Neuromorphic Threat Intelligence MCP Server

> View on ApifyForge | Use on Apify Store

---

Quick Start

Add to your MCP client (Claude Desktop, Cursor, Windsurf):

{
  "mcpServers": {
    "neuromorphic-threat-intelligence-mcp": {
      "url": "https://ryanclinton--neuromorphic-threat-intelligence-mcp.apify.actor/mcp"
    }
  }
}

---

Neuromorphic threat intelligence for AI agents — this MCP server applies 8 brain-inspired and mathematical frameworks to cyber threat detection, pulling live data from 15 sources spanning vulnerability databases, internet scanning infrastructure, sanctions registries, social signals, and code repositories. It gives AI assistants like Claude, Cursor, and any MCP-compatible client the ability to reason about threats the way biological neural circuits do: through spiking dynamics, temporal learning, and topological structure.

Each tool call fires parallel requests across multiple intelligence feeds and then runs a rigorous algorithm — leaky integrate-and-fire spiking networks, STDP plasticity learning, hypergraph attack grammars, SIS epidemic propagation, NEAT neuroevolution, discrete Morse theory, evolutionary population games, or Le Cam statistical deficiency — returning structured JSON with an interpretable conclusion. This is not a wrapper around a single API. It is a multi-source reasoning engine with quantitative outputs and clear threat assessments.

What data can you access?

| Data Point | Source | Example coverage |
|---|---|---|
| 📋 CVE vulnerability records | NVD CVE Search | 200,000+ CVEs with CVSS scores |
| 🔥 Known exploited vulnerabilities | CISA KEV Catalog | Actively exploited in the wild |
| 🖥 Internet host scan data | Censys Search | Open ports, services, banners |
| 🌐 DNS records | DNS Lookup | A, MX, TXT, NS, CNAME records |
| 🔒 SSL/TLS certificate history | crt.sh CT Logs | Certificate transparency log |
| 📝 Domain registration data | WHOIS Lookup | Registrant, dates, nameservers |
| 📍 IP geolocation and ASN | IP Geolocation | Country, org, ASN, coordinates |
| 🛠 Website technology stack | Tech Stack Detector | CMS, frameworks, CDNs, libraries |
| 💻 Security code and PoCs | GitHub Repo Search | Public repositories |
| 💬 Security community discussions | Hacker News Search | HN threads and comments |
| 🚫 US Treasury sanctions | OFAC Sanctions Search | SDN list, blocked persons |
| 🌍 Global watchlists | OpenSanctions Search | 100+ programs, 40+ countries |
| 📡 Social threat signals | Bluesky Social Search | Real-time security community posts |
| 🕰 Historical web snapshots | Wayback Machine | Archive.org snapshots |
| 🔄 Website content changes | Website Change Monitor | Tracked page modifications |

Why use Neuromorphic Threat Intelligence MCP Server?

Manual threat correlation is the bottleneck in every security workflow. A threat analyst checking CVEs, cross-referencing CISA KEV, querying Censys, reviewing DNS history, scanning sanctions lists, and monitoring social channels for a single domain can spend four to six hours producing a picture that is already hours old by the time it is done. Statistical detection methods are often bolted on as an afterthought, producing binary red/green outputs without quantitative confidence.

This MCP server automates the entire correlation and analysis pipeline. It queries up to seven sources in parallel, normalises severity scores from heterogeneous formats (CVSS floats, "Critical/High/Medium" strings, raw scores), assembles structured threat indicators, and passes them through the selected algorithm. The result includes a plain-language interpretation alongside the full numerical output.

