Search / io.github.pipeworx-io/alienvault-otx
Alienvault Otx
R0· no sign-inAlienVault OTX MCP — Open Threat Exchange (free with key)
v0.1.3 · active · repository · website · descriptor JSON · versions
Search / io.github.pipeworx-io/alienvault-otx
R0· no sign-inAlienVault OTX MCP — Open Threat Exchange (free with key)
v0.1.3 · active · repository · website · descriptor JSON · versions
{
"mcpServers": {
"alienvault-otx": {
"type": "http",
"url": "https://gateway.pipeworx.io/alienvault-otx/mcp"
}
}
}claude mcp add --transport http alienvault-otx https://gateway.pipeworx.io/alienvault-otx/mcp[mcp_servers.alienvault-otx]
url = "https://gateway.pipeworx.io/alienvault-otx/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"alienvault-otx": {
"type": "remote",
"url": "https://gateway.pipeworx.io/alienvault-otx/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"alienvault-otx": {
"type": "http",
"url": "https://gateway.pipeworx.io/alienvault-otx/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=alienvault-otx&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vZ2F0ZXdheS5waXBld29yeC5pby9hbGllbnZhdWx0LW90eC9tY3AifQ%3D%3D"
}{
"servers": {
"alienvault-otx": {
"type": "http",
"url": "https://gateway.pipeworx.io/alienvault-otx/mcp"
}
}
}{
"mcpServers": {
"alienvault-otx": {
"httpUrl": "https://gateway.pipeworx.io/alienvault-otx/mcp"
}
}
}extensions:
"alienvault-otx":
enabled: true
name: "alienvault-otx"
type: streamable_http
uri: "https://gateway.pipeworx.io/alienvault-otx/mcp"
timeout: 300
Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.
protocol.modernnewest supported version is 2025-03-26; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptions, tools.description_length, tools.schemas, tools.annotations, tools.directory_hints, tools.token_cost, tools.api_dumptool list unknown (behind auth, not probed, or empty)stability.changes, stability.rug_pulltool list unknowndeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packagepolymarket_edgesremovedScan top Polymarket markets and return opportunities where Pipeworx data disagrees with market price. Built for "what should I bet on today" — agents discover opportunities without paging hundreds of markets. FIVE MODEL FAMILIES grouped into three response segments under by_segment: (1) MODEL_DRIVEN — crypto_price (lognormal barrier from 90d FRED log-returns) and news_momentum (GDELT 7d/21d article-volume ratio, soft signal w/ halved Kelly). (2) STRUCTURAL_ARBITRAGE — partition_overround on mutually-exclusive events; per-leg favorite-longshot bias correction with per-sport α (tennis 1.02, soccer 1.10, MMA 1.15, default 1.0); placeholder-slug filter drops will-person-X / will-team-Y / will-manager-Z / will-someone-else- backstops; partitions with >20% placeholder fraction skipped entirely. (3) CONCENTRATED_LONGSHOT — basket trade when one leg ≥75% AND ≥2 longshots ≤8% AND portfolio return ≥25:1; rare-by-design (gates relaxed Run 8 from prior 85%/5%/50:1). EVERY OPPORTUNITY carries edge_pp_net (net of slippage AND Polymarket's own taker fee — fees_pp_applied itemises the fee component; see fees.ts for the published per-category schedule), kelly_fraction + kelly_fraction_half (capped at 0.25), market.liquidity, market.spread_pp, market.volume, plus a 24h-move warning ("Market moved X.Xpp in 24h") when the recent move alone exceeds the edge — your edge may already be in the price. TRADEABLE-EDGE KNOBS: min_liquidity / max_spread_pp drop opportunities where edge isn't realizable; min_partition_leg_kelly filters partitions by best per-leg Kelly. RESPONSE TOP-LEVEL: by_segment{model_driven,structural_arbitrage,concentrated_longshot}, fed_candidates/fed_note (Fed bets surface here, excluded from ranking — 1m-T vs EFFR signal is unreliable at meeting-month horizons without paid OIS/SOFR-futures data), and _diagnostics{concentrated_longshot:{...funnel counters},category_counts,filter_skips} so callers can see WHY a segment is empty (top-N stale, all candidates failed gates, knob dropped them). Cached 1h at the KV level keyed on all knobs.
