MCP server

PG1 Sovereign Threat Intelligence

io.github.Project-Gifted1/pg1-threat-intel

Checked 26 Oct 2026, 08:29 UTC · Connected to it and listed its tools

Preflight for AI agents, signed: one call; wallet, domain, IP abuse, package checks and CVEs.

Working at last checkAbout 8,557 tokens per request once connected20 tools

Source

https://pg1-ai-agent.vercel.app/api/mcp

At a glance

Type: MCP server
Publisher: Not verified
Status: Working at last check
Tools: 20
Token cost: About 8,557 tokens per request
Sets up in: Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok
Last checked: 26 Oct 2026, 08:29 UTC

Connect it to your agent

Add to Cursor Add to VS Code VS Code Insiders

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http pg1-threat-intel https://pg1-ai-agent.vercel.app/api/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.pg1-threat-intel]
url = "https://pg1-ai-agent.vercel.app/api/mcp"

Gemini CLI

{"mcpServers":{"pg1-threat-intel":{"httpUrl":"https://pg1-ai-agent.vercel.app/api/mcp"}}}

Cursor

{"mcpServers":{"pg1-threat-intel":{"url":"https://pg1-ai-agent.vercel.app/api/mcp"}}}

VS Code

{"servers":{"pg1-threat-intel":{"type":"http","url":"https://pg1-ai-agent.vercel.app/api/mcp"}}}

Antigravity

agy mcp add pg1-threat-intel https://pg1-ai-agent.vercel.app/api/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"pg1-threat-intel","server_url":"https://pg1-ai-agent.vercel.app/api/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"pg1-threat-intel","server_url":"https://pg1-ai-agent.vercel.app/api/mcp"}

