@remnux/mcp-server 0.1.54 → 0.1.56

package/README.md

@@ -15,6 +15,7 @@ Beyond raw command execution, the server encodes malware analysis domain experti
 - Recommends the right tools for each file type (`suggest_tools`) and retrieves usage flags for any installed tool (`get_tool_help`)
 - Runs appropriate tool chains automatically (`analyze_file`) with structured output and IOC extraction
 - Uses neutral language to counteract confirmation bias in AI-generated verdicts
+- Separates static artifacts from executed behavior — tags capa matches by evidence type, gates behavioral claims on the actual import surface (`check_behavior_prerequisites`), and checks whether an embedded string is referenced by code or vestigial (`verify_string_usage`)
 
 For additional tool documentation, you can optionally enable the [REMnux docs MCP server](https://docs.remnux.org/~gitbook/mcp).
 
@@ -260,11 +261,15 @@ claude mcp add remnux --transport http http://REMNUX_IP:3000/mcp \
 | `download_file` | Download a file from the output directory to the host (password-protected archive by default; password: `infected`) |
 | `analyze_file` | Auto-select and run REMnux tools based on detected file type |
 | `extract_iocs` | Extract IOCs (IPs, domains, URLs, hashes, registry keys, etc.) from text with confidence scoring |
+| `check_behavior_prerequisites` | For a Windows PE, report per-behavior `static_capability` (clipboard, HTTP/WinHTTP C2, injection, persistence, etc.) from the import table; packed/.NET binaries return `analysis_incomplete`, not a false negative |
+| `verify_string_usage` | Check whether an embedded string is referenced by code (`referenced_from_code`) or vestigial (`no_code_xrefs_detected`) using radare2 — never claims a string is "unused"; degraded analysis returns `unknown` |
+| `compare_files` | Structured diff of two related samples (loader vs payload): size/entropy, architecture, compiler, packer, imports, capabilities, and sections added/removed |
 | `suggest_tools` | Detect file type and return recommended tools with analysis hints (no execution) |
 | `get_tool_help` | Get usage help (`--help` output) for any installed REMnux tool |
 | `check_tools` | Check which REMnux analysis tools are installed and available |
 | `get_report_template` | Return a bundled malware analysis report template (CC BY 4.0, by Lenny Zeltser) for drafting a report offline |
-| `get_report_guidance` | Return bundled report writing guidelines (sections, confidence, capabilities, IOC tiering, anti-patterns); `topic` narrows the digest |
+| `get_report_guidance` | Return bundled report writing guidelines (sections, confidence, capabilities, IOC tiering, anti-patterns); `topic` narrows the digest, or `topic='triage_checklist'` returns the pre-claim artifact-vs-behavior triage discipline checklist |
+| `get_osint_guidance` | Return bundled, offline OSINT triage guidance for malware indicators. Enrichment tradecraft (hash-first, disclosure-aware, do-not-tip-off-the-adversary, leads-not-verdicts) plus a curated, PR-maintained catalog of free and freemium lookup services. `topic` selects the guidance slice, `ioc_type` narrows the catalog. Makes no network calls and holds no API keys |
 
 ### Key Behaviors
 
@@ -274,6 +279,8 @@ claude mcp add remnux --transport http http://REMNUX_IP:3000/mcp \
 
 **Tool advisories:** `analyze_file` includes per-tool `advisory` messages that frame findings in neutral language, prompting the AI to consider benign explanations before concluding malicious intent. When cross-tool conditions indicate follow-up is needed, an `action_required` array appears with prioritized remediation steps.
 
+**Artifact vs behavior:** capa findings are tagged with `evidence_types` (`artifact`/`behavior`/`structural`/`linking`), derived from the feature nodes that *actually matched* — so a rule that fired only on strings is not mistaken for one backed by code. `analyze_file` rolls this up into a `capability_evidence` field that separates `behavior_capable` (matched on API calls or instructions — the code is present, though static analysis alone doesn't confirm it runs) from `artifact_only` (matched only on data/strings/imports/structure — present, but not evidence the behavior executes). This keeps the distinction between "the data is in the file" and "the binary does this" structural rather than left to prose. See `get_report_guidance` `topic='triage_checklist'` for the corresponding pre-claim discipline.
+
 **Auto-summarization:** When total tool output exceeds ~32KB, `analyze_file` automatically switches to summary mode to prevent LLM context overflow — key findings per tool, full IOC extraction, and paths to saved full outputs for drill-down via `download_file`.
 
