Serveur MCP
ContrastAPI
com.contrastcyber/api
Ce que fait ce MCP
Provides security research and assessment tools covering CVEs, IOCs, dependencies, secrets, injection risks, HTTP headers, domains, email security, MITRE ATLAS, ATT&CK, and D3FEND.
Capacités
Outils
55
outils
asn_lookup
ASN Lookup
Look up Autonomous System Number (ASN) for a domain or IP: AS number, organization, IPv4/IPv6 prefixes. Use to identify network operator and IP range ownership. Default returns first 50 prefixes per family — set include_full_prefixes=True for full list. Free: 30/hr, Pro: 500/hr. Returns {asn, asn_name, ipv4_prefixes, ipv6_prefixes, ipv4_count, ipv6_count}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'asn_lookupArguments', 'required': ['target'], 'properties': {'target': {'type': 'string', 'title': 'Target', 'description': "Domain or IP address to look up ASN for (e.g. 'cloudflare.com', '8.8.8.8')"}, 'include_full_prefixes': {'type': 'boolean', 'title': 'Include Full Prefixes', 'default': False, 'description': 'Return the full announced-prefixes list (default: False, returns first 50). ipv4_count and ipv6_count are always honest pre-truncation totals. Set True for network mapping or BGP route audits — Cloudflare AS13335 announces 2500+ prefixes.'}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['target', 'asn'], 'properties': {'asn': {'type': 'integer'}, 'target': {'type': 'string'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'asn_name': {'type': 'string'}, 'warnings': {'type': 'array'}, 'ipv4_count': {'type': 'integer'}, 'ipv6_count': {'type': 'integer'}, 'next_calls': {'type': ['array', 'null']}, 'resolved_ip': {'type': ['string', 'null']}, 'ipv4_prefixes': {'type': 'array'}, 'ipv6_prefixes': {'type': 'array'}}}}}
atlas_case_study_lookup
ATLAS Case Study Lookup
Look up a MITRE ATLAS case study — a documented real-world AI/ML attack incident. Each case study links a sequence of ATLAS techniques (techniques_used) to the incident. Default response is SLIM (description truncated to 240 chars); pass include='full' for the verbose narrative. Use this after atlas_technique_search to find which incidents have exercised a given technique. Drill into the full techniques_used array via bulk_atlas_technique_lookup in a single call (next_calls emits exactly that hint). Returns 404 when the id is not in the synced catalog. Free: 30/hr, Pro: 500/hr. Returns {case_study_id, name, description, techniques_used, next_calls}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'atlas_case_study_lookupArguments', 'required': ['case_study_id'], 'properties': {'include': {'enum': ['', 'full'], 'type': 'string', 'title': 'Include', 'default': '', 'description': "Detail level. Default (omit/empty) returns slim (description truncated to 240 chars). Pass 'full' for the verbose narrative — case-study descriptions can run 1-3KB."}, 'case_study_id': {'type': 'string', 'title': 'Case Study Id', 'description': "MITRE ATLAS case study id, format 'AML.CS####' (e.g. 'AML.CS0000', 'AML.CS0014')."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['case_study_id', 'name'], 'properties': {'name': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'next_calls': {'type': ['array', 'null']}, 'description': {'type': ['string', 'null']}, 'case_study_id': {'type': 'string'}, 'techniques_used': {'type': 'array'}}}}}
atlas_case_study_search
ATLAS Case Study Search
Search ATLAS case studies (real-world AI/ML attack incidents) by keyword or referenced technique. Default response is SLIM (description truncated to 240 chars per row); pass include='full' for the verbose summary. Useful when the user has a technique in hand and wants to see incidents that exercised it. Drill via atlas_case_study_lookup for the full procedure list. Free: 30/hr, Pro: 500/hr. Returns {query, total, results [{case_study_id, name, description (truncated by default), techniques_used}], next_calls}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'atlas_case_study_searchArguments', 'properties': {'limit': {'type': 'integer', 'title': 'Limit', 'default': 50, 'maximum': 200, 'minimum': 1, 'description': 'Max results to return. Range: 1-200.'}, 'include': {'enum': ['', 'full'], 'type': 'string', 'title': 'Include', 'default': '', 'description': "Detail level. Default ('') returns slim records (description truncated to 240 chars). Pass 'full' for full description on every row."}, 'keyword': {'type': 'string', 'title': 'Keyword', 'default': '', 'description': "Substring match against case study name + description (case-insensitive). Min 2 chars. Example: 'evasion', 'data poisoning'. Omit to list all."}, 'technique_id': {'type': 'string', 'title': 'Technique Id', 'default': '', 'description': "Filter to case studies that include this ATLAS technique id, format 'AML.T####' or 'AML.T####.###' (e.g. 'AML.T0051'). Omit for any technique."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': [], 'properties': {'query': {'type': 'object'}, 'total': {'type': 'integer'}, 'results': {'type': 'array'}, 'verdict': {'type': ['object', 'null']}, 'next_calls': {'type': ['array', 'null']}}}}}
atlas_technique_lookup
ATLAS Technique Lookup
Look up a MITRE ATLAS technique — the AI/ML adversarial attack catalog. ATLAS catalogues TTPs targeting machine learning systems: prompt injection, model evasion, training data poisoning, model theft, etc. Roughly 80% of ATLAS techniques are AI/ML-specific (no ATT&CK bridge); 20% mirror an enterprise ATT&CK technique via attack_reference_id — use that to pivot to D3FEND defenses (d3fend_defense_for_attack) and CVE search. Sub-techniques inherit `tactics` from the parent (inherited_tactics=true flag) when ATLAS upstream leaves them empty. Use this tool when the user asks about AI/ML threats, LLM red-teaming, or adversarial ML; for multiple techniques in one call (e.g. drilling into a case study's techniques_used), prefer bulk_atlas_technique_lookup. Returns 404 when the id is not in the synced ATLAS catalog. Free: 30/hr, Pro: 500/hr. Returns {technique_id, name, description, tactics, inherited_tactics, maturity (demonstrated|feasible|realized), attack_reference_id, attack_reference_url, subtechnique_of, created_date, modified_date, next_calls}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'atlas_technique_lookupArguments', 'required': ['technique_id'], 'properties': {'technique_id': {'type': 'string', 'title': 'Technique Id', 'description': "MITRE ATLAS technique id, format 'AML.T####' or 'AML.T####.###' for sub-techniques (e.g. 'AML.T0000', 'AML.T0051' LLM Prompt Injection, 'AML.T0000.000')."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['technique_id', 'name'], 'properties': {'name': {'type': 'string'}, 'tactics': {'type': 'array'}, 'verdict': {'type': ['object', 'null']}, 'maturity': {'type': ['string', 'null']}, 'next_calls': {'type': ['array', 'null']}, 'description': {'type': ['string', 'null']}, 'created_date': {'type': ['string', 'null']}, 'technique_id': {'type': 'string'}, 'modified_date': {'type': ['string', 'null']}, 'subtechnique_of': {'type': ['string', 'null']}, 'inherited_tactics': {'type': ['boolean', 'null']}, 'attack_reference_id': {'type': ['string', 'null']}, 'attack_reference_url': {'type': ['string', 'null']}}}}}
atlas_technique_search
ATLAS Technique Search
Search the MITRE ATLAS catalog of AI/ML attack techniques by keyword, tactic, or maturity. Default response is SLIM (description truncated to 240 chars per row); pass include='full' for the verbose record. Pass exclude_id when chaining from atlas_technique_lookup to skip self in sibling-tactic searches. Use this to discover techniques matching a threat-model question, e.g. 'what techniques target LLM serving infrastructure?'. Drill into atlas_technique_lookup with any returned technique_id for the full description, ATT&CK bridge, and pivot hints. For broader cross-referencing: when a result has attack_reference_id, that bridges to D3FEND mitigations via d3fend_defense_for_attack. Free: 30/hr, Pro: 500/hr. Returns {query (echoed filters), total, results [{technique_id, name, description (truncated by default), tactics, inherited_tactics, maturity, attack_reference_id, subtechnique_of}], next_calls}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'atlas_technique_searchArguments', 'properties': {'limit': {'type': 'integer', 'title': 'Limit', 'default': 50, 'maximum': 200, 'minimum': 1, 'description': 'Max results to return. Range: 1-200.'}, 'tactic': {'type': 'string', 'title': 'Tactic', 'default': '', 'description': "Filter by ATLAS tactic id, format 'AML.TA####'. Examples: 'AML.TA0002' (Reconnaissance), 'AML.TA0007' (ML Attack Staging). Omit for all tactics."}, 'include': {'enum': ['', 'full'], 'type': 'string', 'title': 'Include', 'default': '', 'description': "Detail level. Default ('') returns slim records (description truncated to 240 chars; drill via atlas_technique_lookup for full text). Pass 'full' for full description on every row — large catalogs (167 techniques) can return ~100KB at full."}, 'keyword': {'type': 'string', 'title': 'Keyword', 'default': '', 'description': "Substring match against technique name + description (case-insensitive). Min 2 chars. Example: 'prompt injection', 'model evasion', 'poisoning'. Omit to list all."}, 'maturity': {'enum': ['', 'demonstrated', 'feasible', 'realized'], 'type': 'string', 'title': 'Maturity', 'default': '', 'description': "Filter by maturity: 'demonstrated' (observed in real attacks), 'feasible' (theoretical), or 'realized' (newer ATLAS classification, treat similar to demonstrated). Omit for all."}, 'exclude_id': {'type': 'string', 'title': 'Exclude Id', 'default': '', 'description': "Optional ATLAS technique id to exclude from results, format 'AML.T####' or 'AML.T####.###'. Useful when chaining from atlas_technique_lookup to fetch siblings without echoing self in the same-tactic search."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': [], 'properties': {'query': {'type': 'object'}, 'total': {'type': 'integer'}, 'results': {'type': 'array'}, 'verdict': {'type': ['object', 'null']}, 'next_calls': {'type': ['array', 'null']}}}}}
audit_domain
Audit Domain
Perform comprehensive domain audit: combines domain_report + live HTTP security headers + technology fingerprinting. By default report.dns.txt is filtered to security-relevant entries (SPF, DMARC, DKIM, MTA-STS, TLS-RPT) and report.dns.total_txt_records reports the honest pre-filter count; pass include_all_txt=true for the raw TXT list. Use when you need the full picture (recon + active checks); use domain_report for passive-only assessment. Response carries next_calls — chain with subdomain_enum (always emitted) and ssl_check (when an A record resolves) for the residual recon depth (tech_fingerprint already inline as `technologies`). Free: 30/hr (costs 6 tokens), Pro: 500/hr. Returns {domain, report, technologies, live_headers, summary, next_calls}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'audit_domainArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Root domain to audit, without protocol or path (e.g. 'example.com', 'shopify.com')"}, 'include_all_txt': {'type': 'boolean', 'title': 'Include All Txt', 'default': False, 'description': 'Return every TXT record under report.dns.txt (default: False, only SPF/DMARC/DKIM/MTA-STS/TLS-RPT kept). report.dns.total_txt_records is always emitted with the honest pre-filter count. Default filter strips vendor verification strings (google-site-verification, ms=, facebook-domain-verification, etc.) that bloat the response without security signal. Set True only when you need the raw TXT inventory.'}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain'], 'properties': {'domain': {'type': 'string'}, 'report': {'type': ['object', 'null']}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'next_calls': {'type': ['array', 'null']}, 'live_headers': {'type': 'object'}, 'technologies': {'type': 'object'}}}}}
