Website Search

lennyzeltser/zeltser-website-mcp-server

Lenny Zeltser packaged his incident response writing expertise into an MCP server that Claude and other AI tools can query on demand. Point your assistant at the remote endpoint and it gains access to IR report templates, scoring rubrics for executive summaries, and guidance on framing findings without blame. The server exposes operations for generating draft reports from raw notes, providing constructive feedback on existing content, and surfacing Zeltser's published security articles. Your incident data stays local since the server only returns writing principles, not processing content. It handles ransomware versus BEC scenarios differently and knows how to balance technical detail with board readability. Built on Zeltser's MCP Expertise Toolkit, so you can fork the approach to codify your own domain knowledge.

tools: 53
transport: HTTP
last updated: Jun 10, 2026

View on GitHub

Install

From registry metadata

$ npx add-mcp https://website-mcp.zeltser.com/mcp --name website-search

Run in your terminal. add-mcp asks which agents to add it to (Claude Code, Codex, Cursor and more). Add -g to install it for every project.

Review the command, arguments and environment values before installing. MCP servers run with your local permissions.

Other ways

Claude Code

$ claude mcp add --transport http website-search https://website-mcp.zeltser.com/mcp

Run in your terminal. Add --scope user to make it available in every project.

Tools

Verified live · 53 tools

Verified live against the running server on Nov 6, 2026.

search_zeltserSearch Lenny Zeltser's Website by keywords. Security articles on malware analysis, incident response, and security leadership. Searches across titles, abstracts, full content, and topics.2 params

Search Lenny Zeltser's Website by keywords. Security articles on malware analysis, incident response, and security leadership. Searches across titles, abstracts, full content, and topics.

Parameters* required

limitnumber

Maximum number of results to return (default: 10, max: 25)

query*string

Search terms to find relevant content

get_articleGet the full content of a specific article from Lenny Zeltser's Website by URL path. Security articles on malware analysis, incident response, and security leadership. Returns title, date, topics, summary, and full body text.1 params

Get the full content of a specific article from Lenny Zeltser's Website by URL path. Security articles on malware analysis, incident response, and security leadership. Returns title, date, topics, summary, and full body text.

Parameters* required

url*string

Article URL path or full URL (e.g., '/about', '/article-slug', or the full URL printed by search results)

get_index_infoGet statistics about the Lenny Zeltser's Website search index including total pages indexed, last update time, and available tools.

Get statistics about the Lenny Zeltser's Website search index including total pages indexed, last update time, and available tools.

No parameters. Call it with no arguments.

get_capabilitiesList all capabilities and tools available from the Lenny Zeltser's Website MCP server, including search tools and any specialized features like IR report writing assistance.

List all capabilities and tools available from the Lenny Zeltser's Website MCP server, including search tools and any specialized features like IR report writing assistance.

No parameters. Call it with no arguments.

get_security_writing_guidelinesGet Lenny Zeltser's expert writing guidelines for security reports and assessments. Provides guidance on tone, structure, clarity, executive summaries, and avoiding common writing mistakes. Includes rating-sheet items (the four lens sheets: structure, look, words, tone) as con...2 params

Get Lenny Zeltser's expert writing guidelines for security reports and assessments. Provides guidance on tone, structure, clarity, executive summaries, and avoiding common writing mistakes. Includes rating-sheet items (the four lens sheets: structure, look, words, tone) as con...

Parameters* required

focusarray

Which aspects of writing to focus on. 'tone': voice, do/avoid examples. 'structure': paragraphs, report qualities, formatting. 'clarity': sentences, jargon alternatives. 'executive_summary': exec s...

include_examplesboolean

Include before/after examples. Default: true. Set to false for smaller response.

ir_get_templateGet Lenny Zeltser's structured incident response template. Covers all critical IR sections with field-by-field guidance. Pass kind: "report" (default — full incident-response report) or "brief" (one-page executive brief, IR 1.5.0+). This server never requests your incident not...1 params

Get Lenny Zeltser's structured incident response template. Covers all critical IR sections with field-by-field guidance. Pass kind: "report" (default — full incident-response report) or "brief" (one-page executive brief, IR 1.5.0+). This server never requests your incident not...

Parameters* required

kindstring

Which artifact to return: 'report' (full incident-response report — default for backward compatibility) or 'brief' (one-page executive brief).one of report · brief

ir_get_guidelinesGet Lenny Zeltser's expert writing guidelines for incident response reports. Topics: tone, words, structure, executive_summary, voice, articles, summary, brief (one-page brief section guidance, IR 1.5.0+), frameworks (regulatory + maturity frameworks), handoffs (cross-server r...1 params

Get Lenny Zeltser's expert writing guidelines for incident response reports. Topics: tone, words, structure, executive_summary, voice, articles, summary, brief (one-page brief section guidance, IR 1.5.0+), frameworks (regulatory + maturity frameworks), handoffs (cross-server r...