 **Preprocessing:** Before analysis, `analyze_file` checks for conditions that prevent effective analysis (encrypted Office docs, bloated PEs, PyInstaller bundles) and applies automatic fixes. Results appear in the `preprocessing` field.
@@ -508,6 +515,14 @@ Analysis produces findings; a report turns them into something a reader can act
 
 The bundled copy is a point-in-time snapshot, refreshed from the canonical public source via `pnpm run sync:report-guidance`. The continuously updated source is the [zeltser-website MCP server](https://zeltser.com/malware-analysis-report) and the article [Writing a Malware Analysis Report](https://zeltser.com/malware-analysis-report), which also offer interactive review and scoring; `analyze_file` points there as optional enrichment when online. Both report tools return only static bundled text — they never read sample content or tool output, so they add no new prompt-injection surface.
 
+### Why bundle an OSINT triage catalog?
+
+Analysis produces IOCs, and triage decides what to do with them. After `extract_iocs`, an AI agent left to improvise might upload a confidential sample to a public multiscanner, or actively probe live C2 and tip off the adversary. `get_osint_guidance` encodes the OPSEC tradecraft for that enrichment step (hash-first, disclosure-aware, do-not-tip-off-the-adversary, leads-not-verdicts) alongside a curated catalog of free and freemium lookup services.
+
+Like the report tools, it returns only static bundled text. It makes no network calls, holds no API keys, reads no sample content, and adds no prompt-injection surface. The server returns guidance, and the AI runs the lookups with its own tools. This keeps the offline, no-secrets stance intact while giving malware-specific OSINT a consistent, in-context home, distinct from a general-purpose OSINT tool.
+
+The service catalog lives in `data/osint-resources.json`, a contributor-editable data file. Every listed service offers a usable free tier (no account, free account, or freemium), so the guidance can default to free-first. Each entry is also tagged for AI-friendliness (`ai_access`: keyless JSON API, key-gated API, or web-only), and the guidance lists keyless APIs first, so an agent with no keys is steered to the services it can use right now (Shodan InternetDB, GreyNoise, ipinfo, DShield, urlscan, crt.sh, RDAP, Team Cymru MHR). Propose additions or access-tier corrections by pull request. A CI test (`src/__tests__/osint-resources.test.ts`) validates structure (required fields, enums, https URLs, `last_verified`, and no duplicates) on every PR, but it cannot judge whether a service is legitimate or still reliable, so reviewers vet new entries for that. Curation favors stable, freely available services, with the backbone drawn from Lenny Zeltser's lists of [automated analysis services](https://zeltser.com/automated-malware-analysis), [malicious-website lookups](https://zeltser.com/lookup-malicious-websites), and [IP/URL blocklists](https://zeltser.com/malicious-ip-blocklists).
+
 ## Related Projects
 