- Scheduling — run periodic threat sweeps daily or weekly to track how your attack surface evolves
- API access — trigger analysis from Python, JavaScript, or any HTTP client without leaving your toolchain
- Proxy rotation — upstream actors use Apify's built-in proxy infrastructure where needed
- Monitoring — get Slack or email alerts when MCP tool calls fail or return unexpected results
- Integrations — connect outputs to Zapier, Make, webhooks, or push results directly into SIEM pipelines

Features

- Leaky integrate-and-fire (LIF) spiking network — one neuron per threat source type, membrane dynamics governed by LIF equation with tau 10–20 ms decay constants, refractory periods of 2–5 ms, and synaptic delays of 1–5 steps
- Filippov differential inclusions at switching surfaces — when membrane potential sits within 0.05 of the threshold, the system applies a convex combination of sub- and super-threshold dynamics, producing a sliding mode; the count of these switching events is a direct measure of how aggressively the boundary between normal and anomalous is being probed
- STDP learning with Tracy-Widom random matrix edge — builds a temporal weight matrix from causal spike pairs across sources; potentiation for pre-before-post sequences, depression for the reverse; the Tracy-Widom edge from random matrix theory separates structured campaign signal from random noise
- Hebbian cell assembly detection — identifies clusters of threat sources whose activity is temporally coherent above a correlation threshold, surfacing the multi-source fingerprint of coordinated campaigns
- Hypergraph attack grammar with Floyd-Warshall reachability — models infrastructure as a context-free hypergraph grammar; production rules encode exploit-to-exploit transitions; derives all reachable attack paths and computes betweenness centrality on critical assets
- Barabasi-Albert scale-free contact process — simulates vulnerability propagation on preferential-attachment networks; computes basic reproduction number R0, epidemic threshold, hub infection order, and steady-state infection fraction
- NEAT neuroevolution with speciation and fitness sharing — evolves neural network topology and weights simultaneously; innovation numbers solve the competing conventions problem; speciation protects structural diversity; trained on 6-feature threat indicator vectors
- Discrete Morse theory CW complex — models infrastructure as a CW complex with 0-cells (assets), 1-cells (connections), and 2-cells (service clusters); gradient vector field pairing reduces the complex; unpaired critical cells represent topologically irreducible attack surface; outputs Euler characteristic and Betti numbers
- Population game replicator dynamics — simulates 2,000 threat actors across five strategies (Nation-State APT, Cybercrime, Hacktivism, Insider Threat, Supply Chain); payoff matrix calibrated from real sanctions and vulnerability density; computes evolutionary stable strategies and Lyapunov exponent
- Le Cam deficiency distance — measures information loss between current and enhanced monitoring configurations; computes minimax risk, Bayes risk, power function, ROC curve, and sample complexity for reliable detection
- Parallel actor orchestration — all upstream actor calls fire simultaneously via Promise.all; a 180-second timeout prevents hung runs from blocking the response
- Severity normalisation — converts CVSS floats (÷10), severity strings (Critical→0.95, High→0.80, Medium→0.50, Low→0.20), and raw numeric scores into a unified 0–1 severity scale before any algorithm runs
- Standby mode operation — runs as a persistent Express server on the Apify platform; the /mcp endpoint handles MCP protocol requests; health probe on / returns 200 immediately for container readiness checks
- Plain-language interpretations — every tool returns an interpretation string with a human-readable verdict (CRITICAL / ELEVATED / NORMAL, STRUCTURED CAMPAIGN DETECTED / NO CLEAR STRUCTURE, etc.) alongside the full numeric output

Use cases for neuromorphic threat intelligence

Security operations and SOC triage

Security analysts receiving a new indicator of compromise — a domain, an IP, a CVE — need rapid contextual enrichment. Instead of opening six browser tabs, call detect_spiking_anomalies with the target. The tool queries NVD, CISA KEV, Censys, DNS, SSL, and tech stack in parallel and runs the LIF simulation. Anomalous neuron firing patterns surface in seconds, with the network synchrony index telling you whether multiple sources are lighting up together.

Threat campaign attribution

Incident response teams trying to attribute a cluster of events to a specific threat group can use attribute_threat_campaign. Provide keywords (e.g., ["Volt Typhoon", "critical infrastructure", "living off the land"]). The STDP engine correlates temporal patterns across CVEs, KEV entries, OFAC sanctions, OpenSanctions, GitHub repos, and Hacker News. If the spectral radius of the weight matrix exceeds the Tracy-Widom edge, there is statistically significant temporal structure — a coordinated campaign fingerprint rather than coincidence.