brand_assets
Brand Assets
Scrape a domain's homepage `<head>` for public brand assets — favicon, og:image, theme-color, og:site_name, JSON-LD `Organization.logo`. Use to enrich CRM records, build company-card UIs, or correlate a lead's site to their visual identity (no manual screenshot required). Strictly homepage-only (path `/`); we do NOT crawl. Ethical floor: target's robots.txt is honoured — `Disallow: /` for ContrastAPI OR `*` returns 403 `error.code = robots_txt_disallow` and we DO NOT fetch. `Cache-Control: no-store` / `private` from the target is respected (response is built but NOT written to our cache; `cache_respected=false` flags this). Per-target eTLD+1 throttle (60 req/min) prevents weaponising via subdomain rotation. All URL fields are absolute and `_untrusted` (DO NOT execute or shell-out — the target controls these strings). Free: 30/hr, Pro: 500/hr. Returns {domain, fetched_url, status_code, favicon_url_untrusted, og_image_url_untrusted, theme_color, site_name_untrusted, logo_url_untrusted, cache_respected, summary}. Returns 502 on DNS/TCP/TLS failure; 403 `robots_txt_disallow` when the target opted out.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'brand_assetsArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Registrable domain to scrape brand assets for (e.g. 'github.com', 'stripe.com'). No scheme, no path, no port. The bot fetches https://<domain>/ with HTTP fallback."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain', 'fetched_url', 'status_code'], 'properties': {'domain': {'type': 'string'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'next_calls': {'type': ['array', 'null']}, 'fetched_url': {'type': 'string'}, 'status_code': {'type': 'integer'}, 'theme_color': {'type': ['string', 'null']}, 'cache_respected': {'type': 'boolean'}, 'logo_url_untrusted': {'type': ['string', 'null']}, 'site_name_untrusted': {'type': ['string', 'null']}, 'favicon_url_untrusted': {'type': ['string', 'null']}, 'og_image_url_untrusted': {'type': ['string', 'null']}}}}}
bulk_atlas_technique_lookup
Bulk ATLAS Technique Lookup
Bulk ATLAS technique lookup — retrieve full records for up to 50 techniques in a single request instead of N separate atlas_technique_lookup calls. Designed as the natural follow-up to atlas_case_study_lookup, whose techniques_used array can be passed directly. Each item is the same shape as atlas_technique_lookup, including parent-tactics inheritance for sub-techniques (inherited_tactics=true flag) and per-item next_calls (D3FEND bridge when attack_reference_id present, sibling-technique search by tactic, parent lookup for sub-techniques). Free: 30/hr (1 per item), Pro: 500/hr. Returns {results [{technique_id, status (ok|not_found|invalid_format), technique, error}], total, successful, failed, partial, summary}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'bulk_atlas_technique_lookupArguments', 'required': ['technique_ids'], 'properties': {'technique_ids': {'type': 'array', 'items': {'type': 'string'}, 'title': 'Technique Ids', 'maxItems': 50, 'description': "List of MITRE ATLAS technique ids in format 'AML.T####' or 'AML.T####.###' (e.g. ['AML.T0051', 'AML.T0043', 'AML.T0000.000']). Up to 50 per call. Case-insensitive; normalized + de-duplicated server-side. Each id counts as 1 request toward the rate limit."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': [], 'properties': {'total': {'type': 'integer'}, 'failed': {'type': 'integer'}, 'partial': {'type': 'boolean'}, 'results': {'type': 'array'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'processed': {'type': 'integer'}, 'next_calls': {'type': ['array', 'null']}, 'successful': {'type': 'integer'}, 'skipped_due_to_rate_limit': {'type': 'array'}}}}}
bulk_cve_lookup
Bulk CVE Lookup
Batch query multiple CVEs (up to 50 per call, same for Free and Pro): retrieve full CVE details for all in 1 request instead of N. By default each CVE's affected_products is truncated to the first 20 entries (total_products reports honest count) and references to the first 10 (total_references reports honest count); pass include_affected_products=true / include_full_references=true to return full lists. Pass include_reference_tags=true to receive references_full=[{url, tags, source}] per CVE in the batch. Pass include_severity_breakdown=true to receive severity_sources/consensus/disagreement per CVE. Use for dependency audits or bulk vulnerability enrichment; use cve_lookup for single CVE. Each successful item carries next_calls — chain with kev_detail (when kev.in_kev=true), cwe_lookup (when cwe_id is present), or exploit_lookup. Free: 30/hr (1 per item), Pro: 500/hr. Returns {results, total, successful, failed, timed_out, partial, summary}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'bulk_cve_lookupArguments', 'required': ['cve_ids'], 'properties': {'cve_ids': {'type': 'array', 'items': {'type': 'string'}, 'title': 'Cve Ids', 'description': "List of CVE identifiers in format CVE-YYYY-NNNNN (e.g. ['CVE-2024-3094', 'CVE-2021-44228', 'CVE-2023-44487']). Maximum 50 per request (same cap for Free and Pro)."}, 'include_reference_tags': {'type': 'boolean', 'title': 'Include Reference Tags', 'default': True, 'description': 'Return structured references_full per CVE in the batch [{url, tags, source}]. Same shape as cve_lookup (default: True). Activates tag-first patch detection per item. Set False for legacy clients.'}, 'include_full_references': {'type': 'boolean', 'title': 'Include Full References', 'default': True, 'description': 'Return the full references list for each CVE in the batch (default: True). total_references is always emitted. Set False to truncate each item to first 10 entries when payload-bound.'}, 'include_affected_products': {'type': 'boolean', 'title': 'Include Affected Products', 'default': False, 'description': 'Return the full affected_products list for each CVE in the batch (default: False, each CVE returns first 20). Set True for bulk dependency audits.'}, 'include_severity_breakdown': {'type': 'boolean', 'title': 'Include Severity Breakdown', 'default': True, 'description': 'Return severity_sources/consensus/disagreement per CVE in batch. Same shape as cve_lookup (default: True). cvss_v2 and cvss_v2_vector are always emitted (additive non-opt-in). Set False to skip if downstream cannot tolerate the extra fields.'}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': [], 'properties': {'total': {'type': 'integer'}, 'failed': {'type': 'integer'}, 'partial': {'type': 'boolean'}, 'results': {'type': 'array'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'processed': {'type': 'integer'}, 'timed_out': {'type': 'integer'}, 'next_calls': {'type': ['array', 'null']}, 'successful': {'type': 'integer'}, 'skipped_due_to_rate_limit': {'type': 'array'}}}}}
bulk_ioc_lookup
Bulk IOC Lookup
Batch query multiple IOCs (IP/domain/URL/hash, up to 50 per call, same for Free and Pro) in 1 request: auto-detects type + queries abuse.ch feeds per-indicator. Per-type source coverage matches ioc_lookup: hash → ThreatFox only; IP → ThreatFox + Feodo + URLhaus; domain / URL → ThreatFox + URLhaus. Each result item carries its own verdict.sources_queried / sources_unavailable so partial failures are visible per indicator. Use for SOC alert triage or batch enrichment; use ioc_lookup for single indicator. Free: 30/hr (1 per item), Pro: 500/hr. Returns {results, total, successful, failed, timed_out, partial, summary}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'bulk_ioc_lookupArguments', 'required': ['indicators'], 'properties': {'indicators': {'type': 'array', 'items': {'type': 'string'}, 'title': 'Indicators', 'description': "List of indicators of compromise: IP addresses, domains, URLs, or file hashes (e.g. ['8.8.8.8', 'evil.com', 'd41d8cd98f00b204e9800998ecf8427e']). Maximum 50 per request (same cap for Free and Pro). Each indicator type is auto-detected."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': [], 'properties': {'total': {'type': 'integer'}, 'failed': {'type': 'integer'}, 'invalid': {'type': 'integer'}, 'partial': {'type': 'boolean'}, 'results': {'type': 'array'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'processed': {'type': 'integer'}, 'timed_out': {'type': 'integer'}, 'next_calls': {'type': ['array', 'null']}, 'successful': {'type': 'integer'}, 'skipped_due_to_rate_limit': {'type': 'array'}}}}}
bulk_sigma_rule_lookup
Bulk Sigma Rule Lookup
Bulk Sigma rule lookup — retrieve full records for up to 50 rule UUIDs in a single request instead of N separate sigma_rule_lookup calls. Designed for triage workflows where multiple rule ids are known (e.g., from a SIEM alert batch or a tagged detection bundle). Each item is the same shape as sigma_rule_lookup with status ok/not_found/invalid_format and an error field when applicable. Up to 50 rule ids per call (same cap for Free and Pro). Each rule_id consumes 1 unit of the hourly quota; ids beyond the caller's remaining quota land in skipped_due_to_rate_limit instead of failing the whole batch (parity with bulk_cve/ioc). Free: 30/hr, Pro: 500/hr. Returns {results [{rule_id, status, rule, error}], total, processed, skipped_due_to_rate_limit, successful, failed, partial, summary, next_calls}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'bulk_sigma_rule_lookupArguments', 'required': ['rule_ids'], 'properties': {'rule_ids': {'type': 'array', 'items': {'type': 'string'}, 'title': 'Rule Ids', 'maxItems': 50, 'description': "List of Sigma rule UUIDs in RFC 4122 format. Up to 50 per call (same cap for Free and Pro). Each rule_id counts as 1 request toward the hourly quota. Per-item validation: invalid-format ids return status='invalid_format', unknown UUIDs return status='not_found' — the whole call does not fail."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': [], 'properties': {'total': {'type': 'integer'}, 'failed': {'type': 'integer'}, 'partial': {'type': 'boolean'}, 'results': {'type': 'array'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'processed': {'type': 'integer'}, 'next_calls': {'type': ['array', 'null']}, 'successful': {'type': 'integer'}, 'skipped_due_to_rate_limit': {'type': 'array'}}}}}
calculate_risk_score
Calculate Risk Score