 - [REMnux](https://remnux.org) - Linux toolkit for malware analysis

package/data/osint-resources.json

@@ -0,0 +1,546 @@
+{
+  "version": "1.0.0",
+  "updated": "2026-06-30",
+  "resources": [
+    {
+      "name": "VirusTotal",
+      "url": "https://www.virustotal.com/",
+      "categories": ["multiscanner", "url_web", "infrastructure"],
+      "ioc_types": ["hash", "url", "domain", "ip", "host_artifact"],
+      "access": "freemium",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "public",
+      "best_use": "Multi-engine reputation for a hash, URL, domain, or IP, plus related-sample and relationship pivots.",
+      "caveats": "Hash/URL/IP lookups are non-content-disclosing, but the query itself reveals the indicator to the vendor. Uploading a FILE shares it with the VirusTotal community (downloadable by paid/enterprise users), so do not upload confidential samples without authorization.",
+      "stability": "Long-established, industry-standard, stable free tier.",
+      "last_verified": "2026-06-30",
+      "source_list": ["lookup-malicious-websites", "automated-malware-analysis"]
+    },
+    {
+      "name": "Team Cymru Malware Hash Registry",
+      "url": "https://www.team-cymru.com/mhr",
+      "categories": ["multiscanner"],
+      "ioc_types": ["hash"],
+      "access": "free",
+      "ai_access": "api_nokey",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Keyless hash reputation. A DNS TXT lookup of <md5-or-sha1>.malware.hash.cymru.com returns the last-seen time and an antivirus detection percentage when the hash is known. SHA-256 is supported over the HTTPS interface.",
+      "caveats": "No key, agent-friendly. MD5 and SHA-1 work over the DNS interface. A SHA-256 is too long for a DNS label, so use the HTTPS interface for SHA-256 (get_file_info and analyze_file report both MD5 and SHA-256). Returns NXDOMAIN for unknown hashes. Non-commercial use only, do not enumerate, and notify Team Cymru before high-volume or automated queries. A non-zero detection percentage is a lead to corroborate, not a verdict.",
+      "stability": "Long-running Team Cymru community service.",
+      "last_verified": "2026-06-30",
+      "source_list": []
+    },
+    {
+      "name": "MalwareBazaar",
+      "url": "https://bazaar.abuse.ch/",
+      "categories": ["file_repo"],
+      "ioc_types": ["hash"],
+      "access": "free_account",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "public",
+      "best_use": "Is this hash known, and what related samples exist (by SHA256, imphash, TLSH, tag, or family).",
+      "caveats": "A public malware sample exchange. Hash lookups are non-content-disclosing, but the query reveals the hash to abuse.ch. Samples you upload are shared with the community. A free abuse.ch Auth-Key is required for API access.",
+      "stability": "Well-established abuse.ch (Spamhaus) platform, widely used.",
+      "last_verified": "2026-06-30",
+      "source_list": []
+    },
+    {
+      "name": "Hybrid Analysis",
+      "url": "https://www.hybrid-analysis.com/",
+      "categories": ["sandbox", "multiscanner"],
+      "ioc_types": ["hash", "url"],
+      "access": "free_account",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "public",
+      "best_use": "Behavioral sandbox reports and reputation for a hash or URL; search existing reports before submitting.",
+      "caveats": "Public submissions are searchable by others. Choose a non-public submission setting where available. A free account is required for full access.",
+      "stability": "Long-running CrowdStrike-operated service.",
+      "last_verified": "2026-06-30",
+      "source_list": ["automated-malware-analysis"]
+    },
+    {
+      "name": "Intezer Analyze",
+      "url": "https://analyze.intezer.com/",
+      "categories": ["code_similarity", "multiscanner"],
+      "ioc_types": ["hash"],
+      "access": "freemium",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "vendor",
+      "best_use": "Code-reuse and genetic similarity to known malware families; anchors corroboration on sample-intrinsic code, not network IOCs.",
+      "caveats": "Free tier has a limited number of scans. Uploaded files are shared with Intezer.",
+      "stability": "Established commercial service with a persistent free tier.",
+      "last_verified": "2026-06-30",
+      "source_list": ["automated-malware-analysis"]
+    },
+    {
+      "name": "ANY.RUN",
+      "url": "https://any.run/",
+      "categories": ["sandbox"],
+      "ioc_types": ["hash", "url"],
+      "access": "freemium",
+      "ai_access": "web",
+      "query_disclosing": "vendor",
+      "content_disclosing": "public",
+      "best_use": "Interactive cloud sandbox with real-time observation; also search existing public submissions by hash or IOC.",
+      "caveats": "Free-tier interactive tasks are PUBLIC. Do not detonate confidential samples on the free tier.",
