Cherry Studio MCP Client

[giscus[bot]]

Cherry Studio MCP Client

🍒 Cherry Studio is a desktop client that supports for multiple LLM providers.

https://chat.mcp.so/client/cherry-studio/CherryHQ?tab=comments

[traumasmart29-commits]

Snow Rider offers the perfect blend of accessibility and intense challenge. Whether you are navigating the steady build of the Normal Level or the frantic pace of the Hard Level, the mountain is waiting snowrider 2

[AdamWaldie]

OPTIX MCP Tools
Endpoint: https://optixthreatintelligence.co.uk/mcp
Authentication: Include your OPTIX API key as the X-API-Key header on every request.

Intelligence Feed
get_threat_feed
Browse the OPTIX threat intelligence feed — a curated, scored stream of intelligence documents from all your configured sources. Each entry includes severity, TLP, IOC count, publisher, and an AI summary.

Parameter Type Default Description
limit integer 20 Number of results (1–100)
offset integer 0 Skip N results for pagination
severity_filter string — critical · high · medium · low
tlp_filter string — TLP:WHITE · TLP:GREEN · TLP:AMBER · TLP:RED
since string — ISO 8601 datetime — only show documents after this time
search_documents
Full-text search across all OPTIX intelligence documents by keyword, topic, publisher, or content type.

Parameter Type Default Description
query ✱ string — Search term, e.g. LockBit, supply chain attack, CVE-2024-3400
limit integer 20 Number of results (1–100)
offset integer 0 Skip N results for pagination
publisher string — Filter by publisher, e.g. Mandiant, CISA
content_type string — ThreatResearch · MalwareAnalysis · Vulnerability · etc.
since string — ISO 8601 datetime — only show documents after this time
get_document
Fetch a specific intelligence document by its ID. Returns the full metadata, AI summary, cyber score, and content tags.

Parameter Type Default Description
document_id ✱ integer — OPTIX document ID (from feed or search results)
get_headlines
Retrieve a short AI-synthesised briefing of the most active threats from recent intelligence. Use for quick situational awareness — no parameters needed.

get_threat_cards
Profile-matched threat cards showing active actors and campaigns relevant to your organisation's sector, with MITRE ATT&CK techniques and severity assessments.

Parameter Type Default Description
time_range string 7d 24h · 7d · 30d
sector string — Filter to a specific sector, e.g. Finance, Healthcare
IOC & Indicator Analysis
search_indicator
Search OPTIX for a specific indicator of compromise by its raw value. Returns matches with confidence scores and linked reports. Use this first to find an IOC's numeric ID before calling get_ioc_context.

Parameter Type Default Description
value ✱ string — Raw IOC value, e.g. 185.220.101.45, malicious-domain.ru
type_hint string — IOC · Infrastructure · ThreatActor · MalwareFamily
get_ioc_context
Deep enrichment for a specific IOC — relationships, linked reports, and contextual tags. Requires the numeric entity ID returned by search_indicator.

Parameter Type Default Description
ioc_id ✱ integer — Numeric entity ID from search_indicator
triage_ioc
Record an analyst triage verdict on one or more IOCs. Supports bulk operations. Decisions can be scoped to your organisation or shared platform-wide.

Parameter Type Default Description
entity_ids ✱ array of integers — IOC entity IDs to triage
status ✱ string — confirmed · false_positive · benign · expired · monitoring · unresolved
scope string platform platform (global) · org (organisation only)
Entity Intelligence
get_threat_actor_profile ⭐ Recommended starting point for any actor query
Rich composite profile for a threat actor in a single call — aliases, ATT&CK techniques, IOCs, linked malware families, and the latest intelligence report summary. Alias resolution is automatic and case-insensitive.

Parameter Type Default Description
actor_name ✱ string — Actor name or alias, e.g. APT28, Fancy Bear, LockBit
list_threat_actors
Browse the full catalogue of threat actors tracked in OPTIX — names, aliases, type, confidence, and first/last seen dates.

No required parameters. Results are paginated automatically.

get_entity
Fetch any named threat intelligence entity by name, alias, or numeric ID. Works for threat actors, malware families, campaigns, CVEs, tools, and more.

Parameter Type Default Description
query ✱ string — Name or ID, e.g. APT28, CVE-2023-44487, 42
entity_type string — ThreatActor · MalwareFamily · Tool · Campaign · Vulnerability · Technique · IOC · Infrastructure · Target
Intelligence Reports
list_intelligence_reports
List AI-generated intelligence reports — tactical, strategic, operational, technical, or RFI. Filter by report type, TLP, or linked entity.

Parameter Type Default Description
limit integer 20 Number of results (1–200)
report_type string — tactical · strategic · technical · operational · rfi
tlp_level string — e.g. TLP:GREEN
entity_id integer — Filter to reports referencing this entity ID
get_intelligence_report
Retrieve the full content of a specific intelligence report by its report ID.

