Skip to main content
Glama
threadlinqs-cmd

Intel Threadlinqs MCP

by threadlinqs-cmd
OverviewSchemaRelated ServersScoreDiscussions
TypeScript
Remote

MITRE Gap Analysis

get_mitre_gap_analysis
Read-onlyIdempotent

Prioritize MITRE ATT&CK techniques with the weakest detection coverage. Filter by tactic and limit to surface the top detection gaps ranked by exposure and existing rule coverage.

Instructions

Prioritized list of MITRE ATT&CK techniques with the weakest detection coverage (detection debt), ranked by debt_score = attributed threats / (1 + detection rules mapping the technique or its parent), scaled by exploitability (max EPSS / KEV of the CVEs its threats weaponize) and rarity. Higher = more exposure with less rule coverage. Filter by tactic (spelling-insensitive: "execution", "Execution" and "Execution (ICS)" all match) and cap with limit; summary.gaps/coverage_pct describe the FILTERED corpus, not the returned page.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNoMax techniques (default 20, max 100). Rows come back debt_score-descending, so limit=N is the top-N worst.
tacticNoFilter to one ATT&CK tactic (e.g. "execution", "defense-evasion", "command-and-control"). An unmatched value returns summary.available_tactics.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
summaryNo
techniquesNo

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed19 schema fields changedv8.2.1
    • changedInput schema / properties / limit / description
      Previous value: -"Max techniques (default 20, max 100)"New value: +"Max techniques (default 20, max 100). Rows come back debt_score-descending, so limit=N is the top-N worst."
    • changedInput schema / properties / tactic / description
      Previous value: -"Filter to one ATT&CK tactic (e.g. \"execution\")"New value: +"Filter to one ATT&CK tactic (e.g. \"execution\", \"defense-evasion\", \"command-and-control\"). An unmatched value returns summary.available_tactics."
    • addedOutput schema / properties / summary / properties / available_tactics
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / summary / properties / by_priority
      Added value: +{
+  "additionalProperties": true,
+  "properties": {},
+  "type": "object"
+}
    • addedOutput schema / properties / summary / properties / by_tactic
      Added value: +{
+  "additionalProperties": true,
+  "properties": {},
+  "type": "object"
+}
    • addedOutput schema / properties / summary / properties / corpus_total
      Added value: +{
+  "type": "integer"
+}
    • addedOutput schema / properties / summary / properties / has_more
      Added value: +{
+  "type": "boolean"
+}
    • addedOutput schema / properties / summary / properties / returned
      Added value: +{
+  "type": "integer"
+}
    • addedOutput schema / properties / summary / properties / scoring
      Added value: +{
+  "description": "States what debt_score counts.",
+  "type": "string"
+}
    • addedOutput schema / properties / summary / properties / tactic_filter
      Added value: +{
+  "type": [
+    "string",
+    "null"
+  ]
+}
    • addedOutput schema / properties / summary / properties / total / description
      Added value: +"Techniques matching the tactic filter (the ranking denominator), not the page size."
    • addedOutput schema / properties / techniques / items / properties / debt_score / description
      Added value: +"Ranking unit. Higher = weaker coverage against more exposure; see summary.scoring."
    • addedOutput schema / properties / techniques / items / properties / detection_count
      Added value: +{
+  "description": "Rules mapping this technique or its parent — NOT detections on threats that merely share it.",
+  "type": "integer"
+}
    • addedOutput schema / properties / techniques / items / properties / epss_max
      Added value: +{
+  "type": "number"
+}
    • addedOutput schema / properties / techniques / items / properties / is_covered / description
      Added value: +"True when at least one detection maps this technique (or its parent) in detections.mitre_mapping."
    • addedOutput schema / properties / techniques / items / properties / kev_exposure
      Added value: +{
+  "type": "integer"
+}
    • addedOutput schema / properties / techniques / items / properties / priority_label / description
      Added value: +"critical | high | medium | low, banded off debt_score."
    • addedOutput schema / properties / techniques / items / properties / technique_id / description
      Added value: +"Pass to get_mitre_technique."
    • addedOutput schema / properties / techniques / items / properties / threat_exposure
      Added value: +{
+  "type": "integer"
+}
  2. Changed4 schema fields changedv8.1.1
    • changedInput schema / properties / limit / description
      Previous value: -"Max results (default 20, max 100)"New value: +"Max techniques (default 20, max 100)"
    • changedInput schema / properties / tactic / description
      Previous value: -"Filter by MITRE tactic (e.g. 'initial-access', 'persistence', 'lateral-movement')"New value: +"Filter to one ATT&CK tactic (e.g. \"execution\")"
    • addedOutput schema / properties / summary
      Added value: +{
+  "additionalProperties": true,
+  "properties": {
+    "coverage_pct": {
+      "type": "number"
+    },
+    "covered": {
+      "type": "integer"
+    },
+    "gaps": {
+      "type": "integer"
+    },
+    "total": {
+      "type": "integer"
+    }
+  },
+  "type": "object"
+}
    • addedOutput schema / properties / techniques
      Added value: +{
+  "items": {
+    "additionalProperties": true,
+    "properties": {
+      "debt_score": {
+        "type": "number"
+      },
+      "is_covered": {
+        "type": "boolean"
+      },
+      "priority_label": {
+        "type": "string"
+      },
+      "tactic": {
+        "type": "string"
+      },
+      "technique_id": {
+        "type": "string"
+      },
+      "technique_name": {
+        "type": "string"
+      }
+    },
+    "type": "object"
+  },
+  "type": "array"
+}
  3. First observedv0.1.0

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover readOnly, idempotent, and non-destructive behavior. The description adds valuable details beyond that: the ranking formula, that tactic matching is spelling-insensitive, and that summary.gaps/coverage_pct describe the filtered corpus rather than the returned page, which is an important caveat.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately sized for the subtleties involved: it defines the ranking, the filtering behavior, and the summary caveat in two sentences. It is a bit dense with the formula, but every component is useful rather than redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema and only two optional parameters, the description covers purpose, ranking, filtering, limit semantics, edge-case behavior for unmatched tactics, and a confusing summary nuance. It could be even stronger if it explicitly contrasted this tool with get_mitre_coverage or get_technique_rules, but it is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema itself documents both parameters. The description still adds value by clarifying that tactic filtering is case/spelling-insensitive, including variants like 'Execution (ICS)', and that limit=N-N maps directly to debt_score-descending top N rows.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool returns a prioritized list of MITRE ATT&CK techniques with the weakest detection coverage, ranked by debt_score. It goes beyond the title by defining what gap analysis means here and clearly distinguishes this from sibling coverage/technique tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear operational guidance: filter by tactic, use limit as a cap, and understand that limit=N yields the top-N worst. It does not explicitly name alternative tools or state when not to use this, but it gives solid context for normal invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/threadlinqs-cmd/intelthreadlinqs-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server