Infrastructure attack path analysis

Red teams and security architects mapping attack paths through an environment can use analyze_attack_graph on a target domain. The hypergraph grammar builds an asset topology from Censys, DNS, SSL, WHOIS, tech stack, and IP geo data, then derives all viable attack paths with associated probabilities. The betweenness centrality output identifies which asset, if compromised, opens the most subsequent paths — exactly the prioritisation information needed for remediation planning.

Vulnerability risk quantification

Risk managers deciding which CVEs to patch first can use simulate_vulnerability_propagation to model how a specific vulnerability class propagates through a Barabasi-Albert network calibrated to real CVE severity data. The R0 value answers the key question directly: is this vulnerability in an epidemic regime or will it die out naturally? Hub infection order tells you which high-degree nodes — the most connected assets — fall first.

AI agent-driven security automation

Security teams building LLM-based agents for continuous monitoring can register this MCP server as a tool provider. Claude or any MCP-compatible agent can then call forecast_exploit_emergence on a threat domain to get detection limits, ROC curves, and sample complexity estimates — letting the agent autonomously decide whether current monitoring is sufficient or recommend a budget increase.

Detection engineering and capability assessment

Detection engineers evaluating whether their sensor coverage is adequate for a specific threat domain can run forecast_exploit_emergence. Le Cam deficiency quantifies the information loss between current and enhanced monitoring. If the detection limit exceeds the signal strength, the tool outputs the exact budget multiplier needed for reliable detection — a mathematical justification for resource requests.

How to connect this MCP server

Step 1: Get your Apify API token

Sign up at apify.com. Your API token is at console.apify.com/account/integrations.

Step 2: Add to your MCP client

Claude Desktop — add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "neuromorphic-threat-intelligence": {
      "url": "https://neuromorphic-threat-intelligence-mcp.apify.actor/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_APIFY_TOKEN"
      }
    }
  }
}

Cursor — add to .cursor/mcp.json in your project root:

{
  "mcpServers": {
    "neuromorphic-threat-intelligence": {
      "url": "https://neuromorphic-threat-intelligence-mcp.apify.actor/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_APIFY_TOKEN"
      }
    }
  }
}

Step 3: Verify the connection

Ask your AI assistant: "List the available tools from the neuromorphic threat intelligence server." It should respond with all 8 tool names and descriptions.

Step 4: Run your first analysis

Try: "Use detect_spiking_anomalies to analyze threats for the domain apache.org with default parameters." The tool will query 6 data sources in parallel and return the LIF simulation results with a plain-language interpretation.

MCP tools reference

| Tool | Algorithm | Data sources | Best for |
|---|---|---|---|
| detect_spiking_anomalies | LIF spiking network + Filippov | NVD, CISA KEV, Censys, DNS, SSL, Tech Stack | Real-time anomaly detection across threat feeds |
| attribute_threat_campaign | STDP + Tracy-Widom edge | NVD, CISA KEV, OFAC, OpenSanctions, GitHub, HN | Campaign attribution by temporal causal pattern |
| analyze_attack_graph | Hypergraph grammar + Floyd-Warshall | Censys, DNS, SSL, WHOIS, Tech Stack, IP Geo, NVD | Attack path analysis and critical asset identification |
| simulate_vulnerability_propagation | SIS contact process + Barabasi-Albert | NVD, CISA KEV, Censys, Tech Stack | Epidemic threshold and hub infection modelling |
| evolve_detection_network | NEAT neuroevolution | NVD, CISA KEV, GitHub, Hacker News | Evolving optimal detection network architecture |
| compute_attack_surface | Discrete Morse theory + CW complex | Censys, DNS, SSL, WHOIS, Tech Stack, IP Geo | Topological attack surface quantification |
| assess_threat_actor_dynamics | Population game ESS + replicator | OFAC, OpenSanctions, NVD, CISA KEV, Bluesky, Wayback | Threat actor strategy evolution forecasting |
| forecast_exploit_emergence | Le Cam deficiency distance | NVD, CISA KEV, GitHub, Hacker News, Change Monitor, Bluesky | Detection limits and monitoring adequacy |