Parameters* required

topicstring

Specific topic: tone (collaborative framing), words (clarity, jargon), structure (paragraphs, headings), executive_summary (exec summary rules), voice (style guidelines), articles (related reading)...one of tone · words · structure · executive_summary · voice · articles

ir_load_contextLoad Lenny Zeltser's IR report writing context for local analysis. Returns expert guidelines for field completeness, incident identification, notification triggers, and writing quality. Includes rating-sheet items (lens taxonomy plus the IR-specific Information sheet) as concr...4 params

Load Lenny Zeltser's IR report writing context for local analysis. Returns expert guidelines for field completeness, incident identification, notification triggers, and writing quality. Includes rating-sheet items (lens taxonomy plus the IR-specific Information sheet) as concr...

Parameters* required

detail_levelstring

Level of detail to return. 'minimal': core field guidance only (~2k tokens). 'standard': field guidance + writing analysis + notifications (~5k tokens, default). 'comprehensive': everything includi...one of minimal · standard · comprehensive

incident_typestring

Load guidance for a specific incident type only (saves tokens). Omit to load all types when 'incidents' topic is included.one of ransomware · bec · data_breach · insider_threat · supply_chain

include_examplesboolean

Include good/poor examples in field guidance. Default: false. Set to true for learning/training.

topicsarray

Specific topics to load. Overrides detail_level for fine-grained control. Options: completeness (field guidance), incidents (type identification), notifications (regulatory triggers), writing (styl...

ir_review_reportGet Lenny Zeltser's expert criteria for reviewing an existing IR report. Returns focused guidance for constructive critique — what to check in each section, writing quality issues to identify, and how to frame feedback collaboratively. Includes rating-sheet items (lens taxonom...2 params

Get Lenny Zeltser's expert criteria for reviewing an existing IR report. Returns focused guidance for constructive critique — what to check in each section, writing quality issues to identify, and how to frame feedback collaboratively. Includes rating-sheet items (lens taxonom...

Parameters* required

focusarray

What aspects to focus on. 'completeness': is everything covered? 'clarity': jargon, passive voice, vague terms. 'tone': collaborative framing. 'structure': sentence/paragraph organization.

sectionsarray

Specific sections to get review criteria for. Omit or use 'all' for complete review criteria.

product_get_templateGet Lenny Zeltser's fill-in-the-blank template for planning a security product strategy. Includes strategic questions organized by section with evidence columns. This server never requests your product plans and instructs your AI to keep them local—guidelines flow to your AI f...

Get Lenny Zeltser's fill-in-the-blank template for planning a security product strategy. Includes strategic questions organized by section with evidence columns. This server never requests your product plans and instructs your AI to keep them local—guidelines flow to your AI f...

No parameters. Call it with no arguments.

product_get_guidelinesGet Lenny Zeltser's expert strategic guidelines for a specific product strategy topic. Topics: market (segmentation), capabilities (AI, agents, MVP, positioning), sales (GTM, channels, distribution, POCs), pricing (models, retention), delivery (deployment, APIs), trust (compli...1 params

Get Lenny Zeltser's expert strategic guidelines for a specific product strategy topic. Topics: market (segmentation), capabilities (AI, agents, MVP, positioning), sales (GTM, channels, distribution, POCs), pricing (models, retention), delivery (deployment, APIs), trust (compli...

Parameters* required

topicstring

Specific topic to get guidelines for. Omit or use 'all' for a complete overview.one of market · capabilities · sales · pricing · delivery · trust

product_load_contextLoad Lenny Zeltser's product strategy context for local analysis. Returns expert strategic frameworks, principles, and guidance for evaluating or creating security product plans. Includes rating-sheet items (the lens taxonomy: structure, words, tone) as concrete reference poin...9 params

Load Lenny Zeltser's product strategy context for local analysis. Returns expert strategic frameworks, principles, and guidance for evaluating or creating security product plans. Includes rating-sheet items (the lens taxonomy: structure, words, tone) as concrete reference poin...

Parameters* required

analysis_modestring

'internal': planning your own product (default). 'external': evaluating another company from outside. External mode reframes questions and adjusts evidence standards.one of internal · external

company_contextstring

Filter guidance to startup or large company perspective. Stage values (pre_seed, seed, series_a, series_b, growth, late_stage) imply startup context with stage-specific emphasis.one of startup · large_company · pre_seed · seed · series_a · series_b

detail_levelstring

Level of detail to return. "minimal": market + capabilities only (~2k tokens). "standard": core strategy sections (~5k tokens, default). "compact": all sections with stripped subsections (~3-4k tok...one of minimal · standard · compact · comprehensive

evaluation_perspectivestring

Emphasize framework sections relevant to a specific perspective. Composes with analysis_mode.one of builder · analyst · investor · buyer

include_examplesboolean

Include examples in framework sections. Default: false.

include_templateboolean

Include the fill-in-the-blank strategy template at the end of the context response. Default: false. Saves a separate product_get_template call.

market_segmentstring

Include SMB-specific guidance (distribution, buying triggers, readiness).one of smb

product_focusstring

Include vertical-specific guidance. 'endpoint': platform entrapment, defensibility. 'ai_security': AI threat landscape, buyer personas, regulatory alignment.one of endpoint · ai_security

topicsarray

Specific topics to include. Overrides detail_level for fine-grained control.

product_review_planGet Lenny Zeltser's expert criteria for reviewing an existing product strategy plan. Returns focused guidance for constructive critique—what to check in each section, strategic coherence issues, and how to frame feedback collaboratively. Includes rating-sheet items (the lens t...5 params

Get Lenny Zeltser's expert criteria for reviewing an existing product strategy plan. Returns focused guidance for constructive critique—what to check in each section, strategic coherence issues, and how to frame feedback collaboratively. Includes rating-sheet items (the lens t...