Composite CVE risk score (0-100) — fuses CVSS, EPSS, KEV, and PoC into a single agent-ready triage signal. Formula: CVSS*0.20 + EPSS*0.35 + KEV*0.30 + PoC*0.15 (each component rescaled to 0-100 before weighting). Multiplicative boosters applied in order: KEV+PoC combo (*1.15), critical-severity-with-high-EPSS (CVSS>=9 AND EPSS>0.7, *1.10), recently published (within last 7 days, *1.05). Final score clamped to [0, 100]. Label bands: CRITICAL>=90, HIGH>=70, MEDIUM>=40, LOW<40. Urgency text encodes patch SLA (immediate when KEV; 24h/72h/30d by label). Use to triage a single CVE without orchestrating cve_lookup + exploit_lookup separately. PoC signal here is the local ExploitDB mirror only — for full multi-source exploit detail (GitHub Advisory + Shodan refs + ExploitDB), call exploit_lookup separately. Methodology adapted from mukul975/cve-mcp-server (Apache-2.0): https://github.com/mukul975/cve-mcp-server. Free: 30/hr, Pro: 500/hr. Returns {cve_id, score (0-100), label (CRITICAL/HIGH/MEDIUM/LOW), urgency, has_public_poc, components (cvss_v3, epss_score, in_kev, has_public_poc, weighted_breakdown), boosters_applied, recommendation, summary, verdict, next_calls}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'calculate_risk_scoreArguments', 'required': ['cve_id'], 'properties': {'cve_id': {'type': 'string', 'title': 'Cve Id', 'description': "CVE identifier in format CVE-YYYY-NNNNN (e.g. 'CVE-2021-44228', 'CVE-2024-3094')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['cve_id', 'score', 'label', 'urgency', 'has_public_poc', 'components', 'recommendation', 'summary'], 'properties': {'label': {'type': 'string'}, 'score': {'type': 'number'}, 'cve_id': {'type': 'string'}, 'summary': {'type': 'string'}, 'urgency': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'components': {'type': 'object'}, 'next_calls': {'type': ['array', 'null']}, 'has_public_poc': {'type': 'boolean'}, 'recommendation': {'type': 'string'}, 'boosters_applied': {'type': 'array'}}}}}
check_dependencies
Check Dependencies
Audit project dependencies (npm/PyPI/Maven/RubyGems/etc.) against CVE database: find known vulnerabilities in your package list. Bulk query up to 50 packages per call (same for Free and Pro). Use for dependency security scanning; use cve_lookup for single CVE. Free: 30/hr (1 per package), Pro: 500/hr. Returns {findings, total, by_severity, summary}. Each finding includes fixed_in (first patched version per NVD/MITRE version range) when a version range matched — omitted from wire when the range is open-ended or no input version was supplied; remediation copy then says 'Check if ... is affected ... and upgrade if so' instead of 'Upgrade to X.Y.Z or later'.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'check_dependenciesArguments', 'required': ['packages'], 'properties': {'packages': {'type': 'array', 'items': {'type': 'object', 'additionalProperties': True}, 'title': 'Packages', 'description': 'List of dependency packages to audit. Each item is an object with \'name\' (required, max 200 chars, e.g. \'lodash\', \'django\', \'log4j-core\') and optional \'version\' (max 100 chars, e.g. \'4.17.0\', \'2.14.1\'). Only \'name\' and \'version\' fields are used; extra fields are ignored. Example: [{"name": "lodash", "version": "4.17.0"}, {"name": "django"}]. Maximum 50 per request (same cap for Free and Pro).'}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': [], 'properties': {'total': {'type': 'integer'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'findings': {'type': 'array'}, 'processed': {'type': 'integer'}, 'next_calls': {'type': ['array', 'null']}, 'by_severity': {'type': 'object'}, 'skipped_due_to_rate_limit': {'type': 'array'}}}}}
check_headers
Check Headers
Validate HTTP security headers you provide (JSON): CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Permissions-Policy, Referrer-Policy against best practices. Use to test header config before deployment or validate non-public servers; use scan_headers to fetch live. Free: 30/hr, Pro: 500/hr. By default header values are truncated to 500 chars; pass include='full' for the full raw value. Returns {total, by_severity, findings}. No external requests.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'check_headersArguments', 'required': ['headers'], 'properties': {'headers': {'type': 'string', 'title': 'Headers', 'description': 'JSON string of HTTP header name-value pairs to validate. Example: \'{"Strict-Transport-Security": "max-age=31536000", "X-Frame-Options": "DENY"}\'. Include only security-relevant headers you want to analyze.'}, 'include': {'enum': ['', 'full'], 'type': 'string', 'title': 'Include', 'default': '', 'description': "Detail level. Default ('') returns slim findings — raw header values capped at 500 chars with total_value_length carrying the honest pre-truncation length. Pass 'full' to restore the full raw value. Allowed: '' or 'full'."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': [], 'properties': {'grade': {'type': 'string'}, 'score': {'type': 'integer'}, 'total': {'type': 'integer'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'findings': {'type': 'array'}, 'next_calls': {'type': ['array', 'null']}, 'by_severity': {'type': 'object'}, 'headers_missing': {'type': 'array'}, 'headers_present': {'type': 'array'}}}}}
check_injection
Check Injection
Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'check_injectionArguments', 'required': ['code'], 'properties': {'code': {'type': 'string', 'title': 'Code', 'description': 'Source code string to scan for injection vulnerabilities (can be a single file or code snippet)'}, 'language': {'enum': ['python', 'javascript', 'typescript', 'java', 'go', 'ruby', 'shell', 'bash', 'generic'], 'type': 'string', 'title': 'Language', 'default': 'generic', 'description': "Programming language of the code. Must be one of: python, javascript, typescript, java, go, ruby, shell, bash, generic. Use 'generic' if unsure."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': [], 'properties': {'total': {'type': 'integer'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'findings': {'type': 'array'}, 'next_calls': {'type': ['array', 'null']}, 'by_severity': {'type': 'object'}}}}}
check_secrets
Check Secrets
Scan source code (or snippet) for hardcoded secrets — cloud provider keys, API tokens, connection strings, private keys, passwords. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect leaked credentials before commit; for injection detection use check_injection. Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored. The generic password-assignment rule is suppressed when a more-specific credential rule fires on the same line — one targeted finding per leaked secret, not two.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'check_secretsArguments', 'required': ['code'], 'properties': {'code': {'type': 'string', 'title': 'Code', 'description': 'Source code string to scan for secrets (can be a single file or code snippet)'}, 'language': {'enum': ['python', 'javascript', 'typescript', 'java', 'go', 'ruby', 'shell', 'bash', 'generic'], 'type': 'string', 'title': 'Language', 'default': 'generic', 'description': "Programming language of the code. Must be one of: python, javascript, typescript, java, go, ruby, shell, bash, generic. Use 'generic' if unsure."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': [], 'properties': {'total': {'type': 'integer'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'findings': {'type': 'array'}, 'next_calls': {'type': ['array', 'null']}, 'by_severity': {'type': 'object'}}}}}
contrast_scan
Contrast Scan
Active website security scan: runs the ContrastScan C engine (11 modules — HTTP security headers, SSL/TLS, DNS, redirect chain, information disclosure, cookie flags, DNSSEC, HTTP methods, CORS, HTML hygiene, deep CSP analysis) against the live site and enriches the raw result with severity-ranked vulnerability findings and a letter grade. Use for a hands-on misconfiguration scan; use audit_domain for passive recon (DNS/WHOIS/SSL/threat intel) and scan_headers for headers only. Active outbound fetch — a per-target eTLD+1 throttle (60 req/min) applies. Free: 30/hr (costs 6 tokens), Pro: 500/hr. Returns {domain, resolved_ip, total_score, max_score, grade, findings, findings_count, headers, ssl, dns, redirect, disclosure, cookies, dnssec, methods, cors, html, csp_analysis, enterprise, summary, next_calls}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'contrast_scanArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Root domain to scan, without protocol or path (e.g. 'example.com'). Bare IPs and private-resolving domains are rejected."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain'], 'properties': {'dns': {'type': 'object'}, 'ssl': {'type': 'object'}, 'cors': {'type': 'object'}, 'html': {'type': 'object'}, 'grade': {'type': 'string'}, 'dnssec': {'type': 'object'}, 'domain': {'type': 'string'}, 'cookies': {'type': 'object'}, 'headers': {'type': 'object'}, 'methods': {'type': 'object'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'findings': {'type': 'array'}, 'redirect': {'type': 'object'}, 'max_score': {'type': 'integer'}, 'disclosure': {'type': 'object'}, 'enterprise': {'type': ['object', 'null']}, 'next_calls': {'type': ['array', 'null']}, 'resolved_ip': {'type': ['string', 'null']}, 'total_score': {'type': 'integer'}, 'csp_analysis': {'type': 'object'}, 'findings_count': {'type': 'object'}}}}}
cve_leading
CVE Leading
List CVEs indexed from MITRE/GHSA BEFORE NVD publication (early-warning, freshest data). By default each result is slim (no description, no cvss_breakdown, no affected_products list, no references) — pass include='full' for the same payload shape as cve_lookup; for drill-down on a single CVE prefer cve_lookup. Use for threat intelligence on emerging CVEs; use cve_search for published NVD data. Verdict (sources_queried, falsifiable_fields, completeness, data_age) is at the response root — applies to the whole batch, not per-row. Response carries a global hint pointing at cve_lookup — drill into any returned cve_id for full detail and chained pivots (exploit_lookup, kev_detail, cwe_lookup). Free: 30/hr, Pro: 500/hr. Returns {count, total, truncated, offset, summary, results, next_offset, verdict, hint}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'cve_leadingArguments', 'properties': {'limit': {'type': 'integer', 'title': 'Limit', 'default': 50, 'maximum': 200, 'minimum': 1, 'description': 'Maximum results to return. Range: 1-200.'}, 'offset': {'type': 'integer', 'title': 'Offset', 'default': 0, 'maximum': 5000, 'minimum': 0, 'description': 'Skip N results for pagination.'}, 'include': {'enum': ['', 'full'], 'type': 'string', 'title': 'Include', 'default': '', 'description': "Per-result detail level. Default ('') returns slim list items (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources). Pass 'full' to also return description, cvss_breakdown, affected_products, references, first_seen_source, first_seen_at. Slim default avoids description/summary duplication that bloats 50-item leading lists. Verdict is at the response root, not per-row (deduplicated for ~40% payload savings). Allowed: '' or 'full'."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': [], 'properties': {'hint': {'type': ['object', 'null']}, 'count': {'type': 'integer'}, 'total': {'type': 'integer'}, 'offset': {'type': 'integer'}, 'results': {'type': 'array'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'truncated': {'type': 'boolean'}, 'next_calls': {'type': ['array', 'null']}, 'query_echo': {'type': ['object', 'null']}, 'next_offset': {'type': ['integer', 'null']}}}}}
