PG1 Sovereign Threat Intelligence
Preflight for AI agents, signed: one call; wallet, domain, IP abuse, package checks and CVEs.
| Endpoint | https://pg1-ai-agent.vercel.app/api/mcp (streamable-http) |
|---|---|
| Registry version | 1.20.2 |
| Now | 20 tools · grade F (34) · pin ts_daec31035aa9372c822d2ebffd154a0f · protocol 2025-06-18 |
| First / last listed | 2026-10-28 05:29 UTC / 2026-10-28 05:29 UTC |
| Grade over time | 2026-10-28: F (34), 20 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: preflight_check check_x402_endpoint check_agent_card verify_result hosting_advisor get_threat_indicators get_cve_details get_ioc_context get_cve_batch get_ioc_batch get_threat_actor_profile get_cve_by_product get_usage_status submit_indicator check_wallet_sanctions check_domain_age check_hostname_reputation check_wallet_age check_ip_abuse check_package
preflight_check | PG1 Sovereign Threat Intelligence: ONE call before an agent acts. Give the action you are about to take and its target; PG1 runs every relevant check in parallel and returns one decision: no_flags, flagged or unknown, with merged reasons, per-check results and latency. no_flags means no flags found in the checks run, never "safe". Fail closed: any check that does not finish makes the decision unkn params: action*, target*, chain, ecosystem |
check_x402_endpoint | PG1 Sovereign Threat Intelligence: checks an x402-paid URL before you pay it. Fetches the URL once (https only; private addresses and redirects refused) and reads its x402 payment request: each option's network must be a known settlement network and its asset the known USDC contract there; the receiving wallet (payTo) is screened against the OFAC SDN list and its on-chain age read; TLS and the dom params: url* |
check_agent_card | PG1 Sovereign Threat Intelligence: checks another agent before you trust it. Fetches its /.well-known/agent-card.json (https only; private addresses and redirects refused): is it a valid A2A agent card, does its name claim a well-known brand the domain does not belong to, how old is the domain, is the hostname on the phishing blocklist or a look-alike. Always free (60/hour per caller). Give url or params: url, domain |
verify_result | PG1 Sovereign Threat Intelligence: verifies that a result really came from PG1, unchanged. Every PG1 tool result is signed (Ed25519) over its request hash, result, sources, timestamp and PG1 version; the signature is in result._meta["pg1/signature"] (MCP), the task's metadata["pg1.signature"] (A2A) or "signature" (REST). Give the result object and the signature block; optionally tool and arguments params: result*, signature*, tool, arguments |
hosting_advisor | PG1 hosting advisor: ranked regions and providers for a workload, with reasons: data-protection regime, published government data-access frameworks (factual, cited), provider acceptable-use fit, sanctions and export-control compliance, estimated latency, a multi-region/multi-provider redundancy and resilience plan, and privacy-by-design guidance. Every fact cites its official source and date; unve params: workload_type*, data_residency, privacy_priority, latency_regions*, uptime_target, budget_usd_month, requirements |
get_threat_indicators | PG1 Sovereign Threat Intelligence: returns a STIX 2.1 bundle of CVE records from NIST NVD, the only source PG1 may currently redistribute commercially. Today it contains no IP, domain, URL or file-hash indicators: every object is a STIX vulnerability with the CVE id and an NVD reference, without scores (use get_cve_details for CVSS and known-exploited status). FREE (CVE records from NIST NVD); doe params: since, type, min_score, limit |
get_cve_details | PG1 Sovereign Threat Intelligence: enriched CVE lookup combining NVD (description, CVSS score/vector) and the CISA Known Exploited Vulnerabilities catalog (active wild exploitation status). The epss field (FIRST.org EPSS exploit-probability score and percentile) is present only when this server serves EPSS in paid responses. Payment required: $0.01 via x402, sent in params._meta["x402/payment"] (t params: cve_id* |
get_ioc_context | PG1 Sovereign Threat Intelligence: looks up a single specific indicator value (IP, domain, URL, or hash) — the recommended pre-action safety check for AI agents before visiting, downloading, or connecting to something. PG1's commercially licensed records currently hold only CVE identifiers from NVD, so an IP, domain, URL or hash returns found: false (free) until other licensed sources are added. A params: value* |
get_cve_batch | PG1 Sovereign Threat Intelligence: looks up multiple CVE identifiers in a single call, each enriched with NVD description/CVSS and CISA KEV status (plus the FIRST.org EPSS score when this server serves EPSS in paid responses) — same enrichment as get_cve_details, batched. Payment required: $0.01 via x402, sent in params._meta['x402/payment'] (the PAYMENT-SIGNATURE header is also accepted), or a va params: cve_ids* |