Parameters* required

focusarray

What aspects to focus on. 'completeness': is everything covered? 'strategy': are decisions coherent? 'feasibility': can this team execute?

market_segmentstring

Include SMB-specific review criteria.one of smb

product_focusstring

Include vertical-specific review criteria. 'endpoint': endpoint viability. 'ai_security': AI security market assessment.one of endpoint · ai_security

review_typestring

'internal': reviewing your own plan (default). 'external-analysis': reviewing an analysis of another company. Adjusts criteria to focus on evidence tiering, source attribution, and marketing language.one of internal · external-analysis

sectionsarray

Specific sections to get review criteria for. Omit or use 'all' for complete review criteria.

product_compare_contextLoad Lenny Zeltser's comparative analysis framework for evaluating multiple security companies side by side. Returns structured scoring rubric, evaluation dimensions, evidence tiering guidance, and comparison-type-specific instructions. Requires comparative analysis content. T...3 params

Load Lenny Zeltser's comparative analysis framework for evaluating multiple security companies side by side. Returns structured scoring rubric, evaluation dimensions, evidence tiering guidance, and comparison-type-specific instructions. Requires comparative analysis content. T...

Parameters* required

company_count*integer

Number of companies being compared (2-10).

comparison_type*string

Type of comparison. 'competition': direct/adjacent competitors. 'market_segment': companies in same segment. 'portfolio': cohort evaluation.one of competition · market_segment · portfolio

include_scoring_rubricboolean

Include the structured 1-5 scoring rubric. Default: true.

rating_get_sheetGet Lenny Zeltser's cybersecurity-writing rating sheet(s) so your AI can apply the rubric. Returns the structured rubric (groups, items, scoring bands) WITHOUT computing a score. Use `rating_score_writing` if you also want a numeric score, gap analysis, or rubric-anchored feed...1 params

Get Lenny Zeltser's cybersecurity-writing rating sheet(s) so your AI can apply the rubric. Returns the structured rubric (groups, items, scoring bands) WITHOUT computing a score. Use `rating_score_writing` if you also want a numeric score, gap analysis, or rubric-anchored feed...

Parameters* required

sheetstring

Which sheet to return. 'structure' / 'look' / 'words' / 'tone' apply to any document. 'info-ir' / 'info-assessment' / 'info-threat' are document-type-specific. 'all' returns the full bundle (default).one of structure · look · words · tone · info-ir · info-assessment

rating_score_writingGet Lenny Zeltser's scoring playbook so your AI can score a draft locally against a cybersecurity-writing rating sheet. THIS IS THE ONLY TOOL THAT PRODUCES NUMERIC SCORES — the writing-coach tools (`get_security_writing_guidelines`, `ir_*`, `product_*`) never score. Returns th...3 params

Get Lenny Zeltser's scoring playbook so your AI can score a draft locally against a cybersecurity-writing rating sheet. THIS IS THE ONLY TOOL THAT PRODUCES NUMERIC SCORES — the writing-coach tools (`get_security_writing_guidelines`, `ir_*`, `product_*`) never score. Returns th...

Parameters* required

detail_levelstring

minimal: scoring playbook only. standard: rubric + scoring playbook (default). comprehensive: rubric + scoring playbook + cross-references to writing guidelines + related articles.one of minimal · standard · comprehensive

modestring

score: per-item pass/fail + total + band classification (default). gaps: enumerate items the draft does NOT satisfy (best fit for Information sheets). feedback: per-item pass/fail + total + band, t...one of score · gaps · feedback

sheet*string

Which sheet to apply. The 7 canonical IDs name a specific rubric. 'auto' picks among the three Information sheets (info-ir / info-assessment / info-threat) based on the document type the user descr...one of structure · look · words · tone · info-ir · info-assessment

rating_load_contextLoad Lenny Zeltser's complete cybersecurity-writing rating toolkit: all 7 sheets, scoring policy, scoring playbook, and cross-references to the writing guidelines. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructio...1 params

Load Lenny Zeltser's complete cybersecurity-writing rating toolkit: all 7 sheets, scoring policy, scoring playbook, and cross-references to the writing guidelines. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructio...

Parameters* required

detail_levelstring

minimal: sheet metadata + scoring playbook only (~2k tokens). standard: full sheets + scoring playbook + cross-references (~6k tokens, default). comprehensive: everything including related articles...one of minimal · standard · comprehensive

aidefense_load_contextLoad Lenny Zeltser's AI Defense Matrix context: the 8-asset x 6-NIST-CSF-2.0-function matrix, nine cross-walked frameworks (NIST IR 8596, CSA AICM, ISO 42001, Google SAIF, SANS Critical AI Security Guidelines, MITRE ATLAS, OWASP AI Exchange, OWASP LLM Top 10, OWASP Agentic Top...2 params

Load Lenny Zeltser's AI Defense Matrix context: the 8-asset x 6-NIST-CSF-2.0-function matrix, nine cross-walked frameworks (NIST IR 8596, CSA AICM, ISO 42001, Google SAIF, SANS Critical AI Security Guidelines, MITRE ATLAS, OWASP AI Exchange, OWASP LLM Top 10, OWASP Agentic Top...