+      "stability": "Widely used interactive sandbox, stable free tier.",
+      "last_verified": "2026-06-30",
+      "source_list": ["automated-malware-analysis"]
+    },
+    {
+      "name": "Joe Sandbox Cloud Basic",
+      "url": "https://www.joesandbox.com/",
+      "categories": ["sandbox"],
+      "ioc_types": ["hash", "url"],
+      "access": "freemium",
+      "ai_access": "web",
+      "query_disclosing": "vendor",
+      "content_disclosing": "public",
+      "best_use": "Detailed behavioral reports for a submitted sample or URL.",
+      "caveats": "Cloud Basic submissions are public. Use a paid or private tier for sensitive samples.",
+      "stability": "Established sandbox vendor with a free Basic tier.",
+      "last_verified": "2026-06-30",
+      "source_list": ["automated-malware-analysis"]
+    },
+    {
+      "name": "Recorded Future Triage",
+      "url": "https://tria.ge/",
+      "categories": ["sandbox"],
+      "ioc_types": ["hash", "url"],
+      "access": "free_account",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "public",
+      "best_use": "Sandbox detonation with configuration extraction; search existing public reports by hash.",
+      "caveats": "Free research accounts default to public samples. Mark submissions unlisted or private for sensitive material.",
+      "stability": "Widely used (tria.ge), stable researcher tier.",
+      "last_verified": "2026-06-30",
+      "source_list": ["automated-malware-analysis"]
+    },
+    {
+      "name": "CAPE Sandbox",
+      "url": "https://capesandbox.com/",
+      "categories": ["sandbox"],
+      "ioc_types": ["hash", "url"],
+      "access": "free",
+      "ai_access": "web",
+      "query_disclosing": "vendor",
+      "content_disclosing": "public",
+      "best_use": "Detonation with payload and configuration extraction for many families.",
+      "caveats": "The community instance is public; submissions, configs, and results are visible. Run a private CAPE for sensitive work.",
+      "stability": "Open-source, community instance long available.",
+      "last_verified": "2026-06-30",
+      "source_list": ["automated-malware-analysis"]
+    },
+    {
+      "name": "Malpedia",
+      "url": "https://malpedia.caad.fkie.fraunhofer.de/",
+      "categories": ["family_yara"],
+      "ioc_types": ["family", "hash"],
+      "access": "free_account",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Normalize family names and aliases across vendors; family references, descriptions, and YARA.",
+      "caveats": "A reference resource, not a submission engine. Some samples and non-public YARA require an account or invite.",
+      "stability": "Fraunhofer FKIE academic resource, stable.",
+      "last_verified": "2026-06-30",
+      "source_list": []
+    },
+    {
+      "name": "YARAify",
+      "url": "https://yaraify.abuse.ch/",
+      "categories": ["family_yara"],
+      "ioc_types": ["hash"],
+      "access": "free_account",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "vendor",
+      "best_use": "Match a file or hash against public YARA and ClamAV rules when vendor naming is weak.",
+      "caveats": "Scanning a file submits it. A free abuse.ch Auth-Key is required for API access.",
+      "stability": "abuse.ch platform, stable.",
+      "last_verified": "2026-06-30",
+      "source_list": []
+    },
+    {
+      "name": "ThreatFox",
+      "url": "https://threatfox.abuse.ch/",
+      "categories": ["community_intel"],
+      "ioc_types": ["hash", "domain", "ip", "url", "family", "host_artifact"],
+      "access": "free_account",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Pivot from a malware family to its current C2 and payload infrastructure, and vice versa.",
+      "caveats": "Community-submitted IOCs are leads, not ground truth, and can be poisoned. Corroborate. A free abuse.ch Auth-Key is required for API access.",
+      "stability": "abuse.ch platform, widely used.",
+      "last_verified": "2026-06-30",
+      "source_list": []
+    },
+    {
+      "name": "urlscan.io",
+      "url": "https://urlscan.io/",
+      "categories": ["url_web", "infrastructure"],
+      "ioc_types": ["url", "domain", "ip"],
+      "access": "freemium",
+      "ai_access": "api_nokey",
+      "query_disclosing": "public",
+      "content_disclosing": "public",
+      "best_use": "Live URL and page analysis (screenshot, DOM, JavaScript, request chain) and search of existing public scans by domain, IP, ASN, or hash.",
+      "caveats": "The keyless path is searching existing public scans; submitting a new scan needs an account. Public scans are searchable by anyone, so use unlisted or private visibility for sensitive URLs. Submitting an attacker URL fetches their infrastructure and may alert them.",