get_ioc_batch | PG1 Sovereign Threat Intelligence: looks up multiple indicators (IPs, domains, URLs, hashes) in a single call — a batched pre-action safety check for AI agents. Each returns the same aggregated provenance as get_ioc_context from PG1's commercially licensed records, which currently hold only CVE identifiers from NVD (IPs, domains, URLs and hashes return found: false). SIBLING DIFFERENTIATION: Use f params: values* |
get_threat_actor_profile | PG1 Sovereign Threat Intelligence: returns a dossier for a known threat actor / APT group — aliases, description, associated MITRE ATT&CK techniques, and associated malware/tooling. Sourced from MITRE ATT&CK Enterprise. Payment required: $0.01 via x402, sent in params._meta['x402/payment'] (the PAYMENT-SIGNATURE header is also accepted), or a valid Gumroad license key (X-API-KEY header). SIBLING D params: actor_name* |
get_cve_by_product | PG1 Sovereign Threat Intelligence: returns CVEs affecting a given vendor/product (optionally a specific version), enriched with CVSS and CISA KEV status (plus EPSS when this server serves EPSS in paid responses), sorted by exploitation risk. Sourced from NVD keyword search. Payment required: $0.01 via x402, sent in params._meta["x402/payment"] (the PAYMENT-SIGNATURE header is also accepted), or a params: vendor*, product*, version, only_kev |
get_usage_status | PG1 Sovereign Threat Intelligence: returns your remaining free-tier calls for today and current Gumroad license status. No payment required — this tool is always free. params: identifier, license_key |
submit_indicator | PG1 Sovereign Threat Intelligence: submit an observed indicator for validation and possible inclusion in future query results. Requires a valid Gumroad license key (X-API-KEY header) — this tool is NOT available via per-query x402. Submissions are staged for review, not immediately added to the live feed. params: indicator*, indicator_type*, malware_family, confidence, source_note |
check_wallet_sanctions | PG1 Sovereign Threat Intelligence: checks a cryptocurrency wallet address against the OFAC SDN (Specially Designated Nationals) sanctions list, synced daily from US Treasury data. No payment required — this tool is always free. SIBLING DIFFERENTIATION: Use for wallet/address sanctions screening only. Do NOT use for IP/domain/hash/URL threat lookups (use get_ioc_context) or CVE data (use get_cve_de params: address*, currency |
check_domain_age | PG1 Sovereign Threat Intelligence: looks up a domain's registration age via RDAP (the IANA-standardized WHOIS successor), resolved through the IANA bootstrap registry for the correct per-TLD RDAP server. No payment required — this tool is always free. SIBLING DIFFERENTIATION: Use for domain registration/age checks only. Do NOT use for reputation/threat-feed lookups (use get_ioc_context) or sanctio params: domain* |
check_hostname_reputation | PG1 Sovereign Threat Intelligence: checks a single hostname against the MetaMask eth-phishing-detect blocklist/allowlist and a lookalike/typosquat detector, synced daily by the sovereign-threat-pipeline. No payment required — this tool is always free. SIBLING DIFFERENTIATION: Use for phishing/lookalike-domain screening of a hostname only. Do NOT use for domain registration age (use check_domain_ag params: hostname* |
check_wallet_age | PG1 Sovereign Threat Intelligence: reports when an EVM wallet address first appeared on a given chain, based on its earliest on-chain transfer history (in or out), plus whether the address is a contract. No payment required — this tool is always free. SIBLING DIFFERENTIATION: Use for wallet age/history only. Do NOT use for sanctions screening (use check_wallet_sanctions), domain age (use check_dom params: address*, chain |
check_ip_abuse | PG1 Sovereign Threat Intelligence: looks up one public IPv4 or IPv6 address in AbuseIPDB using YOUR OWN AbuseIPDB API key (free or paid), and returns its abuse confidence score and report counts with attribution to AbuseIPDB. BRING YOUR OWN KEY: send the key in the X-AbuseIPDB-Key HTTP request header on /api/mcp or /api/a2a - never as a tool argument. PG1 has no AbuseIPDB key of its own; without t params: ip*, max_age_in_days |
check_package | PG1 Sovereign Threat Intelligence: a pre-install check for one npm or PyPI package - check before you install. No payment required - this tool is always free, and no AI model is involved. SIBLING DIFFERENTIATION: Use before installing or recommending a software package (npm or PyPI) only. Do NOT use for domains (use check_domain_age / check_hostname_reputation), CVE ids (use get_cve_details) or pr params: ecosystem*, name*, version |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.