ai_visibility_checkremovedProbe one or more LLMs for what they know about a business / brand / product / topic and score visibility (0-100) per model. Default model is Workers AI Llama-3.3-70b (free); pass `_apiKey` to also probe Anthropic (BYO key — you pay Anthropic directly for those calls). Returns per-model {score, confidence, signals, raw_response} + a combined view. Useful for AI-marketing audits, pre-launch brand checks, competitive monitoring.
validate_claimremoved"Is it true that…" / "fact check" / "verify the claim that…" / "did X really…" / "was Y actually…" / "confirm or refute" / "true or false" — natural-language claim verification against authoritative sources. Use whenever the agent needs to check whether something a user said is factually correct. Company-financial claims (revenue, net income, cash for public US companies) verify via the structured SEC EDGAR + XBRL fast path with exact percent-delta math; ANY OTHER factual claim (macro statistics, rates, prices, drug data, records) automatically falls through to the grounded pipeline — routed to the right live source, answered with verbatim evidence, then judged. Returns a verdict (confirmed / approximately_correct / refuted / inconclusive / unsupported / could_not_verify), the grounded or structured actual value with pipeworx:// citation, and reasoning. IMPORTANT for callers: could_not_verify means the check did not happen (our LLM or source failed) and carries verification_error{stage,detail} — it is NOT evidence for or against the claim, and must not be shown as one. unsupported means we looked and cover no source for it. Replaces 4–6 sequential calls (NL parsing → entity resolution → data lookup → comparison).
pipeworx_trendingremovedWhat other AI agents are calling on Pipeworx right now. Returns the top tools, top packs, and total call volume over a recent window (24h, 7d, or 30d). Useful for: (1) discovering what data sources are hot for current events, (2) confirming a popular tool is the canonical choice before asking your own question, (3) seeing whether your use case aligns with what most agents need. Self-aggregating signal — derived from CF analytics-engine, no PII, just (pack, tool, count). Cached 5min-1h depending on window.
classify_rowremovedCheap categorization: given a company and a list of candidate labels, decide which labels apply — the most common GTM/AI usage shape (tagging a list by industry, ICP fit, etc.), one small model call. Same evidence contract as research_row: each label comes back {label, applies, evidence_url, quote, status: found|inferred|not_established} — "found" only when the model's quote is independently verified as a verbatim substring of the text used. Pass text directly (cheapest — no fetch) or entity.domain to fetch the homepage once as a fallback. No text and no domain means every label is not_established with no model call made.
research_rowremovedClaygent-style per-row research: answer ONE question about ONE company and return a JSON object matching your output_schema, with every field wrapped in its own evidence — {value, evidence_url, quote, status}. status is NEVER self-reported by the model: "found" means this code independently verified the model's quote is a VERBATIM substring of text actually fetched; "inferred" means a value was given but the quote could not be verified; "not_established" means no source answered the field, and its value is always null — never guessed, never a blended score. Sources: "web" fetches the company's own site (entity.domain required — homepage, /about, /leadership) via fetch_url; "catalog" checks entity_profile (SEC EDGAR; resolved:false for a private company is expected, not a failure); "both" (default) tries both. max_cost (USD, default 0.02, max 0.50) scales how many pages are fetched and refuses up front if it is too small to pay for even one extraction call (floor $0.002) — never silently overspends. A row where every source comes back empty costs nothing: every field is mechanically not_established with NO model call made. For a boolean/derived field (e.g. "does this company sell to healthcare"), the quote only has to SUPPORT the value — a descriptive sentence about customers/products counts, the source need not state the answer verbatim. leadership_page_status ("fetched"|"not_found"|"not_attempted", plus leadership_note) says plainly whether a leadership/team page was actually read, so a named-person field (head_of_sales) coming back not_established is distinguishable from "this company just doesn't publish one" vs. "we never checked". model_output_empty:true means the model returned nothing usable (a transport/budget problem) — every field is not_established for THAT reason, never read as 20 individual "no" judgments. Use with a fixed question + schema across many rows for "Claygent over N companies with a hard cost cap" (composes with batch callers). For picking from a fixed label list instead of extracting open fields, use classify_row (cheaper, one model call).