+      "stability": "Widely used, stable free tier.",
+      "last_verified": "2026-06-30",
+      "source_list": ["lookup-malicious-websites"]
+    },
+    {
+      "name": "URLhaus",
+      "url": "https://urlhaus.abuse.ch/",
+      "categories": ["community_intel", "blocklist"],
+      "ioc_types": ["url", "domain", "ip"],
+      "access": "free_account",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Look up a malware-distribution URL, host, or IP, and pivot to related payloads.",
+      "caveats": "A free abuse.ch Auth-Key is required for API access.",
+      "stability": "abuse.ch platform, widely used.",
+      "last_verified": "2026-06-30",
+      "source_list": ["malicious-ip-blocklists"]
+    },
+    {
+      "name": "Sucuri SiteCheck",
+      "url": "https://sitecheck.sucuri.net/",
+      "categories": ["url_web"],
+      "ioc_types": ["url", "domain"],
+      "access": "free",
+      "ai_access": "web",
+      "query_disclosing": "vendor",
+      "content_disclosing": "vendor",
+      "best_use": "Live remote scan of a site for malware and blocklist status.",
+      "caveats": "The scan fetches the URL live from Sucuri infrastructure (not yours). It does not connect from your environment, but it still touches attacker infrastructure, which can tip off an adversary watching their server, so avoid it for sensitive live URLs.",
+      "stability": "Long-running free scanner.",
+      "last_verified": "2026-06-30",
+      "source_list": ["lookup-malicious-websites"]
+    },
+    {
+      "name": "Google Safe Browsing",
+      "url": "https://transparencyreport.google.com/safe-browsing/search",
+      "categories": ["url_web", "blocklist"],
+      "ioc_types": ["url", "domain"],
+      "access": "free",
+      "ai_access": "web",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Check a site's current Safe Browsing status.",
+      "caveats": "Status lookup only. The Safe Browsing API (for automation) requires a key.",
+      "stability": "Google service, stable.",
+      "last_verified": "2026-06-30",
+      "source_list": ["lookup-malicious-websites", "malicious-ip-blocklists"]
+    },
+    {
+      "name": "GreyNoise",
+      "url": "https://www.greynoise.io/",
+      "categories": ["infrastructure"],
+      "ioc_types": ["ip"],
+      "access": "freemium",
+      "ai_access": "api_nokey",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Decide whether an IP is opportunistic internet background noise or worth deeper investigation.",
+      "caveats": "The free community lookup works without an API key and classifies an IP as noise or not. Richer data and higher limits are paid.",
+      "stability": "Established, widely used for IP triage.",
+      "last_verified": "2026-06-30",
+      "source_list": []
+    },
+    {
+      "name": "Shodan InternetDB",
+      "url": "https://internetdb.shodan.io/",
+      "categories": ["infrastructure"],
+      "ioc_types": ["ip"],
+      "access": "free",
+      "ai_access": "api_nokey",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Fast IP lookup for open ports, hostnames, CPEs, tags, and known vulnerabilities.",
+      "caveats": "Unauthenticated and free for non-commercial use. Full Shodan (banners, history, search) needs an account and API key.",
+      "stability": "Shodan service, stable.",
+      "last_verified": "2026-06-30",
+      "source_list": []
+    },
+    {
+      "name": "Censys Search",
+      "url": "https://search.censys.io/",
+      "categories": ["infrastructure", "cert_transparency"],
+      "ioc_types": ["ip", "domain"],
+      "access": "freemium",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Map exposed infrastructure and pivot on hosts, services, banners, and certificates.",
+      "caveats": "Free tier requires an account and is rate-limited.",
+      "stability": "Established internet-scan platform.",
+      "last_verified": "2026-06-30",
+      "source_list": []
+    },
+    {
+      "name": "AbuseIPDB",
+      "url": "https://www.abuseipdb.com/",
+      "categories": ["infrastructure"],
+      "ioc_types": ["ip"],
+      "access": "free_account",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Community reputation and abuse reports for an IP or hostname.",
+      "caveats": "Community reports are leads, not ground truth. A free account and API key are needed for the API.",
+      "stability": "Widely used IP reputation service.",
+      "last_verified": "2026-06-30",
+      "source_list": ["lookup-malicious-websites"]
+    },
+    {
+      "name": "Cisco Talos Reputation Center",
+      "url": "https://talosintelligence.com/reputation_center",
+      "categories": ["infrastructure"],
+      "ioc_types": ["ip", "domain"],
+      "access": "free",
+      "ai_access": "web",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Independent IP, domain, and email reputation cross-check, useful for network and email infrastructure.",