Tool parameters

detect_spiking_anomalies

| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
| target | string | Yes | — | Domain, IP, or keyword to analyze |
| simulation_time | number | No | 500 | LIF simulation duration in ms (100–2000) |
| spike_threshold | number | No | 1.0 | Neuron spike threshold theta (0.5–2.0); lower = more sensitive |
| max_results | number | No | 20 | Max results per data source (5–50) |

attribute_threat_campaign

| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
| campaign_keywords | string[] | Yes | — | 1–10 keywords identifying the campaign |
| tau_plus | number | No | 20 | STDP potentiation time constant in ms (5–100) |
| tau_minus | number | No | 20 | STDP depression time constant in ms (5–100) |
| max_results | number | No | 15 | Max results per source (5–30) |

analyze_attack_graph

| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
| target_domain | string | Yes | — | Domain to build attack graph for |
| max_derivation_depth | number | No | 10 | Grammar derivation depth (3–20) |
| max_results | number | No | 15 | Max results per source (5–30) |

simulate_vulnerability_propagation

| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
| target | string | Yes | — | Domain or technology for vulnerability context |
| network_size | number | No | 500 | Simulated network node count (50–2000) |
| infection_rate | number | No | 0.1 | Per-contact infection probability (0.01–0.5); calibrated by CVE severity |
| recovery_rate | number | No | 0.05 | Recovery probability per time step (0.01–0.5) |
| initial_infected | number | No | 5 | Initially infected nodes (1–50) |
| time_steps | number | No | 200 | Simulation time steps (50–500) |

evolve_detection_network

| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
| threat_domain | string | Yes | — | Threat domain to evolve a detector for |
| population_size | number | No | 100 | NEAT population size (20–200) |
| generations | number | No | 50 | Evolution generations (10–100) |
| target_accuracy | number | No | 0.85 | Target detection accuracy (0.6–0.99) |
| max_results | number | No | 15 | Max results per source (5–30) |

compute_attack_surface

| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
| target_domain | string | Yes | — | Domain for Morse theory attack surface analysis |
| max_results | number | No | 15 | Max results per source (5–30) |

assess_threat_actor_dynamics

| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
| threat_context | string | Yes | — | Context string (e.g., "financial sector", "healthcare") |
| time_steps | number | No | 500 | Replicator dynamics time steps (100–2000) |
| mutation_rate | number | No | 0.01 | Strategy mutation rate (0.001–0.1) |
| max_results | number | No | 15 | Max results per source (5–30) |

forecast_exploit_emergence

| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
| threat_domain | string | Yes | — | Threat domain for detection limit forecasting |
| monitoring_budget | number | No | 100 | Monitoring sample size / sensor count (10–10000) |
| baseline_variance | number | No | 1.0 | Baseline noise variance (0.01–10) |
| max_results | number | No | 15 | Max results per source (5–30) |

Configuration tips

- Lower spike_threshold for noisier environments — 0.7 increases sensitivity; raise to 1.3 to reduce false positives on well-known domains
- Use tau_plus = tau_minus for symmetric STDP learning; set tau_plus > tau_minus if you want to weight causal (pre-before-post) sequences more heavily
- Set max_derivation_depth to 15+ only if you need exhaustive attack path enumeration; depth 5–8 is sufficient for most assessments and runs faster
- Increase monitoring_budget in forecast_exploit_emergence to match your actual sensor count for calibrated Le Cam deficiency estimates
- Use specific threat_context strings like "CVE-2024-4577" or "Log4Shell remote code execution" rather than vague terms — the upstream actors rank results by relevance

