// MCP TOOL REFERENCE

THREATMCP TOOLS

15 tools from the ThreatMCP MCP Server, categorised by risk level.

// ALL 15 THREATMCP TOOLS

READ 13 tools

Read domain_advanced 域名高级查询：获取域名的历史IP和历史Whois信息，用于深度溯源分析 Read domain_analysis 域名分析：全面分析域名，包括解析IP、Whois、威胁情报、相关样本、域名分类等 Read domain_context 域名上下文查询：针对恶意域名查询上下文信息，获取相关样本及取证处置建议 Read file_analysis 文件信誉报告：获取文件详细的静态和动态分析报告，包括威胁等级、行为签名、网络行为等 Read file_multiengines 文件反病毒引擎检测报告：获取文件经过22款反病毒扫描引擎检测后的结果 Read ioc_detection 失陷检测：检测IP地址或域名的恶意威胁，识别远控(C2)、恶意软件、矿池等威胁 Read ip_advanced IP高级查询：获取IP的当前域名和历史域名信息，用于深度溯源分析 Read ip_analysis IP分析：全面分析IP地址，包括地理位置、ASN、威胁情报、相关样本、端口信息等 Read ip_reputation 查询IP地址的安全信誉信息 Read subdomain 子域名查询：获取域名的所有子域名信息，用于资产发现和安全评估 Read url_report URL信誉报告：获取URL扫描引擎检测结果，以及下载文件的分析结果 Read vuln_match 产品漏洞匹配：通过厂商产品匹配功能，聚合相关厂商产品的漏洞信息 Read vulnerability 漏洞情报：获取公开漏洞的基础信息、风险评估、PoC、处置建议、补丁等信息

EXECUTE 2 tools

Execute url_scan 提交URL分析：通过11款URL扫描引擎和黑名单服务对URL进行检测，同时分析下载的文件 Execute file_upload 提交文件分析：上传文件进行沙箱分析，支持PE、Office、PDF、Script等文件类型

// FAQ

How many tools does the ThreatMCP MCP server have? +

The ThreatMCP MCP server exposes 15 tools across 2 categories: Read, Execute.

How do I enforce policies on ThreatMCP tools? +

Route the ThreatMCP server through the PolicyLayer gateway. Define allow, deny, or approval rules per tool in the dashboard; they are enforced on every call before it reaches the server.

What risk categories do ThreatMCP tools fall into? +

ThreatMCP tools are categorised as Read (13), Execute (2). Each category has a recommended default policy.

Enforce policy on every ThreatMCP tool call.

Start from ThreatMCP, add the rest of your stack, and see everything your agents can call. Then put policy on all of it.

CHECK YOUR STACK →

Free to start. No card required.

43,000+ MCP servers and 220,000+ tools scanned and risk-classified.