Tools

check_agent_card ~232 tokens
PG1 Sovereign Threat Intelligence: checks another agent before you trust it. Fetches its /.well-known/agent-card.json (https only; private addresses and redirects refused): is it a valid A2A agent card, does its name claim a well-known brand the domain does not belong to, how old is the domain, is t
check_domain_age ~397 tokens
PG1 Sovereign Threat Intelligence: looks up a domain's registration age via RDAP (the IANA-standardized WHOIS successor), resolved through the IANA bootstrap registry for the correct per-TLD RDAP server. No payment required — this tool is always free. SIBLING DIFFERENTIATION: Use for domain registra
check_hostname_reputation ~642 tokens
PG1 Sovereign Threat Intelligence: checks a single hostname against the MetaMask eth-phishing-detect blocklist/allowlist and a lookalike/typosquat detector, synced daily by the sovereign-threat-pipeline. No payment required — this tool is always free. SIBLING DIFFERENTIATION: Use for phishing/lookal
check_ip_abuse ~712 tokens
PG1 Sovereign Threat Intelligence: looks up one public IPv4 or IPv6 address in AbuseIPDB using YOUR OWN AbuseIPDB API key (free or paid), and returns its abuse confidence score and report counts with attribution to AbuseIPDB. BRING YOUR OWN KEY: send the key in the X-AbuseIPDB-Key HTTP request heade
check_package ~724 tokens
PG1 Sovereign Threat Intelligence: a pre-install check for one npm or PyPI package - check before you install. No payment required - this tool is always free, and no AI model is involved. SIBLING DIFFERENTIATION: Use before installing or recommending a software package (npm or PyPI) only. Do NOT use
check_wallet_age ~626 tokens
PG1 Sovereign Threat Intelligence: reports when an EVM wallet address first appeared on a given chain, based on its earliest on-chain transfer history (in or out), plus whether the address is a contract. No payment required — this tool is always free. SIBLING DIFFERENTIATION: Use for wallet age/hist
check_wallet_sanctions ~446 tokens
PG1 Sovereign Threat Intelligence: checks a cryptocurrency wallet address against the OFAC SDN (Specially Designated Nationals) sanctions list, synced daily from US Treasury data. No payment required — this tool is always free. SIBLING DIFFERENTIATION: Use for wallet/address sanctions screening only
check_x402_endpoint ~272 tokens
PG1 Sovereign Threat Intelligence: checks an x402-paid URL before you pay it. Fetches the URL once (https only; private addresses and redirects refused) and reads its x402 payment request: each option's network must be a known settlement network and its asset the known USDC contract there; the recei
get_cve_batch ~306 tokens
PG1 Sovereign Threat Intelligence: looks up multiple CVE identifiers in a single call, each enriched with NVD description/CVSS and CISA KEV status (plus the FIRST.org EPSS score when this server serves EPSS in paid responses) — same enrichment as get_cve_details, batched. Payment required: $0.01 via
get_cve_by_product ~351 tokens
PG1 Sovereign Threat Intelligence: returns CVEs affecting a given vendor/product (optionally a specific version), enriched with CVSS and CISA KEV status (plus EPSS when this server serves EPSS in paid responses), sorted by exploitation risk. Sourced from NVD keyword search. Payment required: $0.01 v
get_cve_details ~378 tokens
PG1 Sovereign Threat Intelligence: enriched CVE lookup combining NVD (description, CVSS score/vector) and the CISA Known Exploited Vulnerabilities catalog (active wild exploitation status). The epss field (FIRST.org EPSS exploit-probability score and percentile) is present only when this server serv
get_ioc_batch ~393 tokens
PG1 Sovereign Threat Intelligence: looks up multiple indicators (IPs, domains, URLs, hashes) in a single call — a batched pre-action safety check for AI agents. Each returns the same aggregated provenance as get_ioc_context from PG1's commercially licensed records, which currently hold only CVE iden
get_ioc_context ~520 tokens
PG1 Sovereign Threat Intelligence: looks up a single specific indicator value (IP, domain, URL, or hash) — the recommended pre-action safety check for AI agents before visiting, downloading, or connecting to something. PG1's commercially licensed records currently hold only CVE identifiers from NVD,
get_threat_actor_profile ~305 tokens
PG1 Sovereign Threat Intelligence: returns a dossier for a known threat actor / APT group — aliases, description, associated MITRE ATT&CK techniques, and associated malware/tooling. Sourced from MITRE ATT&CK Enterprise. Payment required: $0.01 via x402, sent in params._meta['x402/payment'] (the PAYM
get_threat_indicators ~484 tokens
PG1 Sovereign Threat Intelligence: returns a STIX 2.1 bundle of CVE records from NIST NVD, the only source PG1 may currently redistribute commercially. Today it contains no IP, domain, URL or file-hash indicators: every object is a STIX vulnerability with the CVE id and an NVD reference, without sco
get_usage_status ~151 tokens
PG1 Sovereign Threat Intelligence: returns your remaining free-tier calls for today and current Gumroad license status. No payment required — this tool is always free.
hosting_advisor ~578 tokens
PG1 hosting advisor: ranked regions and providers for a workload, with reasons: data-protection regime, published government data-access frameworks (factual, cited), provider acceptable-use fit, sanctions and export-control compliance, estimated latency, a multi-region/multi-provider redundancy and
preflight_check ~518 tokens
PG1 Sovereign Threat Intelligence: ONE call before an agent acts. Give the action you are about to take and its target; PG1 runs every relevant check in parallel and returns one decision: no_flags, flagged or unknown, with merged reasons, per-check results and latency. no_flags means no flags found
submit_indicator ~212 tokens
PG1 Sovereign Threat Intelligence: submit an observed indicator for validation and possible inclusion in future query results. Requires a valid Gumroad license key (X-API-KEY header) — this tool is NOT available via per-query x402. Submissions are staged for review, not immediately added to the live
verify_result ~310 tokens
PG1 Sovereign Threat Intelligence: verifies that a result really came from PG1, unchanged. Every PG1 tool result is signed (Ed25519) over its request hash, result, sources, timestamp and PG1 version; the signature is in result._meta["pg1/signature"] (MCP), the task's metadata["pg1.signature"] (A2A)

Browse

Related MCP servers

OT Intel API
OT/ICS threat intel for AI agents: 40 tools, pay per call in USDC on Base via x402.
AgentPay — Pay-per-call AI Microservices
34 pay-per-call AI microservices via x402, USDC on Base, no API keys.
Robtex
DNS, IP, AS, domain reputation, and Lightning Network intelligence (44 tools)
SENTINEL Compliance Intelligence
AML/CFT compliance oracle: wallet screening, sanctions, PEPs, jurisdiction risk.
RTK Motion — Motion Capture, Biomechanics, Threat & Fleet Intelligence
Mocap, rehab biomechanics, threat intel, fleet vision. 21 MCP tools, 10 free. x402/USDC paid.
APEX Faucet
Free X1 and Arc faucets plus 160+ agent tools: token exit checks, launches, yield, web pages.
Minia2a
minia2a.uk — hosted MCP over streamable HTTP: call 1,600+ x402 pay-per-call APIs, USDC on Base.
Nullcone Threat Intelligence
Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats

Badge for your README

[![AptLynx](https://aptlynx.net/badge/io.github.Project-Gifted1/pg1-threat-intel.svg)](https://aptlynx.net/servers/io.github.Project-Gifted1/pg1-threat-intel)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents