Website Search

Get Lenny Zeltser's CTI frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests your campaign or threat-intel notes and instructs your AI to keep them local—templates and guidelines flow to your AI for local analysis.

Get Lenny Zeltser's expert CTI writing guidelines. Topics include tone, words, structure, executive_summary, voice, articles, summary, brief (one-page brief section guidance), handoffs (cross-server routing), methodology (the three subsections), fields (per-field guidance), and CTI-specific topics: attribution (full Six Signals prose), confidence (ICD-203 ladder), pyramid_of_pain, six_signals (signals table only), and anti_patterns. The general writing topics (tone/words/structure/executive_summary) now defer to `get_security_writing_guidelines` for the canonical Five Elements rules; CTI-speci…

Get Lenny Zeltser's cyber threat intel template. The long report covers Executive Summary, Actor Snapshot, Methodology, Activity Overview, Representative Adversary Techniques, Indicators of Compromise, Defensive Implications, Attribution Analysis, Anticipated Activity, optional Strategic Analysis and Competing Hypotheses, plus About this Report. The one-page brief covers Bottom Line, Quick Facts, Are We in Scope?, Defensive Actions, What We Don't Know, More Information. This server never requests your campaign or threat-intel notes and instructs your AI to keep them local—templates and guideli…

Load Lenny Zeltser's CTI writing context for local analysis. Returns a JSON payload with section guidance, completeness criteria, framework grounding (12 frameworks), the six attribution signals, ICD-203 confidence levels and ladder, and the Pyramid of Pain. The 'profile' parameter ANNOTATES sections (internal/public applicability label) rather than filtering — every section is returned so cross-profile comparisons are possible. This server never requests your campaign or threat-intel notes and instructs your AI to keep them local—templates and guidelines flow to your AI for local analysis.

Get Lenny Zeltser's expert criteria for reviewing an existing CTI report or brief. Surfaces per-theme review criteria (framework, confidence, attribution, defense, distribution, etc.), cross-cutting criteria, the six anti-patterns to watch for, and focus-driven writing analysis. This server never requests your campaign or threat-intel notes and instructs your AI to keep them local—templates and guidelines flow to your AI for local analysis.

Get the full content of a specific article from Lenny Zeltser's Website by URL path. Security articles on malware analysis, incident response, and security leadership. Returns title, date, topics, summary, and full body text.

List all capabilities and tools available from the Lenny Zeltser's Website MCP server, including search tools and any specialized features like IR report writing assistance.

Get statistics about the Lenny Zeltser's Website search index including total pages indexed, last update time, and available tools.

Get Lenny Zeltser's expert writing guidelines for security reports and assessments. Provides guidance on tone, structure, clarity, executive summaries, and avoiding common writing mistakes. Includes rating-sheet items (the four lens sheets: structure, look, words, tone) as concrete reference points for grounded feedback. Works for any security document. This server never requests your documents and instructs your AI to keep them local—guidelines flow to your AI for local analysis. Note: For incident response reports specifically, use the ir_* tools which provide deeper section-by-section revie…

Get Lenny Zeltser's IR one-page executive brief template. Standalone variant of `ir_get_template` for callers that only want the brief without the long-form report. This server never requests your incident notes and instructs your AI to keep them local—guidelines flow to your AI for local analysis.

Get Lenny Zeltser's IR cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `ir_load_context`. This server never requests your incident notes and instructs your AI to keep them local—guidelines flow to your AI for local analysis.

Get Lenny Zeltser's IR frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests your incident notes and instructs your AI to keep them local—guidelines flow to your AI for local analysis.

Get Lenny Zeltser's expert writing guidelines for incident response reports. Topics: tone, words, structure, executive_summary, voice, articles, summary, brief (one-page brief section guidance, IR 1.5.0+), frameworks (regulatory + maturity frameworks), handoffs (cross-server routing). When the topic maps to a lens (tone, words, structure), the response includes a rating-sheet checklist appendix as concrete reference points for grounded feedback. This server never requests your incident notes and instructs your AI to keep them local—guidelines flow to your AI for local analysis.

Get Lenny Zeltser's structured incident response template. Covers all critical IR sections with field-by-field guidance. Pass kind: "report" (default — full incident-response report) or "brief" (one-page executive brief, IR 1.5.0+). This server never requests your incident notes and instructs your AI to keep them local—guidelines flow to your AI for local analysis.

Load Lenny Zeltser's IR report writing context for local analysis. Returns expert guidelines for field completeness, incident identification, notification triggers, and writing quality. Includes rating-sheet items (lens taxonomy plus the IR-specific Information sheet) as concrete reference points for grounded feedback. This server never requests your incident notes and instructs your AI to keep them local. Use detail_level to control response size: "minimal" (~2k tokens), "standard" (~5k tokens), or "comprehensive" (~11k tokens).

Get Lenny Zeltser's expert criteria for reviewing an existing IR report. Returns focused guidance for constructive critique — what to check in each section, writing quality issues to identify, and how to frame feedback collaboratively. Includes rating-sheet items (lens taxonomy plus the IR-specific Information sheet) as concrete reference points for grounded feedback. This server never requests your report and instructs your AI to keep it local.

Get Lenny Zeltser's Malware cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `malware_load_context`. This server never requests your sample, analysis notes, or indicators and instructs your AI to keep them local—guidelines and the report template flow to your AI for local analysis.

Get Lenny Zeltser's Malware frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests your sample, analysis notes, or indicators and instructs your AI to keep them local—guidelines and the report template flow to your AI for local analysis.

Get Lenny Zeltser's expert malware analysis report writing guidelines. Topics include capabilities, confidence, pyramid_of_pain, anti_patterns, methodology, fields, handoffs, frameworks, plus tone, words, structure, and executive_summary topics that defer to `get_security_writing_guidelines` for canonical Five Elements guidance. Pair the 'fields' topic with field_id for single-field guidance. This server never requests your sample, analysis notes, or indicators and instructs your AI to keep them local—guidelines and the report template flow to your AI for local analysis.

Get Lenny Zeltser's malware analysis report template. The report covers Executive Summary, Sample Snapshot, Malware Family Identification, Component Inventory, Runtime Requirements, Sources, Capabilities, Indicators of Compromise, Analysis Details, What We Don't Know, optional Infection Vector, optional Detection Engineering, About this Report, Appendix: Analysis Environment, and optional Appendix: Analysis Scripts. This server never requests your sample, analysis notes, or indicators and instructs your AI to keep them local—guidelines and the report template flow to your AI for local analysis…

Load Lenny Zeltser's malware analysis report writing context for local analysis. Returns a JSON payload with section guidance, the MBC capability model, ICD-203 confidence scoped to the family call, Pyramid-of-Pain IOC tiering, and a briefPolicy explaining why there is no companion brief. The 'profile' parameter ANNOTATES sections (organizationalReport/researcherNarrative applicability label) rather than filtering — every section is returned so cross-profile comparisons are possible. This server never requests your sample, analysis notes, or indicators and instructs your AI to keep them local—…

Get Lenny Zeltser's expert criteria for reviewing an existing malware analysis report. Surfaces per-theme review criteria for identification, capabilities, indicators, evidence, ecosystem, detection, reproducibility, and distribution; cross-cutting criteria; anti-patterns; and focus-driven writing analysis. This server never requests your sample, analysis notes, or indicators and instructs your AI to keep them local—guidelines and the report template flow to your AI for local analysis.

Load Lenny Zeltser's comparative analysis framework for evaluating multiple security companies side by side. Returns structured scoring rubric, evaluation dimensions, evidence tiering guidance, and comparison-type-specific instructions. Requires comparative analysis content. This server never requests your product plans and instructs your AI to keep them local—guidelines flow to your AI for local analysis.

Get Lenny Zeltser's expert strategic guidelines for a specific product strategy topic. Topics: market (segmentation), capabilities (AI, agents, MVP, positioning), sales (GTM, channels, distribution, POCs), pricing (models, retention), delivery (deployment, APIs), trust (compliance, security program), platform (ecosystem positioning), team (expertise, gaps), competitive (differentiation, moats), defensibility (AI-era defensibility rubric scoring a product across seven dimensions), smb (SMB market dynamics), endpoint (endpoint viability), ai_security (AI security vertical), role (product manager…

Get Lenny Zeltser's fill-in-the-blank template for planning a security product strategy. Includes strategic questions organized by section with evidence columns. This server never requests your product plans and instructs your AI to keep them local—guidelines flow to your AI for local analysis. The template is Copyright (c) 2026 Lenny Zeltser; any content you create using it is entirely yours.