cve_lookup
CVE Lookup
Retrieve detailed CVE data by ID: description, CVSS v3.1 + vector, CVSS v2 (always emitted), EPSS score + percentile, CISA KEV status (expanded: due_date, required_action, ransomware flag, vendor_project, product, vulnerability_name, short_description, notes, cwes, date_removed when in_kev=true), NVD vulnerability_status (Analyzed/Modified/Awaiting Analysis/Deferred/Rejected/Withdrawn), cve_tags ('disputed' triggers [DISPUTED] summary prefix), affected products (CPE), references, patch availability, related CVEs. By default affected_products is truncated to the first 20 entries (total_products reports the honest count) and references to the first 10 (total_references reports the honest count). Pass include_affected_products=true and/or include_full_references=true for the complete lists. Pass include_reference_tags=true to receive structured references_full=[{url, tags, source}] (NVD upstream tags + source provenance) — also activates tag-first patch detection. Pass include_severity_breakdown=true to receive severity_sources/consensus/disagreement (multi-source view of NVD/MITRE/GHSA/OSV severity assessments). Use for single-CVE details; use cve_search for queries by product/severity. Response carries next_calls — chain with kev_detail when kev.in_kev=true, with cwe_lookup on each CWE in cwes (up to 3 pivots), and with exploit_lookup for public PoC availability. Free: 30/hr, Pro: 500/hr. Returns {cve_id, summary, description, severity, cvss_v3, cvss_v2, cvss_v2_vector, cvss_breakdown, cwe_id, cwes, vulnerability_status, cve_tags, published, modified, sources, first_seen_source, first_seen_at, epss, kev (in_kev, date_added, due_date, required_action, known_ransomware_use, vendor_project, product, vulnerability_name, short_description, notes, cwes, date_removed), affected_products (first 20 by default), total_products, references (first 10 by default), total_references, total_references_unique, references_full (only when include_reference_tags=true), severity_sources/severity_consensus/severity_disagreement (only when include_severity_breakdown=true), patch_available, related_cves, verdict, next_calls}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'cve_lookupArguments', 'required': ['cve_id'], 'properties': {'cve_id': {'type': 'string', 'title': 'Cve Id', 'description': "CVE identifier in format CVE-YYYY-NNNNN (e.g. 'CVE-2024-3094', 'CVE-2023-44487')"}, 'include_reference_tags': {'type': 'boolean', 'title': 'Include Reference Tags', 'default': True, 'description': "Return structured references_full field with [{url, tags, source}] objects (NVD reference tags + source provenance) (default: True). Inspects which references are vendor patches (tags=['Patch']) vs exploit PoCs (tags=['Exploit']) vs mailing list discussions. Patch URL detection is tag-first when refs_with_tags is populated; legacy cached rows fall back to regex. Set False to skip the structured shape for legacy clients."}, 'include_full_references': {'type': 'boolean', 'title': 'Include Full References', 'default': True, 'description': 'Return the full references list (default: True, returns all references). total_references is always emitted with the honest count; patch URL detection always runs against the full list, so patch_url/patch_available are unaffected. Set False to truncate to first 10 entries when bandwidth-bound.'}, 'include_affected_products': {'type': 'boolean', 'title': 'Include Affected Products', 'default': False, 'description': 'Return the full affected_products list (default: False, returns first 20). Set True for bulk audits or dependency scanning of Log4j-class CVEs with 50+ products.'}, 'include_severity_breakdown': {'type': 'boolean', 'title': 'Include Severity Breakdown', 'default': True, 'description': 'Return severity_sources, severity_consensus, and severity_disagreement (multi-source severity breakdown) (default: True). Surfaces vendor disputes (e.g. CVE-2023-38545 NVD-CRITICAL vs GHSA-HIGH). cvss_v2 and cvss_v2_vector are always emitted (additive non-opt-in). Consensus uses majority-bucket vote with highest-severity tie-break (CRITICAL > HIGH > MEDIUM > LOW > NONE). Set False to skip if downstream cannot tolerate the extra fields.'}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['cve_id'], 'properties': {'kev': {'type': 'object'}, 'cwes': {'type': ['array', 'null']}, 'epss': {'type': 'object'}, 'cve_id': {'type': 'string'}, 'cwe_id': {'type': ['string', 'null']}, 'cvss_v2': {'type': ['number', 'null']}, 'cvss_v3': {'type': ['number', 'null']}, 'sources': {'type': 'array'}, 'summary': {'type': ['string', 'null']}, 'verdict': {'type': ['object', 'null']}, 'cve_tags': {'type': ['array', 'null']}, 'modified': {'type': ['string', 'null']}, 'severity': {'type': ['string', 'null']}, 'patch_url': {'type': ['string', 'null']}, 'published': {'type': ['string', 'null']}, 'next_calls': {'type': ['array', 'null']}, 'references': {'type': 'array'}, 'description': {'type': ['string', 'null']}, 'related_cves': {'type': ['array', 'null']}, 'first_seen_at': {'type': ['string', 'null']}, 'cvss_breakdown': {'type': ['object', 'null']}, 'cvss_v2_vector': {'type': ['string', 'null']}, 'total_products': {'type': 'integer'}, 'patch_available': {'type': ['boolean', 'null']}, 'references_full': {'type': ['array', 'null']}, 'severity_sources': {'type': ['array', 'null']}, 'total_references': {'type': 'integer'}, 'affected_products': {'type': 'array'}, 'first_seen_source': {'type': ['string', 'null']}, 'severity_consensus': {'type': ['string', 'null']}, 'vulnerability_status': {'type': ['string', 'null']}, 'severity_disagreement': {'type': ['boolean', 'null']}, 'total_references_unique': {'type': ['integer', 'null']}}}}}
cve_search
CVE Search
Search CVE database with filters: product/vendor, severity, published date range, EPSS score, CWE, CVSS range, CISA KEV status. Default response is SLIM per-result (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources) — pass include='full' for description, cvss_breakdown, affected_products, references, first_seen_*. Verdict (sources_queried, falsifiable_fields, completeness, data_age) is at the response root — applies to the whole batch, not per-row. Product/vendor filters are EXACT NVD-canonical-token matches (not the common name — e.g. nginx is 'nginx_open_source'/'nginx_plus', vendor 'f5'); a low/zero count for a well-known product means the token differs, so for dependency/package lists use check_dependencies and for a domain's whole stack tech_stack_cve_audit (both auto-normalize tokens). Use for vulnerability discovery by criteria; pass cwe_id (e.g. CWE-79) to enumerate every CVE in our database mapped to a weakness — pair with cwe_lookup for the category description and mitigations. Use cve_lookup for single CVE by ID, kev_detail when kev=true filtering and the agent needs federal patch deadlines per result. Response carries a global hint pointing at cve_lookup — drill into any returned cve_id for full detail and chained pivots (exploit_lookup, kev_detail, cwe_lookup). Free: 30/hr, Pro: 500/hr. Returns {count, total, truncated, offset, summary, results, query_echo, next_offset, verdict, hint}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'cve_searchArguments', 'properties': {'kev': {'type': 'boolean', 'title': 'Kev', 'default': False, 'description': 'If true, return only CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog — these are actively exploited in the wild.'}, 'sort': {'enum': ['', 'published_desc', 'epss_desc', 'cvss_desc'], 'type': 'string', 'title': 'Sort', 'default': '', 'description': 'Sort order for results. Must be one of: published_desc (newest first), epss_desc (most exploitable first), cvss_desc (most severe first). Omit for newest first (default=published_desc).'}, 'limit': {'type': 'integer', 'title': 'Limit', 'default': 50, 'maximum': 200, 'minimum': 1, 'description': 'Maximum results to return. Range: 1-200.'}, 'cwe_id': {'type': 'string', 'title': 'Cwe Id', 'default': '', 'description': 'Filter by CWE weakness ID. Exact match, case-insensitive. Common values: CWE-79 (XSS), CWE-89 (SQL injection), CWE-120 (buffer overflow), CWE-78 (command injection). Format: CWE-<number>. Omit to not filter by CWE.'}, 'offset': {'type': 'integer', 'title': 'Offset', 'default': 0, 'maximum': 5000, 'minimum': 0, 'description': 'Skip N results for pagination. Use with limit to page through results.'}, 'vendor': {'type': 'string', 'title': 'Vendor', 'default': '', 'description': 'Filter by vendor name (case-insensitive). When combined with product, both must match the same CPE row — prevents cross-row false matches. Example: vendor=apache, product=struts.'}, 'include': {'enum': ['', 'full'], 'type': 'string', 'title': 'Include', 'default': '', 'description': "Per-result detail level. Default (omit) returns slim list items (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources). Pass 'full' to also return description, cvss_breakdown, affected_products, references, first_seen_source, first_seen_at — only do this when the user explicitly wants drill-down on every result. Even with 'full', per-result affected_products and references may be truncated (the per-result total_products/total_references report the honest counts); use cve_lookup for the guaranteed-complete per-CVE lists. For single-CVE detail prefer cve_lookup; slim default keeps token cost ~70% lower on Log4j-class queries. Note: verdict is at the response root, not per-row (was deduplicated to save ~40% payload)."}, 'product': {'type': 'string', 'title': 'Product', 'default': '', 'description': "Product or vendor token to filter by. EXACT match (case-insensitive) against the NVD-canonical CPE product/vendor token — NOT substring/fuzzy, and NOT necessarily the common project name. Common names, vendor renames, and build-tool artifact ids often differ from the canonical token (e.g. modern nginx CVEs are under 'nginx_open_source'/'nginx_plus', vendor 'f5', not 'nginx'; Maven 'log4j-core' maps to 'log4j'). A low or zero count for a well-known product usually means the token differs — do NOT assume coverage is complete. For dependency/package lists prefer check_dependencies, and for a domain's whole tech stack tech_stack_cve_audit (both auto-normalize tokens). A product match means CVEs exist for that product, not that a specific running version is affected — verify the running version is within each CVE's affected range. Omit to search all products."