Output example

detect_spiking_anomalies output for target coldfusion.apache.org:

{
  "target": "coldfusion.apache.org",
  "parameters": {
    "simulation_time": 500,
    "spike_threshold": 1.0
  },
  "network": {
    "neurons": [
      { "id": "N_cve", "spikeCount": 47, "firingRate": 0.094, "meanMembrane": 0.8312 },
      { "id": "N_kev", "spikeCount": 31, "firingRate": 0.062, "meanMembrane": 0.6741 },
      { "id": "N_host", "spikeCount": 12, "firingRate": 0.024, "meanMembrane": 0.3108 },
      { "id": "N_dns", "spikeCount": 8, "firingRate": 0.016, "meanMembrane": 0.2894 },
      { "id": "N_ssl", "spikeCount": 15, "firingRate": 0.030, "meanMembrane": 0.3520 },
      { "id": "N_tech", "spikeCount": 22, "firingRate": 0.044, "meanMembrane": 0.5017 }
    ],
    "totalSpikes": 135,
    "networkActivity": 0.7842,
    "synchronyIndex": 0.6391,
    "filippovSwitchingCount": 14
  },
  "anomalies": [
    { "neuronId": "N_cve", "score": 0.9312, "type": "burst", "timestamp": 1742553600000 },
    { "neuronId": "N_kev", "score": 0.8741, "type": "synchrony", "timestamp": 1742553602441 },
    { "neuronId": "N_tech", "score": 0.7203, "type": "rate_elevation", "timestamp": 1742553605882 },
    { "neuronId": "N_ssl", "score": 0.6891, "type": "burst", "timestamp": 1742553608103 }
  ],
  "burstEvents": [
    { "time": 82, "neuronCount": 4, "severity": 0.8841 },
    { "time": 241, "neuronCount": 3, "severity": 0.7120 },
    { "time": 388, "neuronCount": 5, "severity": 0.9203 }
  ],
  "synapses": [
    { "pre": "N_cve", "post": "N_kev", "weight": 0.3841, "potentiated": true },
    { "pre": "N_kev", "post": "N_tech", "weight": 0.2917, "potentiated": true }
  ],
  "interpretation": "CRITICAL: 4 anomalous neurons detected. Network synchrony 0.6391 indicates correlated threat activity. 3 burst events observed. 14 Filippov switching events at threshold boundaries.",
  "dataSources": {
    "cve": 20,
    "kev": 14,
    "hosts": 18,
    "dns": 7,
    "ssl": 11,
    "tech": 15
  }
}

Output fields

Every tool response includes an interpretation string (plain-language verdict), a dataSources object (record count per source), and tool-specific fields listed below.

| Field | Tool | Type | Description |
|---|---|---|---|
| network.neurons[].spikeCount | spiking | number | Total spikes per neuron during simulation |
| network.synchronyIndex | spiking | number | Pairwise neuron synchrony 0–1 |
| network.filippovSwitchingCount | spiking | number | Threshold boundary crossing events |
| anomalies[].score | spiking | number | Anomaly score 0–1 |
| anomalies[].type | spiking | string | burst / synchrony / rate_elevation |
| burstEvents[].severity | spiking | number | Burst event severity 0–1 |
| stdpResults.spectralRadius | attribution | number | Largest weight matrix eigenvalue |
| stdpResults.tracyWidomEdge | attribution | number | Random matrix noise boundary |
| stdpResults.learningConverged | attribution | boolean | Whether STDP weights stabilised |
| hebbianAssemblies[].coherence | attribution | number | Temporal coherence of threat cluster 0–1 |
| attackGraph.compromisedAssets | attack graph | number | Assets reachable via grammar derivation |
| attackGraph.attackPaths[].probability | attack graph | number | Path traversal probability |
| attackGraph.criticalNodes[].centrality | attack graph | number | Betweenness centrality score |
| epidemiology.basicReproductionNumber | propagation | number | R0 — secondary infections per case |
| epidemiology.epidemicThreshold | propagation | boolean | Whether R0 exceeds critical threshold |
| hubInfectionOrder[].infectedAt | propagation | number | Time step hub node was infected |
| performance.detectionAccuracy | NEAT | number | Evolved network detection accuracy |
| performance.falsePositiveRate | NEAT | number | FPR of best evolved genome |
| bestNetwork.hiddenNodes | NEAT | number | Hidden nodes in best topology |
| morseComplex.criticalCells | attack surface | number | Unpaired (irreducible) cell count |
| morseComplex.eulerCharacteristic | attack surface | number | Topological invariant χ |
| morseComplex.bettiNumbers | attack surface | number[] | Betti numbers [β0, β1, β2] |
| ecosystem.strategies[].isESS | dynamics | boolean | Evolutionary stability of strategy |
| ecosystem.lyapunovExponent | dynamics | number | Positive = chaotic, negative = stable |
| ecosystem.dominantStrategy | dynamics | string | Strategy with highest equilibrium share |
| detectionTheory.deficiency | forecast | number | Le Cam deficiency 0 (no loss) to 1 (total loss) |
| detectionTheory.detectionLimit | forecast | number | Minimum detectable exploit severity |
| detectionTheory.sampleComplexity | forecast | number | Samples needed for 80% detection power |
| rocCurve | forecast | array | False positive rate vs. true positive rate pairs |

