Intel Threadlinqs MCP

List Simulations

list_simulations

Read-onlyIdempotent

Retrieve adversary-emulation simulation scenarios and atomic test commands grouped by threat. Use offset and limit to page through results and explore threat simulation coverage.

Instructions

DEPRECATED (generation stopped 2026-08-03; archived rows only). List adversary-emulation simulation scenarios across the platform (atomic test commands grouped by threat). total / total_simulations are CORPUS-wide; the page you got is returned / page_simulations, and has_more + next_offset walk the rest. The correlation block (shared_techniques, attack_chain_similarities, platform/tactic coverage) is computed over the RETURNED PAGE only — it carries scope:"page" and changes with limit. Pass limit (default 50, max 200) and offset. include_facets=true adds the corpus filter vocabulary (~20 KB of actor/nation/category strings) — off by default. Prefer get_flow_coverage and get_attack_flow — ATT&CK Flows replaced simulations.

Input Schema

TableJSON Schema

Name	Required	Description
`limit`	No	Max threats in this page (default 50, max 200)
`offset`	No	Row offset for paging (default 0). Use next_offset from the previous response.
`include_facets`	No	Include the corpus filter vocabulary (filter_meta). Default false — it is ~20 KB and does not shrink with limit.

Output Schema

TableJSON Schema

Name	Required	Description
`total`	No	Corpus-wide threats that have simulations.
`threats`	No
`has_more`	No
`returned`	No	Threats in THIS page.
`deprecated`	No
`correlation`	No
`filter_meta`	No
`next_offset`	No
`page_simulations`	No	Simulation rows across the returned page only.
`total_simulations`	No	Corpus-wide simulation rows.
`generation_stopped`	No

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

Changed13 schema fields changedv8.2.1Aug 24, 2026

addedInput schema / properties / include_facets

Added value: +{
+  "description": "Include the corpus filter vocabulary (filter_meta). Default false — it is ~20 KB and does not shrink with limit.",
+  "type": "boolean"
+}

changedInput schema / properties / limit / description

Previous value: -"Max results (default 50, max 200)"New value: +"Max threats in this page (default 50, max 200)"

addedInput schema / properties / offset

Added value: +{
+  "description": "Row offset for paging (default 0). Use next_offset from the previous response.",
+  "type": "number"
+}

addedOutput schema / properties / correlation / properties / computed_over_threats
```
Added value: +{
+  "type": "integer"
+}
```
addedOutput schema / properties / correlation / properties / scope
```
Added value: +{
+  "type": "string"
+}
```
addedOutput schema / properties / deprecated
```
Added value: +{
+  "type": "boolean"
+}
```
addedOutput schema / properties / generation_stopped
```
Added value: +{
+  "type": "string"
+}
```
addedOutput schema / properties / has_more
```
Added value: +{
+  "type": "boolean"
+}
```

addedOutput schema / properties / next_offset

Added value: +{
+  "type": [
+    "integer",
+    "null"
+  ]
+}

addedOutput schema / properties / page_simulations

Added value: +{
+  "description": "Simulation rows across the returned page only.",
+  "type": "integer"
+}

addedOutput schema / properties / returned

Added value: +{
+  "description": "Threats in THIS page.",
+  "type": "integer"
+}

addedOutput schema / properties / total / description

Added value: +"Corpus-wide threats that have simulations."

addedOutput schema / properties / total_simulations / description
```
Added value: +"Corpus-wide simulation rows."
```

Changed2 schema fields changedv8.1.1Aug 3, 2026

changedInput schema / properties / limit / description

Previous value: -"Max threats to return (default 50)"New value: +"Max results (default 50, max 200)"

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "additionalProperties": true,
+  "properties": {
+    "correlation": {
+      "additionalProperties": true,
+      "properties": {},
+      "type": "object"
+    },
+    "filter_meta": {
+      "additionalProperties": true,
+      "properties": {},
+      "type": "object"
+    },
+    "threats": {
+      "items": {},
+      "type": "array"
+    },
+    "total": {
+      "type": "integer"
+    },
+    "total_simulations": {
+      "type": "integer"
+    }
+  },
+  "type": "object"
+}

First observedv0.1.0Jul 23, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, but the description adds rich behavioral context beyond these: deprecation and data availability, corpus-wide vs page-scoped counts, correlation block scope, the default-off facet payload, and pagination using has_more/next_offset. This far exceeds what the annotations alone provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-structured, front-loading the critical DEPRECATED warning and then layering pagination, correlation, and replacement guidance. It is longer than average, but the length is justified by important behavioral caveats; mild redundancy appears around the max 200 stating that limit, but not enough to obscure the value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool of this complexity, the description covers all needed invocation context: deprecation status, what the columns mean, pagination mechanics, scope-scaling behavior, optional payload size, and the preferred replacement tools. With an output schema also present, the agent has everything needed to call this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 100% description coverage for limit, offset, and include_facets, and the description largely repeats those details, such as default 50 and max 200. It does add minor new meaning about facets containing 'actor/nation/category strings', but overall it does not significantly enhance parameter understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'List adversary-emulation simulation scenarios across the platform (atomic test commands grouped by threat)'. It also clearly distinguishes this tool from related siblings by explicitly naming get_flow_coverage and get_attack_flow, and marking the tool as DEPRECATED, so an agent can tell exactly what this tool does and why it differs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-not-to-use guidance by declaring the tool deprecated and stating that 'Prefer get_flow_coverage and get_attack_flow — ATT&CK Flows replaced simulations'. It also explains the archived-rows-only nature, making the alternative recommendation clear and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/threadlinqs-cmd/intelthreadlinqs-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server