release_calendar_marketsremovedJOIN of the official release calendar (econ data, the FOMC, FDA decisions, SEC rules) against LIVE Polymarket/Kalshi markets — which scheduled releases land in the next N hours, and which live markets resolve on them. This is a POSITIONING tool, not a speed product: results are cached like every other pack (≤ 60s TTL) and there is no push/webhook — do not use this to try to beat a release, use it to see what is coming and what is already priced. CATEGORIES: econ (CPI, Employment Situation/jobs report, GDP, PCE, PPI, retail sales, housing starts, jobless claims — via fred_release_dates per known release_id, since FRED's own cross-release calendar mostly returns recent actuals, not future dates), fed (the next FOMC meeting's rate decision, via fomc_calendar), fda (PDUFA action dates + FDA advisory-committee meetings, via pdufa_catalysts / fda_adcom_calendar), sec (SEC final rules whose own DATES clause names an effective date in the window, via federal-register recent_rules — usually finds nothing in a short window since SEC rules typically take effect 30–60 days out, which is an accurate answer, not a bug), court (ALWAYS EMPTY today — court-listener has no forward-looking scheduled-hearing calendar, only filing/termination dates, so this category returns zero releases with unsupported:true rather than fabricate one). Omit `categories` or pass "all" for every category. MATCHING AND ITS HONESTY CONTRACT: every release is returned even when it has ZERO matched markets — a release is never dropped just because nothing on Polymarket or Kalshi resolves on it (most FDA/SEC releases will show markets:[]; that is signal, not a gap). Every matched market carries resolves_on_this_release: "true" (the venue's own close/end date sits within ~36h of the release AND the question passed a subject filter — econ and fed only), "likely" (same subject filter, but the venue closes days away from the release date), or "unclear" (a keyword hit with no date to anchor against — always true for the fda category, which has no ladder structure to check a date against). matched_by names the mechanism (a Kalshi series ticker, a Polymarket search query, or an FDA keyword probe) so a caller can judge the match rather than trust a label. scheduled_at carries both `utc` and `et`; econ releases use the standing BLS/Census 8:30am ET convention (FRED's calendar itself has no clock time), FOMC decisions use the 2:00pm ET convention, and FDA/SEC dates are date_only:true (no reliable clock time exists for either). DO NOT treat a matched market as a real arbitrage or a settled fact on its own — a market question sharing tokens with a release name is not proof it settles on that release's own published number. Call resolution_audit / resolution_diff (fleet #1909) on a specific market before sizing anything here. An empty window (zero releases across every requested category) returns the SAME shape as a populated one — release_count:0, releases:[] — plus empty_reason:"no_releases_in_window" and a `hint` telling you to widen, so you never branch on the response shape and never have to guess whether zero means "nothing is scheduled" or "the lookup failed". Econ releases especially cluster on specific dates each month, so a 48h window often straddles a dead stretch.
