+      },
+      "unique_actors": {
+        "type": "integer"
+      }
+    },
+    "type": "object"
+  },
+  "counts": {
+    "additionalProperties": true,
+    "properties": {
+      "by_belief": {
+        "additionalProperties": true,
+        "properties": {},
+        "type": "object"
+      },
+      "by_type": {
+        "additionalProperties": true,
+        "properties": {},
+        "type": "object"
+      },
+      "co_actor_count": {
+        "description": "Every actor touched by ANY matched row, commodity TTPs included — a breadth number, not an answer.",
+        "type": "integer"
+      },
+      "co_actors_returned": {
+        "type": "integer"
+      },
+      "matched": {
+        "type": "integer"
+      },
+      "returned": {
+        "type": "integer"
+      },
+      "truncated": {
+        "type": "boolean"
+      }
+    },
+    "type": "object"
+  },
+  "scoped_to": {
+    "description": "The queried actor. Rows below name ONLY this actor or an alias — never the whole corpus.",
+    "type": "string"
+  },
+  "shared_entities": {
+    "items": {
+      "additionalProperties": true,
+      "properties": {
+        "actor_count": {
+          "description": "True co-actor count; actor_list is clipped.",
+          "type": "integer"
+        },
+        "actor_list": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "belief": {
+          "type": "number"
+        },
+        "belief_label": {
+          "description": "strong | moderate | weak | commodity — commodity is weak attribution signal.",
+          "type": "string"
+        },
+        "entity_type": {
+          "type": "string"
+        },
+        "entity_value": {
+          "type": "string"
+        },
+        "evidence": {
+          "items": {},
+          "type": "array"
+        },
+        "threat_count": {
+          "type": "integer"
+        },
+        "threat_ids": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "type": "array"
+  }
+}

changedOutput schema / properties / cross_actor_attribution / type

Previous value: -[
-  "object",
-  "null"
-]New value: +"object"

Changed7 schema fields changedv8.1.1Aug 3, 2026

changedInput schema / properties / name / description

Previous value: -"Actor name or canonical alias"New value: +"Threat-actor name or alias (e.g. \"APT29\")"

addedOutput schema / properties / actor

Added value: +{
+  "additionalProperties": true,
+  "properties": {
+    "name": {
+      "type": "string"
+    }
+  },
+  "type": "object"
+}

addedOutput schema / properties / cross_actor_attribution

Added value: +{
+  "description": "Shared entities across actors, or null when the attribution engine has nothing.",
+  "type": [
+    "object",
+    "null"
+  ]
+}

addedOutput schema / properties / cves

Added value: +{
+  "items": {},
+  "type": "array"
+}

addedOutput schema / properties / mitre

Added value: +{
+  "additionalProperties": true,
+  "properties": {},
+  "type": "object"
+}

addedOutput schema / properties / threats

Added value: +{
+  "items": {},
+  "type": "array"
+}

addedOutput schema / properties / tools

Added value: +{
+  "items": {},
+  "type": "array"
+}

First observedv0.1.0Jul 23, 2026

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/idempotent hints, the description discloses exactly how attribution is filtered and ranked: only shared entities whose actor list includes this actor or its aliases, with shared malware/infrastructure ranked above commodity TTPs. This adds meaningful behavioral context that annotations do not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences carry the full message: the core purpose is front-loaded, followed by scope and ranking details. It is somewhat dense with parentheticals and capitalized emphasis, but every phrase adds value without fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return details need not be described. A single required parameter is fully documented in the schema, and the description covers filtering, ranking, and intended use, making the tool callable without ambiguity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully covers the single 'name' parameter with its type and example. The description does not add parameter-level detail, but with 100% schema coverage, the baseline applies without requiring compensation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific composite intelligence picture for a threat actor with an enumerated scope: profile, actor_relationships baseline, and cross-actor attribution. It distinguishes itself from simpler siblings like get_actor or get_actor_relationships by emphasizing the cross-actor attribution component.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly frames the use case: "Use it to answer 'who else does this actor overlap with, and on what evidence'." It also explains scope boundaries, but does not name alternative tools or provide when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/threadlinqs-cmd/intelthreadlinqs-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server