}, 'cvss_max': {'type': 'number', 'title': 'Cvss Max', 'default': 10.0, 'maximum': 10.0, 'minimum': 0.0, 'description': 'Maximum CVSS v3 base score (0.0-10.0). Default 10.0 = no filter (sentinel, not applied). Set < 10.0 to filter — CVEs with null CVSS are excluded when active. Combine with cvss_min for a range.'}, 'cvss_min': {'type': 'number', 'title': 'Cvss Min', 'default': 0.0, 'maximum': 10.0, 'minimum': 0.0, 'description': 'Minimum CVSS v3 base score (0.0-10.0). Default 0.0 = no filter (sentinel, not applied). Set > 0 to filter — CVEs with null CVSS are excluded when active. Use 7.0 for high+critical, 9.0 for critical only.'}, 'epss_min': {'type': 'number', 'title': 'Epss Min', 'default': 0.0, 'maximum': 1.0, 'minimum': 0.0, 'description': 'Minimum EPSS score filter (0.0-1.0). EPSS predicts exploitation probability. 0.5 = top ~5% most likely to be exploited. 0.0 = no filter.'}, 'severity': {'enum': ['', 'CRITICAL', 'HIGH', 'MEDIUM', 'LOW'], 'type': 'string', 'title': 'Severity', 'default': '', 'description': 'CVSS severity level. Must be one of: CRITICAL, HIGH, MEDIUM, LOW. Omit for all severities.'}, 'published_after': {'type': 'string', 'title': 'Published After', 'default': '', 'description': "Inclusive lower bound on publish date as YYYY-MM-DD (UTC). Pick this when the user names a starting point, e.g. 'since 2015' → '2015-01-01', 'after March 2024' → '2024-03-01'. Omit to not bound the lower edge. Combine with published_before for ranges."}, 'published_before': {'type': 'string', 'title': 'Published Before', 'default': '', 'description': "Inclusive upper bound on publish date as YYYY-MM-DD (UTC). Pick this when the user names an ending point, e.g. 'before 2020' → '2019-12-31', 'up to 2023' → '2023-12-31'. Omit to not bound the upper edge. Combine with published_after for ranges."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': [], 'properties': {'hint': {'type': ['object', 'null']}, 'count': {'type': 'integer'}, 'total': {'type': 'integer'}, 'offset': {'type': 'integer'}, 'results': {'type': 'array'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'truncated': {'type': 'boolean'}, 'next_calls': {'type': ['array', 'null']}, 'query_echo': {'type': ['object', 'null']}, 'next_offset': {'type': ['integer', 'null']}}}}}
cwe_lookup
CWE Lookup
Look up MITRE CWE (Common Weakness Enumeration) catalog record from research view 1000. Default response is SLIM (first 3 mitigations, first 3 examples; extended_description is null) — pass include='full' for the verbose record (full mitigations + examples lists, populated extended_description). Returns description, abstract type (Pillar/Class/Base/Variant/Compound), status (Stable/Draft/Incomplete/Deprecated), exploit likelihood, recommended mitigations, observed example CVEs, parent_cwe (walk up the hierarchy), child_cwes (drill down to more specific weaknesses), and cve_count (LOWER BOUND — counts only CVEs whose primary CWE matches; CVEs with multiple CWEs may not be counted). Use after cve_lookup or kev_detail to understand the underlying weakness category; chain with cve_search(cwe_id=...) to enumerate all matching CVEs. Returns 404 when the CWE is not in research view 1000. Free: 30/hr, Pro: 500/hr. Returns {cwe_id, name, description, extended_description (null on slim, populated on include='full'), abstract_type, status, likelihood, mitigations (first 3 by default), total_mitigations, examples (first 3 by default), total_examples, parent_cwe, child_cwes, cve_count, updated_at, verdict, next_calls}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'cwe_lookupArguments', 'required': ['cwe_id'], 'properties': {'cwe_id': {'type': 'string', 'title': 'Cwe Id', 'description': "CWE identifier — accepts 'CWE-79', 'cwe-79', or bare '79'. Common values: CWE-79 (XSS), CWE-89 (SQL injection), CWE-78 (command injection), CWE-502 (deserialization), CWE-22 (path traversal), CWE-120 (buffer overflow)."}, 'include': {'enum': ['', 'full'], 'type': 'string', 'title': 'Include', 'default': '', 'description': "Detail level. Default ('') returns slim record (first 3 mitigations, first 3 examples; extended_description is null). total_mitigations / total_examples are always honest pre-truncation counts. Pass 'full' to populate extended_description and return the full mitigations + examples lists."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['cwe_id', 'name'], 'properties': {'name': {'type': 'string'}, 'cwe_id': {'type': 'string'}, 'status': {'type': ['string', 'null']}, 'verdict': {'type': ['object', 'null']}, 'examples': {'type': 'array'}, 'cve_count': {'type': 'integer'}, 'child_cwes': {'type': 'array'}, 'likelihood': {'type': ['string', 'null']}, 'next_calls': {'type': ['array', 'null']}, 'parent_cwe': {'type': ['string', 'null']}, 'updated_at': {'type': ['string', 'null']}, 'description': {'type': ['string', 'null']}, 'mitigations': {'type': 'array'}, 'abstract_type': {'type': ['string', 'null']}, 'total_examples': {'type': ['integer', 'null']}, 'total_mitigations': {'type': ['integer', 'null']}, 'extended_description': {'type': ['string', 'null']}}}}}
d3fend_attack_coverage
D3FEND Attack Coverage
Batch coverage breakdown: given a list of ATT&CK T-codes, return distinct defense counts per D3FEND tactic + identify which techniques have NO D3FEND mapping (undefended_techniques). Use to assess the defensive posture of an entire attack campaign or threat model in one call. defended_techniques is the subset with at least one D3FEND defense; undefended_techniques are gaps worth flagging. Pair with cve_search per gap to identify exploit availability. Free: 30/hr, Pro: 500/hr. Returns {queried_techniques, coverage_by_tactic, defended_techniques, undefended_techniques, next_calls}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'd3fend_attack_coverageArguments', 'required': ['attack_technique_ids'], 'properties': {'attack_technique_ids': {'type': 'array', 'items': {'type': 'string'}, 'title': 'Attack Technique Ids', 'maxItems': 500, 'description': "List of ATT&CK technique ids (T#### or T####.###) to assess. Capped at 500 — extra entries are dropped server-side. Example: ['T1059', 'T1550.001', 'T1190', 'T9999']."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': [], 'properties': {'verdict': {'type': ['object', 'null']}, 'next_calls': {'type': ['array', 'null']}, 'coverage_by_tactic': {'type': 'object'}, 'queried_techniques': {'type': 'array'}, 'defended_techniques': {'type': 'array'}, 'undefended_techniques': {'type': 'array'}}}}}
d3fend_defense_for_attack
D3FEND Defense for Attack
Reverse lookup: given an ATT&CK T-code, return D3FEND defenses that mitigate it. This is the bridge from offensive intelligence (ATT&CK / ATLAS / CVE) to defensive playbook. Pair with cve_lookup or atlas_technique_lookup output — when those carry an ATT&CK id, call this tool to surface the mitigations. `defenses` is capped at `limit` (default 30) for token efficiency; `total` is the honest pre-truncation count and `truncated=true` flags when the cap was hit. `coverage_by_tactic` always aggregates the FULL set, not the slice. Default response is SLIM (drops `uri` from each row); pass include='full' for the verbose record. Pass exclude_id when drilling from d3fend_defense_lookup to skip self in the 'see also' list. Returns 200 with empty defenses list when the T-code has no D3FEND mapping (the gap is itself a signal). Free: 30/hr, Pro: 500/hr. Returns {attack_technique_id, total, truncated, defenses [{defense_id, label, uri (only when include=full), parent_label, tactic, artifact, attack_label, attack_tactic}], coverage_by_tactic, next_calls}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'd3fend_defense_for_attackArguments', 'required': ['attack_technique_id'], 'properties': {'limit': {'type': 'integer', 'title': 'Limit', 'default': 30, 'maximum': 200, 'minimum': 1, 'description': 'Cap on `defenses` array length. Default 30; popular T-codes (T1059, T1078) map to 30-50+ defenses. `total` and `coverage_by_tactic` always reflect the honest pre-truncation count.'}, 'include': {'enum': ['', 'full'], 'type': 'string', 'title': 'Include', 'default': '', 'description': "Detail level. Default (omit/empty) returns slim rows (drops the deterministic ontology `uri` — popular T-codes with 15+ defenses save ~900 chars). Pass 'full' to get `uri` back on every row."}, 'exclude_id': {'type': 'string', 'title': 'Exclude Id', 'default': '', 'description': "Optional D3FEND defense slug to omit from the defenses list. Used when chaining from d3fend_defense_lookup so the originating defense is not echoed back in its own 'see also' results."}, 'attack_technique_id': {'type': 'string', 'title': 'Attack Technique Id', 'description': "ATT&CK technique id matching 'T####' or 'T####.###' (e.g. 'T1059', 'T1550.001'). Use this to bridge from CVE/ATLAS findings to D3FEND mitigations."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['attack_technique_id'], 'properties': {'total': {'type': 'integer'}, 'verdict': {'type': ['object', 'null']}, 'defenses': {'type': 'array'}, 'truncated': {'type': 'boolean'}, 'next_calls': {'type': ['array', 'null']}, 'coverage_by_tactic': {'type': 'object'}, 'attack_technique_id': {'type': 'string'}}}}}
d3fend_defense_lookup
D3FEND Defense Lookup
Look up a MITRE D3FEND defense technique. D3FEND is the canonical defensive counterpart to ATT&CK — each defense is classified into one of 7 tactics (Model/Harden/Detect/Isolate/Deceive/Evict/Restore) and may target a specific digital artifact (e.g. 'Access Token'). Response includes attack_techniques: the list of ATT&CK T-codes this defense mitigates. Use after d3fend_defense_search for the full record + ATT&CK chain. Returns 404 when the slug is not in the synced D3FEND catalog. Free: 30/hr, Pro: 500/hr. Returns {defense_id, label, uri, parent_label, description, tactic, artifact, attack_techniques, next_calls}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'd3fend_defense_lookupArguments', 'required': ['defense_id'], 'properties': {'defense_id': {'type': 'string', 'title': 'Defense Id', 'description': "D3FEND defense slug from the ontology URI fragment (CamelCase), e.g. 'TokenBinding', 'FileHashing', 'CertificatePinning'."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['defense_id', 'label', 'uri', 'tactic'], 'properties': {'uri': {'type': 'string'}, 'label': {'type': 'string'}, 'tactic': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'artifact': {'type': ['string', 'null']}, 'defense_id': {'type': 'string'}, 'next_calls': {'type': ['array', 'null']}, 'description': {'type': ['string', 'null']}, 'parent_label': {'type': ['string', 'null']}, 'attack_techniques': {'type': 'array'}}}}}
d3fend_defense_search
D3FEND Defense Search