Parameters* required

detail_levelstring

minimal: matrix summary counts only, no playbooks or framework rows. standard: full matrix, framework alignments, and the selected playbook(s) (default). comprehensive: everything including related...one of minimal · standard · comprehensive

purposestring

evaluate_program: practitioner playbook for assessing an AI security program. cross_map_product: vendor playbook for mapping product capabilities to matrix cells. general: both playbooks (default).one of evaluate_program · cross_map_product · general

aidefense_get_matrixGet the structured AI Defense Matrix: 8 AI-specific asset rows x 6 NIST CSF 2.0 function columns. Each cell describes a control category for defending that asset class. Supports optional filtering by asset or function. This server never requests your program docs or product ro...3 params

Get the structured AI Defense Matrix: 8 AI-specific asset rows x 6 NIST CSF 2.0 function columns. Each cell describes a control category for defending that asset class. Supports optional filtering by asset or function. This server never requests your program docs or product ro...

Parameters* required

assetstring

Optional: filter to one asset class (e.g., 'ai-model', 'training-data'). Returns the 6 cells for that row.one of ai-workload-platforms · ai-coding-orchestration-tools · ai-generated-code · ai-traffic · ai-model · training-data

formatstring

structured: typed JSON of assets, functions, and cells (default). markdown: human-readable rendering grouped by asset.one of structured · markdown

functionstring

Optional: filter to one NIST CSF function ('govern', 'identify', 'protect', 'detect', 'respond', 'recover'). Returns the 8 cells for that column.one of govern · identify · protect · detect · respond · recover

aidefense_get_framework_alignmentGet AI Defense Matrix cross-mappings to nine external frameworks: NIST IR 8596, CSA AI Controls Matrix, ISO 42001, Google SAIF, SANS Critical AI Security Guidelines, MITRE ATLAS, OWASP AI Exchange, OWASP LLM Top 10, OWASP Agentic Security Top 10. Each row maps an AI asset clas...2 params

Get AI Defense Matrix cross-mappings to nine external frameworks: NIST IR 8596, CSA AI Controls Matrix, ISO 42001, Google SAIF, SANS Critical AI Security Guidelines, MITRE ATLAS, OWASP AI Exchange, OWASP LLM Top 10, OWASP Agentic Security Top 10. Each row maps an AI asset clas...

Parameters* required

buyerstring

Optional: scope to a buyer archetype's framework subset. federal: NIST IR 8596 + ISO 42001. ai-governance: ISO 42001 + CSA AICM. app-security: OWASP LLM Top 10 + OWASP AI Exchange. threat-modeler:...one of federal · ai-governance · app-security · threat-modeler · enterprise

frameworkstring

Optional: scope to one framework slug (e.g., 'mitre-atlas', 'owasp-llm-top10'). Omit to get all nine. Wins over 'buyer' if both are passed.one of nist-ir-8596 · csa-aicm · iso-42001 · google-saif · sans-caisg · mitre-atlas

aidefense_evaluate_programGet the AI Defense Matrix evaluation playbook for assessing an AI security program: per-cell prompts, gap-inventory template, and a workflow that walks each asset class first and rolls findings up to the Govern column. Supports mode='gate' for binary deployment-gate decisions...6 params

Get the AI Defense Matrix evaluation playbook for assessing an AI security program: per-cell prompts, gap-inventory template, and a workflow that walks each asset class first and rolls findings up to the Govern column. Supports mode='gate' for binary deployment-gate decisions...

Parameters* required

assetstring

Optional: focus the prompts on one asset class.one of ai-workload-platforms · ai-coding-orchestration-tools · ai-generated-code · ai-traffic · ai-model · training-data

assetsarray

Optional: focus the prompts on multiple asset classes (e.g., for a deployment that touches orchestration + runtime data + agent identities). Takes precedence over `asset` if both are set.

consumer_patternstring

consumed: organization consumes a third-party model (GPT-4 via API) — drops AI-Workload Platforms, Training Data, AI-Generated Code rows, and AI Model identify/protect/detect/respond/recover (keeps...one of consumed · built · hybrid

frameworkstring

Optional: scope cellPrompts to those whose 'sources' field cites the named framework. Accepts a bare slug ('iso-42001') for any prompt citing that framework, or a 'framework:concept-id' form ('mitr...

functionstring

Optional: focus the prompts on one NIST CSF function.one of govern · identify · protect · detect · respond · recover

modestring

assessment (default): full program assessment — all maturity tiers. gate: binary deployment-gate decision — returns the deploymentGateWorkflow plus only gate-tier prompts (drops 90-day and mature p...one of assessment · gate

aidefense_cross_mapGet the AI Defense Matrix cross-mapping playbook for mapping product capabilities to matrix cells: coverage taxonomy (primary, secondary, partial, aspirational), differentiation guidance, disambiguation block, worked examples, and out-of-scope examples. The response always inc...4 params

Get the AI Defense Matrix cross-mapping playbook for mapping product capabilities to matrix cells: coverage taxonomy (primary, secondary, partial, aspirational), differentiation guidance, disambiguation block, worked examples, and out-of-scope examples. The response always inc...