Load Lenny Zeltser's product strategy context for local analysis. Returns expert strategic frameworks, principles, and guidance for evaluating or creating security product plans. Includes rating-sheet items (the lens taxonomy: structure, words, tone) as concrete reference points for grounded feedback on the plan's writing. This server never requests your plans and instructs your AI to keep them local. Use detail_level to control response size: "minimal" (~2k tokens), "standard" (~5k tokens), "compact" (~3-4k tokens, all sections but stripped), or "comprehensive" (~12k tokens). Use market_segme…

Get Lenny Zeltser's expert criteria for reviewing an existing product strategy plan. Returns focused guidance for constructive critique—what to check in each section, strategic coherence issues, and how to frame feedback collaboratively. Includes rating-sheet items (the lens taxonomy: structure, words, tone) as concrete reference points for grounded feedback on the plan's writing. This server never requests your plan and instructs your AI to keep it local. Use market_segment: "smb" to include SMB-specific review criteria. Use product_focus: "endpoint" to include endpoint viability assessment.

Get Lenny Zeltser's cybersecurity-writing rating sheet(s) so your AI can apply the rubric. Returns the structured rubric (groups, items, scoring bands) WITHOUT computing a score. Use `rating_score_writing` if you also want a numeric score, gap analysis, or rubric-anchored feedback. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.

Load Lenny Zeltser's complete cybersecurity-writing rating toolkit: all 7 sheets, scoring policy, scoring playbook, and cross-references to the writing guidelines. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.

Get Lenny Zeltser's scoring playbook so your AI can score a draft locally against a cybersecurity-writing rating sheet. THIS IS THE ONLY TOOL THAT PRODUCES NUMERIC SCORES — the writing-coach tools (`get_security_writing_guidelines`, `ir_*`, `product_*`) never score. Returns the rubric plus step-by-step instructions for applying it. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.

Search Lenny Zeltser's Website by keywords. Security articles on malware analysis, incident response, and security leadership. Searches across titles, abstracts, full content, and topics.

Get Lenny Zeltser's Vuln one-page executive brief template. Standalone variant of `vuln_get_template` for callers that only want the brief without the long-form report. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief template and guidelines flow to your AI for local analysis.

Get Lenny Zeltser's Vuln cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `vuln_load_context`. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief template and guidelines flow to your AI for local analysis.

Get Lenny Zeltser's Vuln frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief template and guidelines flow to your AI for local analysis.

Get Lenny Zeltser's expert vulnerability-brief writing guidelines. Topics include tone, words, structure, voice, articles, summary, fields (per-field guidance), handoffs (cross-server routing), and vuln-specific topics: significance (calibrated insecurity, no vendor passthrough — note this is the Vuln Brief's Significance row, distinct from CVSS/vendor severity scoring), actions (action-enabling What/Why/When/Who), gaps (calibrated uncertainty), sources (evidence synthesis), are_we_affected (scope discipline), and anti_patterns. Pair the 'fields' topic with field_id for single-field guidance. …

Get Lenny Zeltser's one-page Vulnerability Advisory Brief template. Covers Bottom Line, Quick Facts, Are We Affected?, Defensive Actions (with What/Why/When/Who), What We Don't Know, and More Information. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief template and guidelines flow to your AI for local analysis.

Load Lenny Zeltser's Vulnerability Investigation Brief context for local analysis. Returns a JSON payload with brief section guidance, completeness criteria, significance discipline (renamed from 'severity' in 1.1.0 — the Vuln Brief's Significance row, distinct from CVSS or vendor severity scoring), evidence-source guidance, frameworks (CVSS / CVE / NVD / CISA KEV / Vendor Advisory), and ALWAYS embeds the mcpHandoffs array — six pointers that tell the AI when to reach for rating_score_writing, rating_get_sheet, get_security_writing_guidelines, cti_load_context, ir_load_context, or search_zelts…

Get Lenny Zeltser's expert criteria for reviewing an existing Vulnerability Investigation Brief. Surfaces per-theme review criteria (significance, scope, actions, gaps, sources), cross-cutting criteria, anti-patterns, and inline mcpHandoffs pointers when the requested focus triggers scoring or writing-mechanics themes (e.g., focus=tone surfaces rating_score_writing). This server never requests your vulnerability notes and instructs your AI to keep them local—the brief template and guidelines flow to your AI for local analysis.