Search the MITRE D3FEND catalog of defensive techniques by keyword, tactic, or targeted artifact. Default response is SLIM (drops `uri` from each row — saves ~60 chars/row, ~30% on popular drills); pass include='full' for the verbose record. Pass exclude_id when chaining from d3fend_defense_lookup to skip self in sibling-artifact searches. Use to discover defenses applicable to a given threat model — e.g. 'what defenses harden access tokens?' (tactic=Harden + artifact='Access Token'). Drill into d3fend_defense_lookup with any returned defense_id for the ATT&CK technique mappings. Free: 30/hr, Pro: 500/hr. Returns {query, total, results [{defense_id, label, uri (only when include=full), parent_label, tactic, artifact}], next_calls}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'd3fend_defense_searchArguments', 'properties': {'limit': {'type': 'integer', 'title': 'Limit', 'default': 50, 'maximum': 200, 'minimum': 1, 'description': 'Max results to return. Range: 1-200.'}, 'tactic': {'enum': ['', 'Model', 'Harden', 'Detect', 'Isolate', 'Deceive', 'Evict', 'Restore'], 'type': 'string', 'title': 'Tactic', 'default': '', 'description': 'Filter by D3FEND tactic. One of: Model, Harden, Detect, Isolate, Deceive, Evict, Restore. Omit for all tactics.'}, 'include': {'enum': ['', 'full'], 'type': 'string', 'title': 'Include', 'default': '', 'description': "Detail level. Default (omit/empty) returns slim rows (drops the deterministic ontology `uri` field, ~60 chars/row saved). Pass 'full' to get `uri` back on every row. The slug `defense_id` is always returned and uniquely identifies the defense."}, 'keyword': {'type': 'string', 'title': 'Keyword', 'default': '', 'description': "Substring match against defense label, description, or parent_label (case-insensitive). Min 2 chars. Example: 'token', 'hashing', 'sandbox'. Omit to list all."}, 'artifact': {'type': 'string', 'title': 'Artifact', 'default': '', 'description': "Filter by exact targeted digital artifact (case-insensitive), e.g. 'Access Token', 'File', 'Process'. Omit for any artifact."}, 'exclude_id': {'type': 'string', 'title': 'Exclude Id', 'default': '', 'description': "Optional D3FEND defense slug (CamelCase, e.g. 'TokenBinding') to omit from results. Useful when chaining from d3fend_defense_lookup so the originating defense is not echoed back in its own siblings list. Omit when not needed."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': [], 'properties': {'query': {'type': 'object'}, 'total': {'type': 'integer'}, 'results': {'type': 'array'}, 'verdict': {'type': ['object', 'null']}, 'next_calls': {'type': ['array', 'null']}}}}}
dns_lookup
DNS Lookup
Query all DNS record types (A, AAAA, MX, NS, TXT, CNAME, SOA) for a domain. Use for mail routing inspection, nameserver verification, or SPF/DMARC checks; for full overview use domain_report. TXT records are returned raw (no filter) — `total_txt_records` always carries the honest count (use domain_report for the security-only filtered TXT view). Free: 30/hr, Pro: 500/hr. Returns {domain, records: {a, aaaa, mx, ns, txt, total_txt_records, cname, soa}, summary}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'dns_lookupArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Root domain to query, without protocol or path (e.g. 'example.com', 'cloudflare.com')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain', 'records'], 'properties': {'domain': {'type': 'string'}, 'records': {'type': 'object'}, 'summary': {'type': ['string', 'null']}, 'verdict': {'type': ['object', 'null']}, 'next_calls': {'type': ['array', 'null']}}}}}
domain_report
Domain Report
Query DNS, WHOIS, SSL, subdomains, and threat intel for a domain in one call. By default dns.txt is filtered to security-relevant entries (SPF, DMARC, DKIM, MTA-STS, TLS-RPT) and dns.total_txt_records reports the honest pre-filter count; pass include_all_txt=true for the raw TXT list. Use as a starting point for domain investigations; use audit_domain for live headers + tech stack. Response carries next_calls — chain with subdomain_enum (always emitted), ssl_check + tech_fingerprint (when an A record resolves) for the standard recon depth without re-prompting. Free: 30/hr, Pro: 500/hr. Returns domain report with DNS records, WHOIS data, SSL cert, risk score, email config, threat status, recommendation, and next_calls.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'domain_reportArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Root domain to analyze, without protocol or path (e.g. 'example.com', 'shopify.com')"}, 'include_all_txt': {'type': 'boolean', 'title': 'Include All Txt', 'default': False, 'description': 'Return every TXT record (default: False, only SPF/DMARC/DKIM/MTA-STS/TLS-RPT kept). dns.total_txt_records is always emitted with the honest pre-filter count. Default filter strips vendor verification strings (google-site-verification, ms=, facebook-domain-verification, etc.) that bloat the response without security signal. Set True only when you need the raw TXT inventory.'}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain'], 'properties': {'dns': {'type': ['object', 'null']}, 'ssl': {'type': ['object', 'null']}, 'waf': {'type': ['object', 'null']}, 'risk': {'type': ['object', 'null']}, 'whois': {'type': ['object', 'null']}, 'domain': {'type': 'string'}, 'threat': {'type': ['object', 'null']}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'next_calls': {'type': ['array', 'null']}, 'reputation': {'type': ['object', 'null']}, 'subdomains': {'type': ['object', 'null']}, 'reverse_dns': {'type': ['object', 'null']}, 'certificates': {'type': ['object', 'null']}, 'email_security': {'type': ['object', 'null']}}}}}
email_disposable
Email Disposable
Check if email address uses a known disposable/temporary provider (Guerrilla Mail, Temp Mail, Mailinator, etc.). Use for input validation to detect throwaway signups; for domain reputation use threat_intel. Companion email-investigation tools: email_mx (deliverability + MX trust), domain_report on the email's domain (full recon), threat_intel (malware-distribution signal on the domain). Free: 30/hr, Pro: 500/hr. Returns {disposable, domain, provider}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'email_disposableArguments', 'required': ['email'], 'properties': {'email': {'type': 'string', 'title': 'Email', 'description': "Full email address to check (e.g. 'user@tempmail.com', 'test@guerrillamail.com')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['email', 'domain'], 'properties': {'email': {'type': 'string'}, 'domain': {'type': 'string'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'provider': {'type': ['string', 'null']}, 'disposable': {'type': 'boolean'}, 'mx_records': {'type': 'array'}, 'next_calls': {'type': ['array', 'null']}, 'risk_level': {'type': 'string'}, 'mx_disposable': {'type': 'boolean'}}}}}
email_mx
Email MX
Analyze email security: MX records, SPF policy, DMARC policy, DKIM probe across common+date-based selectors, mail provider, grade. Use to verify email-auth setup and phishing risk; for full audit use domain_report. Free: 30/hr, Pro: 500/hr. email_security.dkim_status reports honest evidence: 'verified' iff at least one selector responded, else 'unverifiable' (custom selectors cannot be discovered without prior knowledge). Grade: when DKIM verified, A=SPF+DMARC+DKIM/B=2of3/C=1of3; when DKIM unverifiable, A=SPF+DMARC/B=one/F=neither — DKIM absence is NOT penalized because it is unprovable in DNS. Returns {mx_records, mail_provider, email_security:{spf, dmarc, dkim_selectors, dkim_status, grade, issues}, summary}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'email_mxArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Domain to analyze email configuration for (e.g. 'example.com', 'google.com')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain'], 'properties': {'domain': {'type': 'string'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'mx_records': {'type': 'array'}, 'next_calls': {'type': ['array', 'null']}, 'mail_provider': {'type': ['string', 'null']}, 'email_security': {'type': 'object'}}}}}
email_security_posture
Email Security Posture
Analyze domain email authentication posture: SPF, DMARC, DKIM with numeric score and findings. Dual-use: red-team (spoofing feasibility) + blue-team (posture audit). Score 0-100, grades A+-F. DKIM probing tests common selectors + recent dates; custom selectors must be supplied. Passive DNS-only; no SMTP probe. Free: 30/hr, Pro: 500/hr.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'email_security_postureArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Domain to audit email authentication posture for (e.g. 'example.com')"}, 'selectors': {'anyOf': [{'type': 'string'}, {'type': 'null'}], 'title': 'Selectors', 'default': None, 'description': 'Optional comma-separated custom DKIM selectors to probe'}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain', 'spf', 'dmarc', 'dkim', 'posture_score', 'posture_grade', 'all_findings', 'summary'], 'properties': {'spf': {'type': 'object'}, 'dkim': {'type': 'object'}, 'dmarc': {'type': 'object'}, 'domain': {'type': 'string'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'next_calls': {'type': ['array', 'null']}, 'all_findings': {'type': 'array'}, 'posture_grade': {'type': 'string'}, 'posture_score': {'type': 'integer'}}}}}
email_verify
Email Verify
One-call email validation combining syntax + MX records + disposable check + role-address detection (admin@/info@/...) + free-provider classification (gmail/outlook/yahoo/...). Use BEFORE adding an email to a contact list, sending an outbound message, or auditing a lead-list dump — replaces 2-3 tool calls (email_mx + email_disposable + manual role parse) with one structured response. Deliberately does NOT do SMTP `RCPT TO` deliverability probing — Hunter.io / NeverBounce-style mailbox enumeration is an ethical grey area we declined; use those services if you need that specific signal. role_address=true on `admin@`, `info@`, `noreply@`, `support@`, etc. (Gmail-style `+tag` is stripped before classification). free_provider=true on consumer-mailbox domains (B2B detection signal — a 'work' email at `@gmail.com` likely isn't a corporate user). Free: 30/hr, Pro: 500/hr. Returns {email, domain, syntax_valid, mx_records, disposable, disposable_provider, role_address, role_type, free_provider, summary}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'email_verifyArguments', 'required': ['email'], 'properties': {'email': {'type': 'string', 'title': 'Email', 'description': "Full email address to verify (e.g. 'admin@example.com', 'user@gmail.com'). Must contain '@'."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['email', 'domain', 'syntax_valid'], 'properties': {'email': {'type': 'string'}, 'domain': {'type': 'string'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'role_type': {'type': ['string', 'null']}, 'disposable': {'type': 'boolean'}, 'mx_records': {'type': 'array'}, 'next_calls': {'type': ['array', 'null']}, 'role_address': {'type': 'boolean'}, 'syntax_valid': {'type': 'boolean'}, 'free_provider': {'type': 'boolean'}, 'disposable_provider': {'type': ['string', 'null']}}}}}
exploit_lookup
Exploit Lookup
