nlink-jp

pcap/pcapng analysis as an MCP server — a digest-pinned tshark runs in a network-less Podman container with the capture mounted read-only, so an agent narrows a

Threat context from Google Threat Intelligence (CLI + MCP) — the collections an indicator belongs to, a sample’s sandbox behaviour, corpus-wide IOC search in GT

Context for a CVE from EchelonGraph’s CVE Pulse API (CLI + MCP) — CVSS, CISA KEV, EPSS, SSVC, exploit and patch signals, product matching, vendor advisories and

Read-only lookups against your own OpenCTI instance (CLI + MCP) — IOCs through observables and indicators with sightings and decay, threat actors and techniques