// SCAN REPORT

OPTIX: Operational Platform for Threat Intelligence Exploration

28 tools. 11 can modify or destroy data without limits.

1 destructive tool with no built-in limits. Policy required.

Last updated: 1 Jul 2026

11 can modify or destroy data

17 read-only

28 tools total

Community server · catalogue entry verified 01/07/2026

How to control OPTIX: Operational Platform for Threat Intelligence Exploration ↓

TOOL MAP

What OPTIX: Operational Platform for Threat Intelligence Exploration exposes to your agents

Read (17) Write / Execute (10) Destructive / Financial (1)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous OPTIX: Operational Platform for Threat Intelligence Exploration tools

Destructive · High watchlist.remove Removing an entity from a watchlist is a destructive action: the entry is deleted and monitoring coverage for that entity is lost. Execute · High entity.research This tool executes an AI-driven research operation rather than simply retrieving pre-computed data. Execute · High detection.tradecraft This tool generates and likely executes or dispatches SIEM queries against live security infrastructure. Execute · Medium entity.ask The tool generates and likely executes or emits a SIEM query for threat hunting purposes.

11 of OPTIX: Operational Platform for Threat Intelligence Exploration's 28 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control OPTIX: Operational Platform for Threat Intelligence Exploration

PolicyLayer is an MCP gateway — it sits between your AI agents and OPTIX: Operational Platform for Threat Intelligence Exploration, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "watchlist.remove": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "detection.rule": {
    "limits": [
      {
        "counter": "detection.rule_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "account.status": {
    "limits": [
      {
        "counter": "account.status_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register OPTIX: Operational Platform for Threat Intelligence Exploration — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON OPTIX: OPERATIONAL PLATFORM FOR THREAT INTELLIGENCE EXPLORATION →

Instant setup, no code required.

FULL CATALOGUE

All 28 OPTIX: Operational Platform for Threat Intelligence Exploration tools

DESTRUCTIVE 1 tools

Destructive watchlist.remove Remove an entity from the analyst

EXECUTE 3 tools

Execute detection.tradecraft Generate a SIEM threat hunting query covering the complete known tradecraft Execute entity.ask Generate a SIEM threat hunting query for a specific threat entity. Given an Execute entity.research Trigger deep AI research on a specific OPTIX entity (threat actor, malware

WRITE 7 tools

Write detection.rule Generate a SIEM detection rule for a specific MITRE ATT&CK technique. Write feed.save_view Save a named feed filter configuration in OPTIX so the analyst can recall it Write feedback.vote Submit a relevance vote (upvote or downvote) on an OPTIX intelligence document. Write incident.report Submit a structured incident report to OPTIX and generate a tactical intelligence Write ioc.triage Apply a triage verdict to one or more IOCs in OPTIX. Triage decisions record Write report.generate Generate a strategic, operational, technical, or RFI intelligence report in Write watchlist.add Add an entity to the analyst

READ 17 tools

Read account.status Retrieve the current OPTIX account credit balance, monthly allocation, usage, Read actor.list List ALL threat actors the workspace is currently tracking in OPTIX. Read actor.profile ⭐ RECOMMENDED STARTING POINT for any threat actor query. Read detection.attack_matrix Retrieve the OPTIX MITRE ATT&CK coverage matrix showing which techniques Read detection.coverage_gaps Analyse a specific intelligence document to identify MITRE ATT&CK techniques Read document.get Fetch a specific intelligence document from OPTIX by its numeric ID. Read entity.get Fetch a named threat intelligence entity from OPTIX by name, alias, or numeric ID. Read feed.cards Retrieve profile-matched situational awareness threat cards from OPTIX. Read feed.get Retrieve the OPTIX threat intelligence feed — a paginated stream of curated, Read feed.headlines Retrieve the current OPTIX threat intelligence headlines — a short list of Read ioc.context Retrieve enriched community context for a specific IOC by its numeric entity ID. Read report.get Retrieve a specific OPTIX intelligence report by its numeric ID, including Read report.list List intelligence reports stored in OPTIX. These are AI-generated reports (tactical, Read search.ai Natural language threat intelligence search across OPTIX documents and entities. Read search.documents Full-text search across all OPTIX intelligence documents. Use this tool when an Read search.indicator Search OPTIX for a specific indicator of compromise (IOC) by its raw value. Read watchlist.list List all threat actors, malware families, and other entities currently on

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about OPTIX: Operational Platform for Threat Intelligence Exploration

Can an AI agent delete data through the OPTIX: Operational Platform for Threat Intelligence Exploration MCP server? +

Yes. The OPTIX: Operational Platform for Threat Intelligence Exploration server exposes 1 destructive tools including watchlist.remove. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through OPTIX: Operational Platform for Threat Intelligence Exploration? +

The OPTIX: Operational Platform for Threat Intelligence Exploration server has 7 write tools including detection.rule, feed.save_view, feedback.vote. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach OPTIX: Operational Platform for Threat Intelligence Exploration.

How many tools does the OPTIX: Operational Platform for Threat Intelligence Exploration MCP server expose? +

28 tools across 4 categories: Destructive, Execute, Read, Write. 17 are read-only. 11 can modify, create, or delete data.

How do I enforce a policy on OPTIX: Operational Platform for Threat Intelligence Exploration? +

Register the OPTIX: Operational Platform for Threat Intelligence Exploration MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every OPTIX: Operational Platform for Threat Intelligence Exploration tool call.

Deterministic rules across all 28 OPTIX: Operational Platform for Threat Intelligence Exploration tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON OPTIX: OPERATIONAL PLATFORM FOR THREAT INTELLIGENCE EXPLORATION →

Instant setup, no code required.

28 OPTIX: Operational Platform for Threat Intelligence Exploration tools catalogued and risk-classified — across an index of 43,000+ MCP servers.