bots.st/rosti-threat-intel
Rösti Threat Intel
IOC lookups and threat-intel report search
2640 ms
answered our call
- State
- Answered
- Protocol
- MCP 2025-06-18
- Tools listed
- 11
- Answered
- 3 of the last 3 calls
How to reach it
- MCP, HTTP
https://mcp.rosti.dev/mcp
What it can do
| Tool | What it says it does |
|---|---|
describe_taxonomy | List the values Rösti uses for IOC types, IOC tags (with descriptions), IOC categories and export formats, and explain the false-positive risk scale. Use these values for the filters of the search and list tools. |
find_related_reports | Find other Rösti reports that share IOCs with one report, most shared IOCs first, with the shared values. |
get_export_link | Get a download link for one report export, e.g. CSV or MISP. The link is signed and expires after 15 minutes; it is meant to be opened by the user, not downloaded here. |
get_report | Get one Rösti report: metadata, MITRE ATT&CK ids, CVEs, available export formats, and how many of its IOCs there are per type and per tag. Use list_report_iocs for the IOCs themselves and get_yara_rules for its YARA rules. |
get_yara_rules | Get the YARA rules published with one Rösti report, with their full source. |
list_report_iocs | List the IOCs of one Rösti report, optionally filtered by type, tag, category or text. IOCs with the same entity_ref belong together, e.g. the MD5, SHA-1 and SHA-256 of one file. Each IOC carries its IDS flag and false-positive risk. |
list_sources | List the publishers whose reports Rösti collects (vendor blogs, CERTs, researchers), with report counts, the newest report date and whether the source is still active. Source ids work as the sources filter of search_reports. |
lookup_ioc | Check whether one IOC (indicator of compromise) appears in Rösti's threat-intelligence reports. A defanged value (hxxps://evil[.]com, 1.2.3[.]4) is refanged before the lookup; `input` then shows the value as given. Matching is exact, with a case-insensitive fallback. Returns every report the… |
lookup_iocs | Check many IOCs (indicators of compromise) at once against Rösti's threat-intelligence reports. Defanged values (hxxps://evil[.]com, 1.2.3[.]4, user[at]evil[.]com) are refanged before the lookup; `refanged` shows which. Matching is exact, with a case-insensitive fallback. For each value that is… |
search_iocs | Search IOCs across all Rösti reports by text, type, tag, category and creation time. Without filters, lists IOCs from all reports. Each IOC carries its report id (use get_report for the report), type, category, tags, IDS flag, comment and false-positive risk. Use lookup_ioc or lookup_iocs to… |
search_reports | Search Rösti's threat-intelligence reports by text, source, CVE, MITRE ATT&CK id and publication date. Returns report summaries: title, date, source, authors, tags, counts of IOCs, YARA rules and MITRE ids, and links to the original report and rosti.dev. Use get_report for the details of one… |
In its maker's words
Look up IOCs and search threat-intel reports, YARA rules, MITRE ATT&CK ids and CVEs from rosti.dev
- Website
- rosti.dev/mcp
- Publisher
- rosti.dev
- Listed from
- the official MCP Registry as
dev.rosti/rosti - Version
- 0.2.1, updated 5 Nov 2026
- Kinds of work
- Security and trust, Search and research, Documents and files
The domain it lives on
- rosti.dev
- registered 20 Mar 2026 (8 months ago), at Namecheap Inc., its home page is a working site
From our own crawl of domain names: registry records and the home page as our crawler last saw it.
Every call we made
| When | What happened | Time |
|---|---|---|
| Answered | 2640 ms | |
| Answered | 2366 ms | |
| Answered | 1176 ms |
Next door
- paidforAssess an x402 seller before payment
- WhisperDNS-verifiable agent networking and control
- EchelonGraph CVE & ExposureCVE and internet exposure lookups
- RevClamp MCP ServerAudits payments, disputes, and VAT compliance
- APIEmpresas: Spanish company dataKYB checks using CIF, directors, sanctions, tenders, BORME
Is this your bot? Claim its address to add a verified badge and keep the listing current.