kalshi_weather_edgeremovedPrices Kalshi daily high-temperature markets against the NWS forecast for the market's OWN settlement station, and measures whether that forecast actually beats the market. Two modes. LIVE (default): returns the full strike ladder for one city and settlement date with market_prob (mid), forecast_prob, and edge_pp per strike, plus the settlement clause verbatim. BACKTEST (`backtest_days: N`): scores an archived gridded forecast against the market on settled days and returns brier_market vs brier_forecast with a plain-English `verdict`, so the edge is MEASURED rather than asserted. READ THE WARNINGS — they are not boilerplate. (1) These markets DO NOT settle on the NWS. They settle on The Weather Company (weather.com) at a Kalshi station code such as CLINYC, which the response quotes verbatim; so part of every edge_pp is NWS-vs-Weather-Company disagreement about the same day at the same station, which is not mispricing and not tradeable. `settlement_vs_forecast_basis_f` from backtest mode is that part as a number. (2) The station is DERIVED from the settlement clause, never from the city name: Chicago settles at MIDWAY and New York at CENTRAL PARK, so a city-centre forecast would misprice a whole ladder. A station that cannot be resolved yields rows with no forecast and a reason, never a guessed coordinate. (3) forecast_prob assumes a normal distribution around the NWS high whose width is ASSUMED, not fitted (stated in `distribution_assumption`) — run backtest mode to see whether it is calibrated. (4) edge_pp is gross: no Kalshi fees, no bid-ask. MEASURED RESULT, AND IT IS NOT THE FLATTERING ONE: on the first backtest (KXHIGHNY, 13 settled days to 2026-09-11, 58 market observations) the MARKET beat the forecast — Brier 0.1008 for the market against 0.1594 for the archived gridded forecast, lower being better. So on that sample there is NO forecast edge to sell, and a large edge_pp is more likely to be the model disagreeing with a better-informed market than an opportunity. The measured settlement-vs-forecast basis was 1.7F mean absolute over 8 pinnable days, slightly warm-biased, which is a big share of a typical edge_pp on a 2-degree bracket. Re-run backtest_days before believing any edge; if a later sample reverses this, the numbers say so. NWS is US-only, so the ~30 international Kalshi weather series (London, Paris, Tokyo) return market prices with forecast_unavailable rather than a forecast. Precipitation series are listed but not yet priced. Cities: nyc, chicago, los angeles, miami, austin, houston, denver, philadelphia — or pass `series_ticker` for any other (e.g. "KXHIGHTBOS").
polymarket_fill_riskremovedRealizable-vs-theoretical edge check against live CLOB order-book depth. REQUIRES one of `market` (single-market mode) or `event` (basket/partition mode). SINGLE-MARKET: pass a market slug/URL + side (buy_yes|sell_yes|buy_no|sell_no, default buy_yes) + size_usd (default 1000 — max spend on buys, target proceeds on sells); walks the ladder and returns top_of_book, vwap_fill_price, slippage_pp, shares_filled, max_fillable_usd, and a verdict (clean|degraded|cannot_fill). BASKET: pass an event slug/URL + side (sell_yes = capture overround by selling every leg, buy_yes = capture underround; default auto from partition sum) + size_usd interpreted as settlement notional S (shares per leg; each share pays $1); returns theoretical_sum vs realizable_sum (top-of-book vs VWAP across all legs), capture_ratio, profit_usd at executed size, per-leg fill detail, thin_legs[], max_clean_notional_usd, and forced_directional_risk naming the legs most likely to strand you unhedged. USE THIS before acting on any polymarket_arbitrage SELL/BUY-EVERY-LEG signal or any polymarket_edges trade above ~$500 — theoretical overround on thin books is not capturable, and partial basket fills convert an arb into an unhedged directional position (the dominant loss mode in real arb-bot P&L). FEES ARE NOT MODELLED HERE: vwap_fill_price/profit_usd are GROSS of Polymarket's own taker fee (rate 0.04-0.07 by category — see polymarket_edges/fees.ts), on top of which this tool prices depth-crossing cost; a thin-margin fill that looks clean here can still be net-negative after the fee.