How much does it cost to run neuromorphic threat analysis?

This MCP server uses pay-per-event pricing — you pay $0.04 per tool call. Each call orchestrates 4–7 upstream actor runs in parallel; platform compute costs are included in the per-call price.

| Scenario | Tool calls | Cost per call | Total cost |
|---|---|---|---|
| Single investigation | 1 | $0.04 | $0.04 |
| Domain audit (all 8 tools) | 8 | $0.04 | $0.32 |
| Daily threat sweep (10 targets) | 10 | $0.04 | $0.40 |
| Weekly SOC workflow (50 queries) | 50 | $0.04 | $2.00 |
| Continuous monitoring (500/month) | 500 | $0.04 | $20.00 |

The Apify Free plan includes $5 of monthly credits — enough for 125 tool calls with no subscription required.

You can set a maximum spending limit per run to control costs. The actor stops when your budget is reached and returns a clear error message rather than silently truncating results.

For comparison, commercial threat intelligence platforms charge $300–1,500/month for multi-source correlation with far fewer algorithmic outputs. Most users of this MCP server spend $2–20/month for richer, more quantitative analysis.

How Neuromorphic Threat Intelligence MCP Server works

Phase 1 — Parallel data collection

Each tool call identifies its required data sources (4–7 depending on the tool) and dispatches all actor calls simultaneously using Promise.all via runActorsParallel. Each upstream call has a 180-second timeout and 256 MB memory allocation. If an upstream actor fails or returns no dataset, the client logs a warning and returns an empty array — the algorithm still runs on whatever data was collected.

Phase 2 — Severity normalisation and indicator assembly

Raw results from heterogeneous sources are normalised into a unified ThreatIndicator format. Severity is extracted from whichever field is present: cvssScore (divided by 10), severity string enum (critical→0.95, high→0.80, medium→0.50, low→0.20), numeric score, or source-type defaults (kev→0.85 because CISA KEV entries are by definition actively exploited). Timestamps are parsed from publishedDate, dateAdded, timestamp, date, createdAt, or created fields in that priority order.