Search public exploits/PoC for a specific CVE across three sources: (1) GitHub Advisory Database (sources.github.advisories[]), (2) Shodan CVEDB references (sources.shodan_refs.results[] — packetstorm/seclists/vendor URLs cited by Shodan; results capped at SHODAN_REFS_LIMIT default 200, truncated=true when capped, count is the honest upstream total), (3) ExploitDB CSV mirror (exploits[] array, with edb_id + author + verified flag — these are the actual ExploitDB entries). Use to assess if a vulnerability has weaponized exploits in the wild; run after cve_lookup to evaluate real-world risk. When the CVE is also in CISA KEV (kev.in_kev=true on cve_lookup), pair with kev_detail for federal patch deadline; pair with cwe_lookup on cwe_id for the underlying weakness category and mitigations. Response carries next_calls — single cve_lookup pivot for full context (KEV status, CWE chain, CVSS, EPSS); cve_lookup's own next_calls then surface kev_detail and cwe_lookup automatically (this endpoint has no in_kev/cwe_id schema, so blind emission of those pivots is intentionally avoided). Free: 30/hr, Pro: 500/hr. Returns {cve_id, exploits_found, has_public_exploit, sources: {github, shodan_refs: {found, count, truncated, results}}, exploits: [{edb_id, cve_id, date_published, author, type, platform, url, verified, description}], summary, verdict, next_calls}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'exploit_lookupArguments', 'required': ['cve_id'], 'properties': {'cve_id': {'type': 'string', 'title': 'Cve Id', 'description': "CVE identifier in format CVE-YYYY-NNNNN (e.g. 'CVE-2024-3094', 'CVE-2023-44487')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['cve_id'], 'properties': {'cve_id': {'type': 'string'}, 'sources': {'type': 'object'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'exploits': {'type': 'array'}, 'next_calls': {'type': ['array', 'null']}, 'exploits_found': {'type': 'integer'}, 'has_public_exploit': {'type': 'boolean'}}}}}
geo_audit
Geo Audit
Deterministic GEO / AI-visibility readiness audit of a domain's homepage with a 0-100 score + a `missing_signals` fix list. Answers "can AI assistants (ChatGPT, Claude, Perplexity, Google AI) discover, crawl, and recommend this site?" using STRUCTURAL signals ONLY — no LLM is queried, fully deterministic. 7 weighted rules: llms.txt present (15), AI-crawler robots.txt access — 9 crawlers incl. GPTBot/ClaudeBot/PerplexityBot/Google-Extended/CCBot (25 — the dominant signal; blocking = invisible to that AI surface), schema.org @type coverage Organization/Product/FAQPage (20), server-side rendering vs client-only SPA (15 — a JS-only SPA serves AI crawlers empty HTML), discovery signals og/canonical/sitemap (10), semantic headings single-H1 + H2 structure (10), competitor-comparison content (5). Use to triage why a brand is absent from AI recommendations, as a pre-flight before GEO/AEO content work, or to score a prospect's AI-readiness. Strictly homepage-only — we do NOT crawl. Ethical floor: target's robots.txt is honoured — `Disallow: /` for ContrastAPI returns 403 `error.code = robots_txt_disallow` and we DO NOT fetch. `Cache-Control: no-store`/`private` skips our cache write (`cache_respected=false`). Per-target eTLD+1 throttle (60 req/min). Free: 30/hr, Pro: 500/hr. Returns {domain, fetched_url, status_code, llms_txt_present, ai_crawlers_total, ai_crawlers_allowed, ai_crawlers_blocked, schema_types, client_side_rendered, render_framework, has_canonical, og_tag_count, sitemap_count, h1_count, h2_count, comparison_content, score, missing_signals, cache_respected, summary}. Returns 502 on DNS/TCP/TLS failure; 403 `robots_txt_disallow` when the target opted out.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'geo_auditArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Registrable domain to audit for AI-visibility / GEO readiness (e.g. 'example.com', 'shopify.com'). No scheme, no path, no port. Strictly homepage-only — the bot fetches https://<domain>/ with HTTP fallback (we do NOT crawl)."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain', 'fetched_url', 'status_code', 'score'], 'properties': {'score': {'type': 'integer'}, 'domain': {'type': 'string'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'h1_count': {'type': 'integer'}, 'h2_count': {'type': 'integer'}, 'next_calls': {'type': ['array', 'null']}, 'fetched_url': {'type': 'string'}, 'status_code': {'type': 'integer'}, 'og_tag_count': {'type': 'integer'}, 'schema_types': {'type': 'array'}, 'has_canonical': {'type': 'boolean'}, 'sitemap_count': {'type': 'integer'}, 'cache_respected': {'type': 'boolean'}, 'missing_signals': {'type': 'array'}, 'llms_txt_present': {'type': 'boolean'}, 'render_framework': {'type': ['string', 'null']}, 'ai_crawlers_total': {'type': 'integer'}, 'comparison_content': {'type': 'boolean'}, 'ai_crawlers_allowed': {'type': 'integer'}, 'ai_crawlers_blocked': {'type': 'array'}, 'client_side_rendered': {'type': 'boolean'}}}}}
get_cvss_details
Get CVSS Details
Parse a CVSS v3.x vector string into a per-metric breakdown plus a recomputed base score. Returns the canonicalized vector, version (3.0 or 3.1), base_score, base_severity (NONE/LOW/MEDIUM/HIGH/CRITICAL), and the eight base metrics: attack_vector (NETWORK/ADJACENT_NETWORK/LOCAL/PHYSICAL), attack_complexity (LOW/HIGH), privileges_required (NONE/LOW/HIGH), user_interaction (NONE/REQUIRED), scope (UNCHANGED/CHANGED), and the three impact metrics confidentiality_impact / integrity_impact / availability_impact (NONE/LOW/HIGH each). When temporal/environmental metrics are explicit in the vector, temporal_score and environmental_score are populated separately. Use to translate raw CVSS strings into agent-friendly attributes without re-parsing the vector grammar yourself, and to verify upstream NVD scoring against the recomputed value. v2 vectors (AV:N/AC:L/Au:N/...) are rejected with 400 — read cvss_v2_vector from cve_lookup if you need v2 detail. Free: 30/hr, Pro: 500/hr. Returns {version, vector, base_score, base_severity, metrics: {attack_vector, attack_complexity, privileges_required, user_interaction, scope, confidentiality_impact, integrity_impact, availability_impact}, temporal_score, environmental_score, summary, verdict}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'get_cvss_detailsArguments', 'required': ['vector'], 'properties': {'vector': {'type': 'string', 'title': 'Vector', 'description': "CVSS v3.0 or v3.1 vector string, e.g. 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'. v2 vectors are rejected — use the cvss_v2_vector field on cve_lookup if you need v2."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['version', 'vector', 'base_score', 'base_severity', 'metrics', 'summary'], 'properties': {'vector': {'type': 'string'}, 'metrics': {'type': 'object'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'version': {'type': 'string'}, 'base_score': {'type': 'number'}, 'next_calls': {'type': ['array', 'null']}, 'base_severity': {'type': 'string'}, 'temporal_score': {'type': ['number', 'null']}, 'environmental_score': {'type': ['number', 'null']}}}}}
hash_lookup
Hash Lookup
Query MalwareBazaar for file hash (MD5/SHA1/SHA256): malware family, file type, size, tags, first/last seen, download count. Use to check if file hash is known malware; use ioc_lookup for auto-detection of all IOC types. Companion malware-investigation tools: ioc_lookup (multi-source: ThreatFox + Feodo Tracker + URLhaus), threat_intel (domain-level URLhaus check), exploit_lookup (link a known CVE to PoC code if the hash maps to an exploit binary). Free: 30/hr, Pro: 500/hr. Returns {found, malware_family, file_type, file_size, tags, first_seen, last_seen, signature}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'hash_lookupArguments', 'required': ['file_hash'], 'properties': {'file_hash': {'type': 'string', 'title': 'File Hash', 'description': "File hash to look up. Accepts MD5 (32 chars), SHA-1 (40 chars), or SHA-256 (64 chars). Lowercase hex only, no spaces. Example: 'd41d8cd98f00b204e9800998ecf8427e'"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['hash', 'hash_type'], 'properties': {'hash': {'type': 'string'}, 'tags': {'type': 'array'}, 'found': {'type': 'boolean'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'file_name': {'type': ['string', 'null']}, 'file_size': {'type': ['integer', 'null']}, 'file_type': {'type': ['string', 'null']}, 'hash_type': {'type': 'string'}, 'first_seen': {'type': ['string', 'null']}, 'next_calls': {'type': ['array', 'null']}, 'malware_family': {'type': ['string', 'null']}}}}}
ioc_lookup
IOC Lookup
Enrich Indicator of Compromise (IP/domain/URL/hash) by auto-detecting type and querying abuse.ch feeds. Per-type source coverage: hash → ThreatFox only (Feodo and URLhaus do not index hashes); IP → ThreatFox + Feodo Tracker + URLhaus; domain / URL → ThreatFox + URLhaus. verdict.sources_queried lists what actually ran; verdict.sources_unavailable lists what failed (timeout / upstream error). Use as primary IOC triage tool when type unknown; use threat_intel for domain-only, hash_lookup for richer MalwareBazaar hash data. Free: 30/hr, Pro: 500/hr. Returns {indicator, type, threat_level, sources, summary, verdict}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'ioc_lookupArguments', 'required': ['indicator'], 'properties': {'indicator': {'type': 'string', 'title': 'Indicator', 'description': "Indicator of Compromise: IP address, domain, full URL, or file hash in MD5/SHA1/SHA256 format (e.g. '8.8.8.8', 'evil.com', 'https://evil.com/malware.exe', 'd41d8cd98f00b204e9800998ecf8427e')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['indicator', 'type'], 'properties': {'type': {'type': 'string'}, 'sources': {'type': 'object'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'indicator': {'type': 'string'}, 'next_calls': {'type': ['array', 'null']}, 'threat_level': {'type': 'string'}}}}}
ip_lookup
IP Lookup
Query comprehensive IP intelligence: reverse DNS, ASN + holder name + country inline (RIPE Stat, Phase 1), open ports, hostnames, vulnerabilities (Shodan InternetDB enriched with severity + cvss_v3 from local cve.db — Phase 2 v1.16.0 BREAKING; vulns is now list[VulnInfo] {cve_id, severity, cvss_v3} dicts, pre-1.16 it was list[str] of CVE IDs; unknown CVEs emit severity='UNKNOWN' / cvss_v3=null — do NOT infer benign), cloud provider, Tor exit status, and reputation. cloud_provider uses two-tier detection: published cloud CIDR ranges (AWS/GCP/Cloudflare) first, then an ASN-to-provider fallback map for anycast/public-service IPs outside published ranges (e.g. 8.8.8.8 → AS15169 → 'Google'). Reputation: FireHOL level1 blocklist on Free tier; +AbuseIPDB + Shodan on Pro (Phase 4). Use for IP investigation; for orchestrated IP+reputation use threat_report. Response is null-explicit: every field is always present (cloud_provider=null when neither tier matches; tor_exit=false when not listed or upstream fetch failed — check verdict.sources_unavailable to disambiguate fetch failure from genuine absence). Response carries next_calls (conditional) — asn_lookup when ASN is populated, ioc_lookup when reputation is FireHOL-listed or AbuseIPDB confidence>50, threat_report on Pro tier for orchestrated profile. Free: 30/hr, Pro: 500/hr. Returns {ip, ptr, geo, asn, asn_name, country, ports, hostnames, vulns, cloud_provider, tor_exit, reputation, risk_score, verdict, next_calls}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'ip_lookupArguments', 'required': ['ip'], 'properties': {'ip': {'type': 'string', 'title': 'Ip', 'description': "IPv4 or IPv6 address to investigate (e.g. '8.8.8.8', '2606:4700::1111')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['ip'], 'properties': {'ip': {'type': 'string'}, 'asn': {'type': ['integer', 'null']}, 'ptr': {'type': ['string', 'null']}, 'cpes': {'type': 'array'}, 'tags': {'type': 'array'}, 'ports': {'type': 'array'}, 'vulns': {'type': 'array'}, 'country': {'type': ['string', 'null']}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'asn_name': {'type': ['string', 'null']}, 'tor_exit': {'type': 'boolean'}, 'hostnames': {'type': 'array'}, 'next_calls': {'type': ['array', 'null']}, 'reputation': {'type': ['object', 'null']}, 'risk_score': {'type': 'integer'}, 'is_datacenter': {'type': 'boolean'}, 'cloud_provider': {'type': ['string', 'null']}, 'severity_label': {'type': 'string'}}}}}