Parameters* required

frameworkstring

Optional: include only one external framework's cross-mapping (e.g., 'owasp-llm-top10') alongside the playbook.one of nist-ir-8596 · csa-aicm · iso-42001 · google-saif · sans-caisg · mitre-atlas

include_framework_alignmentboolean

Optional: when false, the framework alignment block (~half the response) is omitted in favor of a short note pointing to aidefense_get_framework_alignment. Use when the caller will fetch alignment...

include_process_shapedboolean

Optional: when true with whitespace, lift the coverageType filter so process and cdm-rollup cells with at most one cataloged product appear too. Use when you want to see all sparse cells regardless...

whitespaceboolean

Optional: when true, surface a `whitespace.sparseCells` block scoped to cells with at most one product in the AI Defense Matrix Catalog where a product can plausibly succeed (vendorDensity <= 1 AND...

aidefense_locate_conceptReverse-lookup a single concept ID (MITRE ATLAS technique like 'AML.T0051', OWASP LLM Top 10 risk like 'LLM01', OWASP Agentic Top 10 issue like 'ASI03', or ISO 42001 Annex A clause like 'A.6') across the AI Defense Matrix. Returns which framework the concept belongs to, the as...1 params

Reverse-lookup a single concept ID (MITRE ATLAS technique like 'AML.T0051', OWASP LLM Top 10 risk like 'LLM01', OWASP Agentic Top 10 issue like 'ASI03', or ISO 42001 Annex A clause like 'A.6') across the AI Defense Matrix. Returns which framework the concept belongs to, the as...

Parameters* required

concept*string

A single concept ID. Recognized patterns: 'AML.T<4 digits>(.<3 digits>)?' (MITRE ATLAS), 'LLM<2 digits>' (OWASP LLM Top 10), 'ASI<2 digits>' (OWASP Agentic Top 10), 'A.<digits>' (ISO 42001 Annex A...

ir_get_brief_templateGet Lenny Zeltser's IR one-page executive brief template. Standalone variant of `ir_get_template` for callers that only want the brief without the long-form report. This server never requests your incident notes and instructs your AI to keep them local—guidelines flow to your...

Get Lenny Zeltser's IR one-page executive brief template. Standalone variant of `ir_get_template` for callers that only want the brief without the long-form report. This server never requests your incident notes and instructs your AI to keep them local—guidelines flow to your...

No parameters. Call it with no arguments.

ir_get_cross_server_routesGet Lenny Zeltser's IR cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `ir_load_context`. This server never requests your incident notes and instructs your AI t...

Get Lenny Zeltser's IR cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `ir_load_context`. This server never requests your incident notes and instructs your AI t...

No parameters. Call it with no arguments.

ir_get_frameworksGet Lenny Zeltser's IR frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests your incident no...1 params

Get Lenny Zeltser's IR frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests your incident no...

Parameters* required

include_siblingsboolean

Include the siblingFrames block (adjacent frameworks with whyOmitted notes) and the siblingArtifacts block (related templates) in the response. Default: true.

cti_get_templateGet Lenny Zeltser's cyber threat intel template. The long report covers Executive Summary, Actor Snapshot, Methodology, Activity Overview, Representative Adversary Techniques, Indicators of Compromise, Defensive Implications, Attribution Analysis, Anticipated Activity, optiona...1 params

Get Lenny Zeltser's cyber threat intel template. The long report covers Executive Summary, Actor Snapshot, Methodology, Activity Overview, Representative Adversary Techniques, Indicators of Compromise, Defensive Implications, Attribution Analysis, Anticipated Activity, optiona...

Parameters* required

templatestring

Which artifact to return: 'report' (12-section long report, default) or 'brief' (one-page executive brief).one of report · brief

cti_get_guidelinesGet Lenny Zeltser's expert CTI writing guidelines. Topics include tone, words, structure, executive_summary, voice, articles, summary, brief (one-page brief section guidance), handoffs (cross-server routing), methodology (the three subsections), fields (per-field guidance), an...2 params

Get Lenny Zeltser's expert CTI writing guidelines. Topics include tone, words, structure, executive_summary, voice, articles, summary, brief (one-page brief section guidance), handoffs (cross-server routing), methodology (the three subsections), fields (per-field guidance), an...

Parameters* required

field_idstring

Only meaningful with topic='fields'. When supplied, returns guidance for the named field id. When omitted under topic='fields', returns a directory of available field ids.

topicstring

Which topic to surface. Defaults to a 'summary' overview when omitted.one of tone · words · structure · executive_summary · voice · articles

cti_load_contextLoad Lenny Zeltser's CTI writing context for local analysis. Returns a JSON payload with section guidance, completeness criteria, framework grounding (12 frameworks), the six attribution signals, ICD-203 confidence levels and ladder, and the Pyramid of Pain. The 'profile' para...5 params

Load Lenny Zeltser's CTI writing context for local analysis. Returns a JSON payload with section guidance, completeness criteria, framework grounding (12 frameworks), the six attribution signals, ICD-203 confidence levels and ladder, and the Pyramid of Pain. The 'profile' para...