+      "caveats": "Reputation snapshot; corroborate with other sources.",
+      "stability": "Cisco-operated, stable.",
+      "last_verified": "2026-06-30",
+      "source_list": ["lookup-malicious-websites"]
+    },
+    {
+      "name": "ipinfo",
+      "url": "https://ipinfo.io/",
+      "categories": ["infrastructure"],
+      "ioc_types": ["ip"],
+      "access": "freemium",
+      "ai_access": "api_nokey",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Geolocation, ASN, and owner baseline for an IP.",
+      "caveats": "Free tier with an account is rate-limited; richer data is paid.",
+      "stability": "Established IP-data provider.",
+      "last_verified": "2026-06-30",
+      "source_list": []
+    },
+    {
+      "name": "crt.sh",
+      "url": "https://crt.sh/",
+      "categories": ["cert_transparency"],
+      "ioc_types": ["domain"],
+      "access": "free",
+      "ai_access": "api_nokey",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Certificate Transparency search to pivot on domains, organization names, and certificate fingerprints.",
+      "caveats": "Passive lookup against public CT logs. The service can be slow or briefly unavailable under load, so retry or fall back to another CT source if it times out.",
+      "stability": "Long-running free CT search.",
+      "last_verified": "2026-06-30",
+      "source_list": []
+    },
+    {
+      "name": "DNSDumpster",
+      "url": "https://dnsdumpster.com/",
+      "categories": ["passive_dns"],
+      "ioc_types": ["domain"],
+      "access": "free",
+      "ai_access": "web",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Passive DNS, subdomain, and host discovery for a domain.",
+      "caveats": "Free and rate-limited.",
+      "stability": "Long-running free recon tool.",
+      "last_verified": "2026-06-30",
+      "source_list": []
+    },
+    {
+      "name": "SecurityTrails",
+      "url": "https://securitytrails.com/",
+      "categories": ["passive_dns", "infrastructure"],
+      "ioc_types": ["domain", "ip"],
+      "access": "freemium",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Passive DNS, DNS history, subdomain discovery, and domain-to-IP infrastructure pivots.",
+      "caveats": "Free tier with an account; paid for volume.",
+      "stability": "Established passive-DNS provider.",
+      "last_verified": "2026-06-30",
+      "source_list": ["lookup-malicious-websites"]
+    },
+    {
+      "name": "Validin",
+      "url": "https://app.validin.com/",
+      "categories": ["passive_dns", "infrastructure"],
+      "ioc_types": ["domain", "ip"],
+      "access": "freemium",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "DNS and threat-infrastructure enrichment, mapping artifacts to malware-family and attacker profiles.",
+      "caveats": "Free community tier with an account.",
+      "stability": "Newer but actively maintained; reassess at re-verification.",
+      "last_verified": "2026-06-30",
+      "source_list": []
+    },
+    {
+      "name": "CyberGordon",
+      "url": "https://cybergordon.com/",
+      "categories": ["aggregator"],
+      "ioc_types": ["ip", "domain", "url", "hash"],
+      "access": "free",
+      "ai_access": "web",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Run one observable across many reputation services at once for a fast first corroboration pass.",
+      "caveats": "Aggregates third-party services, so each underlying source carries its own caveats.",
+      "stability": "Stable free aggregator.",
+      "last_verified": "2026-06-30",
+      "source_list": ["lookup-malicious-websites"]
+    },
+    {
+      "name": "Pulsedive",
+      "url": "https://pulsedive.com/",
+      "categories": ["aggregator", "community_intel"],
+      "ioc_types": ["ip", "domain", "url", "hash", "host_artifact"],
+      "access": "freemium",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Enrich an IP, domain, URL, or hash from OSINT feeds, with passive and active scan options.",
+      "caveats": "Free tier with an account. Treat feed-sourced data as leads.",
+      "stability": "Established threat-intel platform.",
+      "last_verified": "2026-06-30",
+      "source_list": ["lookup-malicious-websites"]
+    },
+    {
+      "name": "IBM X-Force Exchange",
+      "url": "https://exchange.xforce.ibmcloud.com/",
+      "categories": ["aggregator"],
+      "ioc_types": ["ip", "domain", "url", "hash"],
+      "access": "free_account",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Independent reputation and context for an IP, URL, or hash to corroborate other sources.",
+      "caveats": "A free account is required.",
+      "stability": "IBM-operated, stable.",
+      "last_verified": "2026-06-30",
+      "source_list": ["lookup-malicious-websites"]
+    },
+    {