Phase 3 — Algorithm execution

The assembled indicators are passed to the chosen algorithm from scoring.ts. A deterministic seeded PRNG (mulberry32 initialized from a hash of indicator IDs) ensures reproducible results for the same input data. Key implementation details:

- LIF simulation runs at dt=1.0 ms steps for the specified simulation_time. All-to-all synapses with random initial weights 0.1–0.4 and axonal delays 1–5 steps. Filippov switching detection uses a 0.05 boundary tolerance around the threshold.
- STDP weight matrix is built from temporal spike pairs within a 500-minute window. The Tracy-Widom edge is computed as 2 * sqrt(n) where n is neuron count, matching the standard result for the largest eigenvalue of a GUE random matrix.
- Hypergraph grammar uses context-free production rules seeded from asset types. Floyd-Warshall computes all-pairs reachability in O(n³). Betweenness centrality is approximated by counting how often each node appears in shortest paths.
- Contact process uses Barabasi-Albert preferential attachment to generate the network, then runs discrete-time SIS dynamics with infection rate calibrated by average CVE severity from real NVD data.
- NEAT evolves 6-feature input vectors (severity, type flags for cve/kev/sanction, indicator age, metadata richness) toward a binary threat/noise classification output. Speciation uses a compatibility threshold with weight contributions of 1.0 for disjoint genes and 0.4 for weight differences.
- Discrete Morse assigns a Morse function value to each cell and computes discrete gradient vector fields by pairing cells of adjacent dimensions. Unpaired cells become critical and count toward the attack surface.
- Population game calibrates the payoff matrix entries from sanctions density and vulnerability density signals pulled from the live data. The replicator equation is integrated with Euler method at each time step with mutation injection.
- Le Cam deficiency computes the total variation distance between the likelihood ratio distributions of the two experiments, then derives the power function, minimax risk, and sample complexity from Gaussian approximation.

Phase 4 — Interpretation and structured output

Each algorithm produces both raw numeric fields and a plain-language interpretation string. The interpretation uses threshold-based classification (e.g., anomaly count > 3 → CRITICAL, > 0 → ELEVATED, 0 → NORMAL) to give the AI agent a clear signal it can act on without requiring it to interpret the mathematics.

Tips for best results

1. Use specific targets over broad keywords. detect_spiking_anomalies with target "CVE-2024-4577" retrieves highly relevant CVEs and KEV entries. A broad keyword like "web" will return generic results that dilute the severity signal.

2. Run the full 8-tool suite for high-value targets. Each tool illuminates a different dimension. detect_spiking_anomalies catches correlated multi-source anomalies; analyze_attack_graph maps the infrastructure; compute_attack_surface quantifies irreducible exposure. Together they give a complete picture.

3. Lower spike_threshold for early warning. The default of 1.0 is calibrated for general use. For continuous monitoring of critical infrastructure, 0.7–0.8 catches weaker signals at the cost of more false positives.

4. Combine evolve_detection_network with specific threat domains. The NEAT algorithm trains on indicator data pulled from your query. Use precise domain strings like "ransomware healthcare" rather than "malware" to get a detector specialized for your context.

5. Use forecast_exploit_emergence before expanding monitoring. The Le Cam deficiency output tells you quantitatively whether doubling your sensor count improves detection — and by how much. Use the sampleComplexity field to justify monitoring budget requests.

6. Interpret synchronyIndex alongside anomalies count. A high synchrony index (>0.6) with zero anomalies suggests borderline activity where sources are correlated but not yet crossing individual thresholds — a leading indicator worth watching.

7. Use assess_threat_actor_dynamics quarterly. The evolutionary game output reflects the balance of real sanctions activity and vulnerability data at query time. Running it quarterly tracks shifts in which threat actor strategies are gaining ground in your sector.

8. Set spending limits on automated workflows. If you run this MCP server in a Claude agent that loops, add a per-run budget limit to prevent runaway costs from unexpected recursion.

Combine with other Apify actors

| Actor | How to combine |
|---|---|
| Website Contact Scraper | Enrich attack graph nodes with human contact data — pair infrastructure exposure from analyze_attack_graph with responsible disclosure contacts |
| Website Tech Stack Detector | Pre-run tech stack detection to build a richer technology inventory before running simulate_vulnerability_propagation with technology-specific CVEs |
| WHOIS Domain Lookup | Bulk WHOIS lookups for a portfolio of domains before feeding each through detect_spiking_anomalies for organisation-wide threat scanning |
| Website Change Monitor | Feed change events as input to `detect_spiking_