Parameters* required

detail_levelstring

Response size: minimal (~2-3k tokens), standard (~5-7k), comprehensive (~12k+).one of minimal · standard · comprehensive

include_examplesboolean

Include exampleGood/examplePoor in fieldGuidance entries.

profilestring

Annotate sections by their applicability to this profile (internal or public). Sections are NOT filtered — annotated only.one of internal · public

templatestring

Foreground 'report' or 'brief' sections; both lists stay in the payload.one of report · brief

topicsarray

Narrow the response to specific topics; 'all' includes everything.

cti_review_reportGet Lenny Zeltser's expert criteria for reviewing an existing CTI report or brief. Surfaces per-theme review criteria (framework, confidence, attribution, defense, distribution, etc.), cross-cutting criteria, the six anti-patterns to watch for, and focus-driven writing analysi...2 params

Get Lenny Zeltser's expert criteria for reviewing an existing CTI report or brief. Surfaces per-theme review criteria (framework, confidence, attribution, defense, distribution, etc.), cross-cutting criteria, the six anti-patterns to watch for, and focus-driven writing analysi...

Parameters* required

focusarray

Focus areas: completeness, clarity, tone, structure, attribution, confidence, or all.

sectionsarray

Narrow to specific report sections; 'all' includes every section.

cti_get_brief_templateGet Lenny Zeltser's CTI one-page executive brief template. Standalone variant of `cti_get_template` for callers that only want the brief without the long-form report. This server never requests your campaign or threat-intel notes and instructs your AI to keep them local—templa...

Get Lenny Zeltser's CTI one-page executive brief template. Standalone variant of `cti_get_template` for callers that only want the brief without the long-form report. This server never requests your campaign or threat-intel notes and instructs your AI to keep them local—templa...

No parameters. Call it with no arguments.

cti_get_cross_server_routesGet Lenny Zeltser's CTI cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `cti_load_context`. This server never requests your campaign or threat-intel notes and i...

Get Lenny Zeltser's CTI cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `cti_load_context`. This server never requests your campaign or threat-intel notes and i...

No parameters. Call it with no arguments.

cti_get_frameworksGet Lenny Zeltser's CTI frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests your campaign o...1 params

Get Lenny Zeltser's CTI frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests your campaign o...

Parameters* required

include_siblingsboolean

Include the siblingFrames block (adjacent frameworks with whyOmitted notes) and the siblingArtifacts block (related templates) in the response. Default: true.

malware_get_templateGet Lenny Zeltser's malware analysis report template. The report covers Executive Summary, Sample Snapshot, Malware Family Identification, Component Inventory, Runtime Requirements, Sources, Capabilities, Indicators of Compromise, Analysis Details, What We Don't Know, optional...

Get Lenny Zeltser's malware analysis report template. The report covers Executive Summary, Sample Snapshot, Malware Family Identification, Component Inventory, Runtime Requirements, Sources, Capabilities, Indicators of Compromise, Analysis Details, What We Don't Know, optional...

No parameters. Call it with no arguments.

malware_get_guidelinesGet Lenny Zeltser's expert malware analysis report writing guidelines. Topics include capabilities, confidence, pyramid_of_pain, anti_patterns, methodology, fields, handoffs, frameworks, plus tone, words, structure, and executive_summary topics that defer to `get_security_writ...2 params

Get Lenny Zeltser's expert malware analysis report writing guidelines. Topics include capabilities, confidence, pyramid_of_pain, anti_patterns, methodology, fields, handoffs, frameworks, plus tone, words, structure, and executive_summary topics that defer to `get_security_writ...

Parameters* required

field_idstring

Only meaningful with topic='fields'. When supplied, returns guidance for the named field id. When omitted under topic='fields', returns a directory of available field ids.

topicstring

Which topic to surface. Defaults to a 'summary' overview when omitted.one of tone · words · structure · executive_summary · voice · articles

malware_load_contextLoad Lenny Zeltser's malware analysis report writing context for local analysis. Returns a JSON payload with section guidance, the MBC capability model, ICD-203 confidence scoped to the family call, Pyramid-of-Pain IOC tiering, and a briefPolicy explaining why there is no comp...4 params

Load Lenny Zeltser's malware analysis report writing context for local analysis. Returns a JSON payload with section guidance, the MBC capability model, ICD-203 confidence scoped to the family call, Pyramid-of-Pain IOC tiering, and a briefPolicy explaining why there is no comp...

Parameters* required

detail_levelstring

Response size: minimal, standard, or comprehensive.one of minimal · standard · comprehensive

include_examplesboolean

Include exampleGood/examplePoor in fieldGuidance entries.

profilestring

Annotate sections by their applicability to this profile. Sections are NOT filtered — annotated only.one of organizationalReport · researcherNarrative

topicsarray

Narrow the response to specific topics; 'all' includes everything.

malware_review_reportGet Lenny Zeltser's expert criteria for reviewing an existing malware analysis report. Surfaces per-theme review criteria for identification, capabilities, indicators, evidence, ecosystem, detection, reproducibility, and distribution; cross-cutting criteria; anti-patterns; and...2 params

Get Lenny Zeltser's expert criteria for reviewing an existing malware analysis report. Surfaces per-theme review criteria for identification, capabilities, indicators, evidence, ecosystem, detection, reproducibility, and distribution; cross-cutting criteria; anti-patterns; and...

