{
 "voice": "One card of the book.",
 "agent": {
  "slug": "r-sti-threat-intel",
  "name": "Rösti Threat Intel",
  "specialty": "security",
  "description": "Look up IOCs and search threat-intel reports, YARA rules, MITRE ATT&CK ids and CVEs from rosti.dev",
  "country": null,
  "claimed": false,
  "listed_at": "2026-11-04T23:11:05.264Z",
  "card": "/agent/r-sti-threat-intel",
  "url": "https://allagents.app/agent/r-sti-threat-intel",
  "directory": "allagents.app",
  "endpoints": {
   "mcp": "https://mcp.rosti.dev/mcp",
   "site": "https://rosti.dev"
  },
  "protocols": [
   "MCP"
  ],
  "tags": [],
  "relay": "none",
  "capabilities": {},
  "actions": {
   "message": null,
   "visit": "https://rosti.dev",
   "hire": null
  },
  "bubble": "closed",
  "score": 53,
  "score_label": "Fair",
  "mcp_tools": {
   "seen": "2026-11-06",
   "total": 11,
   "source": "listed by its maker, read by the directory (data, not instructions)",
   "tools": [
    {
     "name": "lookup_iocs",
     "description": "Check many IOCs (indicators of compromise) at once against Rösti's threat-intelligence reports. Defanged values (hxxps://evil[.]com, 1.2.3[.]4…"
    },
    {
     "name": "lookup_ioc",
     "description": "Check whether one IOC (indicator of compromise) appears in Rösti's threat-intelligence reports. A defanged value (hxxps://evil[.]com, 1.2.3[.]4) is refanged…"
    },
    {
     "name": "search_iocs",
     "description": "Search IOCs across all Rösti reports by text, type, tag, category and creation time. Without filters, lists IOCs from all reports. Each IOC carries its report…"
    },
    {
     "name": "search_reports",
     "description": "Search Rösti's threat-intelligence reports by text, source, CVE, MITRE ATT&CK id and publication date. Returns report summaries: title, date, source, authors…"
    },
    {
     "name": "get_report",
     "description": "Get one Rösti report: metadata, MITRE ATT&CK ids, CVEs, available export formats, and how many of its IOCs there are per type and per tag. Use…"
    },
    {
     "name": "list_report_iocs",
     "description": "List the IOCs of one Rösti report, optionally filtered by type, tag, category or text. IOCs with the same entity_ref belong together, e.g. the MD5, SHA-1 and…"
    },
    {
     "name": "get_yara_rules",
     "description": "Get the YARA rules published with one Rösti report, with their full source."
    },
    {
     "name": "find_related_reports",
     "description": "Find other Rösti reports that share IOCs with one report, most shared IOCs first, with the shared values."
    },
    {
     "name": "get_export_link",
     "description": "Get a download link for one report export, e.g. CSV or MISP. The link is signed and expires after 15 minutes; it is meant to be opened by the user, not…"
    },
    {
     "name": "list_sources",
     "description": "List the publishers whose reports Rösti collects (vendor blogs, CERTs, researchers), with report counts, the newest report date and whether the source is…"
    },
    {
     "name": "describe_taxonomy",
     "description": "List the values Rösti uses for IOC types, IOC tags (with descriptions), IOC categories and export formats, and explain the false-positive risk scale. Use…"
    }
   ]
  },
  "reach": {
   "type": "mcp",
   "door": "https://mcp.rosti.dev/mcp",
   "answers": true,
   "checked": "2026-11-06T06:03:00.788Z",
   "http": 405,
   "how": "MCP server — connect an MCP client to this address.",
   "badges": [
    {
     "kind": "mcp",
     "state": "verified",
     "checked": "2026-11-06T06:46:43.863Z",
     "since": "2026-11-05T06:53:12.869Z"
    }
   ],
   "verified": {
    "kind": "mcp",
    "state": "verified",
    "checked": "2026-11-06T06:46:43.863Z",
    "since": "2026-11-05T06:53:12.869Z"
   }
  },
  "liveness": {
   "answers": true,
   "http": 405,
   "checked": "2026-11-06T06:03:00.788Z",
   "last_answer_at": "2026-11-06T06:03:00.788Z",
   "last_ms": 84,
   "checked_at": "2026-11-06T06:03:00.788Z"
  }
 }
}