+      "name": "AlienVault OTX",
+      "url": "https://otx.alienvault.com/",
+      "categories": ["community_intel"],
+      "ioc_types": ["ip", "domain", "url", "hash", "family", "host_artifact"],
+      "access": "free_account",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Check whether an IOC appears in community pulses and campaign context.",
+      "caveats": "Lead generation, not ground truth. Community pulses can be poisoned; corroborate. Now operated as LevelBlue OTX. A free account is required.",
+      "stability": "Large community threat-intel platform.",
+      "last_verified": "2026-06-30",
+      "source_list": ["lookup-malicious-websites"]
+    },
+    {
+      "name": "OpenPhish",
+      "url": "https://openphish.com/",
+      "categories": ["blocklist"],
+      "ioc_types": ["url"],
+      "access": "free",
+      "ai_access": "api_nokey",
+      "query_disclosing": "none",
+      "content_disclosing": "none",
+      "best_use": "Check a URL or domain against a phishing feed.",
+      "caveats": "Free for non-commercial use.",
+      "stability": "Long-running phishing feed.",
+      "last_verified": "2026-06-30",
+      "source_list": ["malicious-ip-blocklists"]
+    },
+    {
+      "name": "DShield (SANS ISC)",
+      "url": "https://www.dshield.org/",
+      "categories": ["blocklist", "infrastructure"],
+      "ioc_types": ["ip"],
+      "access": "free",
+      "ai_access": "api_nokey",
+      "query_disclosing": "none",
+      "content_disclosing": "none",
+      "best_use": "Check an IP against suspicious-source blocklists and attack telemetry from the SANS Internet Storm Center.",
+      "caveats": "Aggregated telemetry; read the list methodology before acting.",
+      "stability": "SANS ISC, long-running.",
+      "last_verified": "2026-06-30",
+      "source_list": ["malicious-ip-blocklists"]
+    },
+    {
+      "name": "UnpacMe",
+      "url": "https://www.unpac.me/",
+      "categories": ["unpacking"],
+      "ioc_types": ["hash"],
+      "access": "freemium",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "public",
+      "best_use": "Automated unpacking and payload or configuration extraction when triage stalls on a packed sample.",
+      "caveats": "Not pure OSINT; submission is disclosing. Free-tier results are public.",
+      "stability": "Established automated unpacker.",
+      "last_verified": "2026-06-30",
+      "source_list": []
+    },
+    {
+      "name": "RDAP (rdap.org)",
+      "url": "https://rdap.org/",
+      "categories": ["registration", "infrastructure"],
+      "ioc_types": ["domain", "ip"],
+      "access": "free",
+      "ai_access": "api_nokey",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Registration data (RDAP, the JSON successor to WHOIS) for a domain or IP via a single no-key request, for registrar, network-owner, and allocation pivots.",
+      "caveats": "rdap.org redirects to the authoritative registry or RIR and returns clean JSON with no key, so it is agent-friendly. Domain coverage depends on the TLD supporting RDAP.",
+      "stability": "IETF-standard protocol with a stable bootstrap redirector.",
+      "last_verified": "2026-06-30",
+      "source_list": []
+    },
+    {
+      "name": "Silent Push Community Edition",
+      "url": "https://www.silentpush.com/community-edition/",
+      "categories": ["infrastructure", "passive_dns"],
+      "ioc_types": ["domain", "ip"],
+      "access": "freemium",
+      "ai_access": "api_key",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Infrastructure hunting across DNS, WHOIS, certificates, and web-content fingerprints to map related attacker infrastructure.",
+      "caveats": "The free Community Edition allows 250 queries per month (GUI and API) for DNS, IP, domain, and WHOIS-history lookups. Advanced features and intelligence feeds are paid.",
+      "stability": "Established platform with a free Community Edition.",
+      "last_verified": "2026-06-30",
+      "source_list": []
+    },
+    {
+      "name": "Maltego Community Edition",
+      "url": "https://www.maltego.com/products/maltego-community-edition/",
+      "categories": ["aggregator"],
+      "ioc_types": ["domain", "ip", "hash", "url"],
+      "access": "freemium",
+      "ai_access": "web",
+      "query_disclosing": "vendor",
+      "content_disclosing": "none",
+      "best_use": "Link-analysis and graph pivoting across many data sources via transforms.",
+      "caveats": "The free Community Edition (requires a Maltego ID) includes about 50 transforms, 200 credits per month, and up to 24 results per transform, with per-provider monthly caps. Breach data and higher limits are paid.",
+      "stability": "Long-established link-analysis platform with a free Community Edition.",
+      "last_verified": "2026-06-30",
+      "source_list": []
+    }
+  ]
+}