Parameters* required

focusarray

Focus areas: completeness, clarity, tone, structure, capabilities, confidence, anti_patterns, or all.

sectionsarray

Narrow to specific report sections; 'all' includes every section.

malware_get_cross_server_routesGet Lenny Zeltser's Malware cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `malware_load_context`. This server never requests your sample, analysis notes, or i...

Get Lenny Zeltser's Malware cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `malware_load_context`. This server never requests your sample, analysis notes, or i...

No parameters. Call it with no arguments.

malware_get_frameworksGet Lenny Zeltser's Malware frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests your sample...1 params

Get Lenny Zeltser's Malware frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests your sample...

Parameters* required

include_siblingsboolean

Include the siblingFrames block (adjacent frameworks with whyOmitted notes) and the siblingArtifacts block (related templates) in the response. Default: true.

vuln_get_templateGet Lenny Zeltser's one-page Vulnerability Advisory Brief template. Covers Bottom Line, Quick Facts, Are We Affected?, Defensive Actions (with What/Why/When/Who), What We Don't Know, and More Information. This server never requests your vulnerability notes and instructs your A...

Get Lenny Zeltser's one-page Vulnerability Advisory Brief template. Covers Bottom Line, Quick Facts, Are We Affected?, Defensive Actions (with What/Why/When/Who), What We Don't Know, and More Information. This server never requests your vulnerability notes and instructs your A...

No parameters. Call it with no arguments.

vuln_get_guidelinesGet Lenny Zeltser's expert vulnerability-brief writing guidelines. Topics include tone, words, structure, voice, articles, summary, fields (per-field guidance), handoffs (cross-server routing), and vuln-specific topics: significance (calibrated insecurity, no vendor passthroug...2 params

Get Lenny Zeltser's expert vulnerability-brief writing guidelines. Topics include tone, words, structure, voice, articles, summary, fields (per-field guidance), handoffs (cross-server routing), and vuln-specific topics: significance (calibrated insecurity, no vendor passthroug...

Parameters* required

field_idstring

Only meaningful with topic='fields'. When supplied, returns guidance for the named field id. When omitted under topic='fields', returns a directory of available field ids.

topicstring

Which topic to surface. Defaults to a 'summary' overview when omitted.one of tone · words · structure · voice · articles · summary

vuln_load_contextLoad Lenny Zeltser's Vulnerability Investigation Brief context for local analysis. Returns a JSON payload with brief section guidance, completeness criteria, significance discipline (renamed from 'severity' in 1.1.0 — the Vuln Brief's Significance row, distinct from CVSS or ve...3 params

Load Lenny Zeltser's Vulnerability Investigation Brief context for local analysis. Returns a JSON payload with brief section guidance, completeness criteria, significance discipline (renamed from 'severity' in 1.1.0 — the Vuln Brief's Significance row, distinct from CVSS or ve...

Parameters* required

detail_levelstring

Response size: minimal, standard, or comprehensive.one of minimal · standard · comprehensive

include_examplesboolean

Include exampleGood/examplePoor in fieldGuidance entries.

topicsarray

Narrow the response to specific topics; 'all' includes everything.

vuln_review_briefGet Lenny Zeltser's expert criteria for reviewing an existing Vulnerability Investigation Brief. Surfaces per-theme review criteria (significance, scope, actions, gaps, sources), cross-cutting criteria, anti-patterns, and inline mcpHandoffs pointers when the requested focus tr...2 params

Get Lenny Zeltser's expert criteria for reviewing an existing Vulnerability Investigation Brief. Surfaces per-theme review criteria (significance, scope, actions, gaps, sources), cross-cutting criteria, anti-patterns, and inline mcpHandoffs pointers when the requested focus tr...

Parameters* required

focusarray

Focus areas: completeness, clarity, tone, structure, significance, actions, sources, or all.

sectionsarray

Narrow to specific brief sections; 'all' includes every section.

vuln_get_brief_templateGet Lenny Zeltser's Vuln one-page executive brief template. Standalone variant of `vuln_get_template` for callers that only want the brief without the long-form report. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief templ...

Get Lenny Zeltser's Vuln one-page executive brief template. Standalone variant of `vuln_get_template` for callers that only want the brief without the long-form report. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief templ...

No parameters. Call it with no arguments.

vuln_get_cross_server_routesGet Lenny Zeltser's Vuln cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `vuln_load_context`. This server never requests your vulnerability notes and instructs...

Get Lenny Zeltser's Vuln cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `vuln_load_context`. This server never requests your vulnerability notes and instructs...

No parameters. Call it with no arguments.

vuln_get_frameworksGet Lenny Zeltser's Vuln frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests your vulnerabi...1 params

Get Lenny Zeltser's Vuln frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests your vulnerabi...

Parameters* required

include_siblingsboolean

Include the siblingFrames block (adjacent frameworks with whyOmitted notes) and the siblingArtifacts block (related templates) in the response. Default: true.

assessment_get_templateGet Lenny Zeltser's security assessment template. The report is a reader-first findings report: Executive Summary, Assessment Scope, Findings Summary, Detailed Findings, Remediation Priorities, optional Attack Path Narrative and Detection and Response Observations, Methodology...1 params

Get Lenny Zeltser's security assessment template. The report is a reader-first findings report: Executive Summary, Assessment Scope, Findings Summary, Detailed Findings, Remediation Priorities, optional Attack Path Narrative and Detection and Response Observations, Methodology...