polymarket_arbitrageremovedFind arbitrage opportunities on Polymarket via monotonicity violations + partition-sum checks. Call with NO args for a `trending_scan` of the top ~200 markets by weekly volume; pass `event` for the strongest per-event partition_check, or `topic` for a themed cross-event scan. `event` (recommended for a specific market): pass a Polymarket event slug like "fed-decision-may-2026" or "when-will-bitcoin-hit-150k"; walks child markets, checks date-axis / threshold-axis ordering AND computes the partition_check (sum of YES prices across mutually-exclusive legs — should ≈1; deviations >3pp emit a BUY/SELL EVERY LEG signal). `topic` (for cross-event scanning): pass a seed question like "Strait of Hormuz traffic returns to normal" or "Fed rate decision"; searches related events across the platform, flattens markets, runs the comparator on the union. Cross-event mode catches "...by May 31" vs "...by Jun 30" patterns that single-event misses. SEMANTIC ANCHOR: cross-event pairs require ≥0.30 Jaccard similarity on question tokens (prevents Powell-Fed-Pause being paired with Powell-DOJ-probe); skipped_low_similarity surfaces the rejected pair count. PARTITION FILTER: drops will-person-X / will-manager-Y / will-someone-else- placeholder slugs; partitions with >20% placeholder fraction return null arb signal. Response: opportunities[] (gap_pp, suggested_trade, reasoning, monotonicity violation context), and in event mode partition_check{sum_yes_prices, gap_from_1, placeholders_filtered, suggested_trade}. FEES: every opportunities[] row and partition_check.arbitrage carry edge_pp_gross (== gap_pp / overround_pp), fees_pp, edge_pp_net, net_positive, plus polymarket_fee_pp, fee_basis and fee_categories[]. BOTH cost components are modeled: Polymarket's own per-category TAKER FEE (fee = shares × rate × p × (1-p), rates crypto 0.07 / sports-economics-culture-weather-other 0.05 / finance-politics-mentions-tech 0.04, geopolitics and world events fee-free; verified against Polymarket's own docs as of 2026-09-13) and Polygon gas (~$0.02/leg). The taker fee dominates: ~$1.75 per 100 shares on a crypto market at 50c versus $0.02 of gas, so rows that looked profitable before fleet #1927 may now show net_positive:false — that is the correction, not a regression. Each leg is priced at ITS OWN market's rate and price (the fee curve peaks at 50c and falls toward both extremes). fee_basis says where the rate came from: 'payload' (read off the market, the normal case), 'category' (mapped from its fee category), 'fee_free', or 'fallback' (rate unknown — charged at the modal 0.05 rather than assumed free, so an unreadable market is never reported as costless). Where fill_check reprices against live depth, this does NOT double-count that spread cost. FILL CHECK: when the partition signal fires, arbitrage.fill_check prices it against live CLOB depth (theoretical_edge_pp_at_book vs realizable_edge_pp at 1000 shares/leg, thin_legs[]) — realizable_edge_pp ≤ 0 means the overround exists only at last-trade, not in the book; do not trade it. For custom sizing use polymarket_fill_risk.
Showing the latest 10. Full history: list_changes · trend: quality JSON.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +namespace-matches-repo +website +reachable +uptime-98% +updated-1d-ago
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://gateway.pipeworx.io/alienvault-otx/mcp streamable-http | none | yes | 98% | 37 ms | 2025-03-26 | 2026-10-19 |
No tools observed. Tools appear once a credential-free probe can list them.
Schemas: list_tools.
And 1,847 more from this publisher.
{
"name": "io.github.pipeworx-io/alienvault-otx",
"title": "Alienvault Otx",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://gateway.pipeworx.io/alienvault-otx/mcp",
"type": "streamable-http"
}
],
"version": "0.1.3",
"repository": {
"url": "https://github.com/pipeworx-io/mcp-alienvault-otx",
"source": "github"
},
"websiteUrl": "https://pipeworx.io/packs/alienvault-otx",
"description": "AlienVault OTX MCP — Open Threat Exchange (free with key)"
}