Parameter Type Default Description
report_id ✱ integer — Report ID from list_intelligence_reports or generate_report
generate_report — 40 credits
Generate a new intelligence report (tactical, strategic, technical, operational, or RFI) using a natural language query. OPTIX searches its document corpus and entity knowledge base to produce a structured, cited report.

Parameter Type Default Description
title ✱ string — Report title, e.g. Q3 Ransomware Threat Landscape
query ✱ string — Natural language description of what the report should cover
report_type string tactical tactical · strategic · technical · operational · rfi
tlp string TLP:GREEN TLP:WHITE · TLP:GREEN · TLP:AMBER
report_incident — 40 credits
Submit a structured incident report and generate a tactical intelligence product. Returns a reference ID.

Parameter Type Default Description
title ✱ string — Short incident title
description ✱ string — Detailed narrative including the attack chain
severity ✱ string — critical · high · medium · low
tlp string TLP:GREEN TLP:WHITE · TLP:GREEN · TLP:AMBER
indicators array of strings — Raw indicator values observed
analyst_notes string — Additional context or remediation steps
Detection & Coverage
get_attack_matrix
View your OPTIX MITRE ATT&CK coverage matrix — which techniques have been observed in intelligence data and which have existing detection rules.

Parameter Type Default Description
technique_id string — Specific technique ID, e.g. T1566. Omit for the full matrix
get_coverage_gaps
Analyse a specific intelligence document to find which MITRE ATT&CK techniques it references that currently lack detection rule coverage.

Parameter Type Default Description
document_id ✱ integer — OPTIX document ID to analyse
generate_detection_rule — 4 credits
Generate a SIEM detection rule for a specific MITRE ATT&CK technique. Optionally enriched with context from a document or entity.

Supported SIEM languages: kql · splunk_spl · s1ql_v1 · s1ql_v2 · crowdstrike · elastic_eql · exabeam · chronicle_yara_l · sigma · carbon_black · palo_alto_xql

Parameter Type Default Description
technique_id ✱ string — MITRE ATT&CK technique ID, e.g. T1059.001
language ✱ string — Target SIEM language (see above)
technique_name string — Human-readable technique name — improves generation quality
document_id integer — Incorporate context from a specific document
entity_id integer — Enrich with a specific threat actor or malware family
custom_context string — Additional analyst context, e.g. specific log sources
generate_tradecraft_query — 4 credits
Generate a broad SIEM hunt query covering the complete known tradecraft (TTPs, tools, behaviours) of a specific threat actor or malware family.

Parameter Type Default Description
language ✱ string — Target SIEM language
entity_name ✱ string — Actor or malware name, e.g. APT29, LockBit
entity_type ✱ string — ThreatActor · MalwareFamily
entity_id integer — OPTIX entity ID for structured enrichment
technique_entries array — Scope to specific techniques (each with techniqueId, techniqueName)
AI & Research
ai_search
Natural language search across OPTIX documents and entities. Use natural mode for AI-expanded queries or keyword for literal matching.

Parameter Type Default Description
query ✱ string — Question or keyword, e.g. What TTPs does APT29 use?
mode string natural natural · keyword
research_entity — 15 credits
Trigger deep AI research on an entity. OPTIX enriches the profile with structured intelligence from authoritative external sources.

Parameter Type Default Description
entity_id ✱ integer — Numeric entity ID (from get_entity)
force_refresh boolean false Force a new research run even if recent results exist
ask_entity — 4 credits
Generate a threat hunting query for a specific entity informed by its known TTPs, IOCs, and intelligence history.

Parameter Type Default Description
entity_id ✱ integer — Entity ID (ThreatActor, MalwareFamily, Tool, or Vulnerability)
language ✱ string — Target SIEM language
Watchlist
get_watchlist
List all entities currently on your watchlist. Watchlisted entities trigger notifications when new intelligence documents reference them.

No parameters.

add_to_watchlist
Add an entity to your watchlist by its numeric ID. Idempotent — safe to call if already watching.

Parameter Type Default Description
entity_id ✱ integer — Numeric entity ID to add
remove_from_watchlist
Remove an entity from your watchlist.

Parameter Type Default Description
entity_id ✱ integer — Numeric entity ID to remove
Account & Preferences
get_account_status
Check your current credit balance, monthly allocation, usage, and reset date. Call this before any credit-consuming operation if you are unsure whether you have sufficient credits.

No parameters.

save_feed_view
Save a named feed filter configuration for quick recall later.

Parameter Type Default Description
name ✱ string — Label for this view, e.g. Critical malware last 7 days
filters object {} Filter config — keys: severity, tlp, contentType, publisher, publishedAfter, publishedBefore
submit_feedback
Vote on an intelligence document to improve OPTIX scoring and feed personalisation.

Parameter Type Default Description
document_id ✱ integer — Document to vote on
vote ✱ string — up · down
scope string platform platform (all analysts) · org (your organisation only)
✱ Required parameter · All other parameters are optional