Parameters* required

kindstring

Which artifact to return: 'report' (full findings report, default) or 'brief' (one-page executive brief).one of report · brief

assessment_get_guidelinesGet Lenny Zeltser's expert security assessment report writing guidelines. Topics: severity (the risk-adjusted severity model — the spine), findings, remediation, methodology, scope, strengths, brief (one-page brief section guidance), executive_summary, analysis, anti_patterns,...1 params

Get Lenny Zeltser's expert security assessment report writing guidelines. Topics: severity (the risk-adjusted severity model — the spine), findings, remediation, methodology, scope, strengths, brief (one-page brief section guidance), executive_summary, analysis, anti_patterns,...

Parameters* required

topicstring

Which topic to surface. Defaults to a 'summary' overview when omitted.one of tone · executive_summary · severity · findings · remediation · methodology

assessment_load_contextLoad Lenny Zeltser's security assessment report writing context for local analysis. Returns a JSON payload with the risk-adjusted severity model (the spine), reader-first section guidance, completeness criteria, frameworks (NIST SP 800-115/800-30, OWASP WSTG/Risk Rating, CVSS,...5 params

Load Lenny Zeltser's security assessment report writing context for local analysis. Returns a JSON payload with the risk-adjusted severity model (the spine), reader-first section guidance, completeness criteria, frameworks (NIST SP 800-115/800-30, OWASP WSTG/Risk Rating, CVSS,...

Parameters* required

detail_levelstring

Response size: minimal, standard, or comprehensive.one of minimal · standard · comprehensive

include_examplesboolean

Include exampleGood/examplePoor in fieldGuidance entries.

profilestring

Annotate sections by applicability to this profile (internal or external). Sections are NOT filtered — annotated only.one of internal · external

templatestring

Foreground 'report' or 'brief' sections; both lists stay in the payload.one of report · brief

topicsarray

Narrow the response to specific topics; 'all' includes everything.

assessment_review_reportGet Lenny Zeltser's expert criteria for reviewing an existing security assessment report or brief. Surfaces the 17 info-assessment review items across five groups (Key Takeaways, Assessment Scope, Prioritized Findings, Remediation Suggestions, Assessment Methodology), cross-cu...2 params

Get Lenny Zeltser's expert criteria for reviewing an existing security assessment report or brief. Surfaces the 17 info-assessment review items across five groups (Key Takeaways, Assessment Scope, Prioritized Findings, Remediation Suggestions, Assessment Methodology), cross-cu...

Parameters* required

focusarray

Focus areas: completeness, clarity, tone, structure, severity, remediation, strengths, anti_patterns, or all.

sectionsarray

Narrow to specific report sections; 'all' includes every section.

assessment_get_brief_templateGet Lenny Zeltser's Security Assessment one-page executive brief template. Standalone variant of `assessment_get_template` for callers that only want the brief without the long-form report. This server never requests your assessment notes or report and instructs your AI to kee...

Get Lenny Zeltser's Security Assessment one-page executive brief template. Standalone variant of `assessment_get_template` for callers that only want the brief without the long-form report. This server never requests your assessment notes or report and instructs your AI to kee...

No parameters. Call it with no arguments.

assessment_get_cross_server_routesGet Lenny Zeltser's Security Assessment cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `assessment_load_context`. This server never requests your assessment no...

Get Lenny Zeltser's Security Assessment cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `assessment_load_context`. This server never requests your assessment no...

No parameters. Call it with no arguments.

assessment_get_frameworksGet Lenny Zeltser's Security Assessment frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests...1 params

Get Lenny Zeltser's Security Assessment frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests...

Parameters* required

include_siblingsboolean

Include the siblingFrames block (adjacent frameworks with whyOmitted notes) and the siblingArtifacts block (related templates) in the response. Default: true.

Readme

Details

Repository: github.com/lennyzeltser/zeltser-website-mcp-server
Website: zeltser.com/good-ir-reports-with-ai
Categories: Search & Web Crawling, Security & Pentesting
Transport: HTTP
Registry: MCP registry, active
Tools verified: Nov 6, 2026

Related Search & Web Crawling MCP servers

View all

Memory Search Mcpcsoai-org/memory-search-mcpMemory Search MCP Server by MEOK AI Labs0stars

Extractswwyymm/averra-extract-mcpURL-to-Markdown API for AI pipelines — clean markdown with metadata and caching.0stars

Search Routerio.github.ainode-tech/search-router4 web-search tiers (x402 USDC on Base) - simple/medium/deep/cached. Free health.0stars

OCR Text Extraction APIbr0ski777/ocr-extract-x402Extract text from images using OCR. Tesseract-powered. x402 micropayment.0stars

Vector Search APIbr0ski777/vector-search-x402In-memory vector search with TF-IDF and cosine similarity. x402 micropayment.0stars

Web Search APIbr0ski777/web-search-x402Web search returning structured results — titles, URLs, snippets. x402 micropayment.0stars