kev_detail
KEV Detail
Look up CISA KEV (Known Exploited Vulnerabilities) full record for a CVE. Returns federal patch deadline (due_date), CISA-specified required_action remediation, known ransomware association, vendor/product, the CISA-given common name (e.g. 'Log4Shell'), CISA-reported CWE list, plus lifecycle metadata: date_updated (when CISA last revised the entry), date_removed (set when CISA removed the CVE from the catalog — null while still active), and updated_at (our DB sync freshness). Returns 404 when the CVE is not in the KEV catalog — use cve_lookup for non-KEV CVEs. Best follow-up after cve_lookup or cve_search(kev=true) when an in_kev=true CVE is identified; chain with cwe_lookup on each returned CWE to investigate the weakness category. Free: 30/hr, Pro: 500/hr. Returns {cve_id, vendor_project, product, vulnerability_name, date_added, due_date, required_action, known_ransomware_use, notes, cwes, date_updated, date_removed, updated_at, verdict, next_calls}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'kev_detailArguments', 'required': ['cve_id'], 'properties': {'cve_id': {'type': 'string', 'title': 'Cve Id', 'description': "CVE identifier in format CVE-YYYY-NNNNN (e.g. 'CVE-2021-44228', 'CVE-2024-3094')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['cve_id'], 'properties': {'cwes': {'type': 'array'}, 'notes': {'type': ['string', 'null']}, 'cve_id': {'type': 'string'}, 'in_kev': {'type': 'boolean'}, 'product': {'type': ['string', 'null']}, 'verdict': {'type': ['object', 'null']}, 'due_date': {'type': ['string', 'null']}, 'date_added': {'type': ['string', 'null']}, 'next_calls': {'type': ['array', 'null']}, 'updated_at': {'type': ['string', 'null']}, 'date_removed': {'type': ['string', 'null']}, 'date_updated': {'type': ['string', 'null']}, 'vendor_project': {'type': ['string', 'null']}, 'required_action': {'type': ['string', 'null']}, 'short_description': {'type': ['string', 'null']}, 'vulnerability_name': {'type': ['string', 'null']}, 'known_ransomware_use': {'type': 'boolean'}}}}}
password_check
Password Check
Check if SHA-1 hash appears in Have I Been Pwned (HIBP) breach dataset using k-anonymity (5-char prefix only, full hash never leaves tool). Use for password breach audits; read-only, no data stored. Companion OSINT investigation tools: hash_lookup (file-hash malware family lookup, different namespace), email_disposable (throwaway-mail signal on associated accounts), username_lookup (social-platform exposure on associated handles). Free: 30/hr, Pro: 500/hr. Returns {found, count}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'password_checkArguments', 'required': ['sha1_hash'], 'properties': {'sha1_hash': {'type': 'string', 'title': 'Sha1 Hash', 'description': "Full SHA-1 hash of the password as 40 lowercase hexadecimal characters (e.g. '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8' for 'password')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['hash_prefix'], 'properties': {'found': {'type': 'boolean'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'next_calls': {'type': ['array', 'null']}, 'hash_prefix': {'type': 'string'}, 'breach_count': {'type': 'integer'}}}}}
phishing_check
Phishing Check
Query URLhaus for a specific URL and its host. is_malicious is True only when there is ACTIVE evidence — exact URL match with url_status='online' (or unknown) OR host has urls_online > 0. URLhaus retains historical records forever, so a host can have url_count > 0 with urls_online == 0; in that case is_malicious=False, is_stale=True, threat_level='low'. Use for URL-level threat assessment; use threat_intel for domain-level checks. Companion threat-investigation tools: ioc_lookup (multi-source IOC: ThreatFox + URLhaus + Feodo Tracker, auto-detect type), hash_lookup (file-hash malware family, MalwareBazaar), threat_intel (domain-level URLhaus only). Free: 30/hr, Pro: 500/hr. Returns {url, host, is_malicious, is_stale, urlhaus_host:{found,urls_online,url_count}, urlhaus_url:{found,threat,tags,status}, threat_level, summary}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'phishing_checkArguments', 'required': ['url'], 'properties': {'url': {'type': 'string', 'title': 'Url', 'description': "Full URL to check, including protocol (e.g. 'https://suspicious-login.com/verify', 'http://evil.com/payload.exe')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['url', 'host'], 'properties': {'url': {'type': 'string'}, 'host': {'type': 'string'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'is_stale': {'type': 'boolean'}, 'next_calls': {'type': ['array', 'null']}, 'urlhaus_url': {'type': 'object'}, 'is_malicious': {'type': 'boolean'}, 'threat_level': {'type': 'string'}, 'urlhaus_host': {'type': 'object'}}}}}
phone_lookup
Phone Lookup
Validate and analyze phone number: country, region, carrier, line type (mobile/landline/VoIP), timezone, formatted versions. Use to verify phone legitimacy and detect fraud risks. Requires E.164 format (+1234567890). Companion OSINT identity-investigation tools: username_lookup (social-platform handle correlation), email_disposable (throwaway-mail signal on associated email). Free: 30/hr, Pro: 500/hr. Returns {valid, country, region, carrier, carrier_status, line_type, timezone, formats}. carrier is omitted from the wire when libphonenumber has no mapping for the region (US/CA/GB and other MNP-restricted regions); always read carrier_status — 'known' means carrier is present, 'unsupported_region' means we cannot identify the carrier (do not infer the number lacks one).
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'phone_lookupArguments', 'required': ['number'], 'properties': {'number': {'type': 'string', 'title': 'Number', 'description': "Phone number in E.164 format: + followed by country code and number, no spaces or dashes. Examples: '+14155552671' (US), '+905551234567' (TR), '+442071234567' (UK). Wrong: '0555-123-4567', '(415) 555-2671'"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': [], 'properties': {'type': {'type': 'string'}, 'error': {'type': ['string', 'null']}, 'valid': {'type': 'boolean'}, 'format': {'type': ['object', 'null']}, 'number': {'type': 'string'}, 'carrier': {'type': ['string', 'null']}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'timezone': {'type': 'array'}, 'next_calls': {'type': ['array', 'null']}, 'country_code': {'type': 'string'}, 'country_name': {'type': 'string'}, 'carrier_status': {'type': ['string', 'null']}}}}}
redirect_chain
Redirect Chain
Walk an HTTP redirect chain hop-by-hop, returning per-hop {url, status_code, location, latency_ms}. Use to deobfuscate URL shorteners (bit.ly / t.co / lnkd.in), audit suspicious links from phishing investigations, or trace marketing tracking redirects. SSRF-guarded: each redirect target's resolved IP is re-validated before connecting (private IPs and non-HTTP schemes rejected). Up to 10 hops; loop_detected=true if a hop would revisit a previously-seen URL (we abort before the duplicate fetch); truncated=true if the chain still had a 30x at hop 10. Per-target eTLD+1 throttle (60 req/min) consumed once for the start host AND once per new host reached — a chain across 11 unrelated domains cannot bypass the cap. Free: 30/hr, Pro: 500/hr. Returns {start_url, final_url, hops, hop_count, final_status, loop_detected, truncated, summary}. Returns 502 ErrorResponse on hard fetch failure (timeout / TLS / connect); 429 with Retry-After if a hop's eTLD+1 throttle is exceeded mid-chain.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'redirect_chainArguments', 'required': ['url'], 'properties': {'url': {'type': 'string', 'title': 'Url', 'description': "Full URL whose redirect chain to walk, e.g. 'https://bit.ly/3xyz' or 'http://example.com/old-path'. Must start with http:// or https://. Pass the URL exactly as you'd `curl -L` it; the server handles encoding."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['start_url', 'final_url', 'hop_count', 'final_status'], 'properties': {'hops': {'type': 'array'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'final_url': {'type': 'string'}, 'hop_count': {'type': 'integer'}, 'start_url': {'type': 'string'}, 'truncated': {'type': 'boolean'}, 'next_calls': {'type': ['array', 'null']}, 'final_status': {'type': 'integer'}, 'loop_detected': {'type': 'boolean'}}}}}
robots_txt
Robots.txt
Fetch + parse the target domain's robots.txt — sitemaps, per-User-agent allow/disallow rules, crawl-delay, Host directive. Use BEFORE crawling/scraping a target site (seo_audit, brand_assets, redirect_chain) to honour the site's published rules. status_code=404 means no robots.txt exists = implicit allow-all per RFC 9309 §2.4. ContrastAPI fetches with `User-agent: ContrastAPI/<version> (+https://contrastcyber.com/bot)` so site operators can identify + opt out via robots.txt; we honour `Disallow: /` for our UA in seo_audit and brand_assets. Per-target eTLD+1 throttle (60 req/min) prevents weaponising this endpoint against a single site; subdomain rotation collapses to the same bucket. Free: 30/hr, Pro: 500/hr. Returns {domain, fetched_url, status_code, sitemaps, user_agents:{ua:{allow,disallow,crawl_delay}}, host, truncated, summary}. Returns 502 ErrorResponse if the target rejected the connection (DNS/TCP/TLS failure); the agent should NOT assume "no robots" in that case — it's an upstream-failure signal.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'robots_txtArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Registrable domain to fetch robots.txt for (e.g. 'example.com', 'github.com'). No scheme, no path, no port. Subdomains accepted; the bot fetches https://<domain>/robots.txt with HTTP fallback."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain', 'fetched_url', 'status_code'], 'properties': {'host': {'type': ['string', 'null']}, 'domain': {'type': 'string'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'sitemaps': {'type': 'array'}, 'truncated': {'type': 'boolean'}, 'next_calls': {'type': ['array', 'null']}, 'fetched_url': {'type': 'string'}, 'status_code': {'type': 'integer'}, 'user_agents': {'type': 'object'}}}}}
scan_headers
Scan Headers
Perform live HTTP GET and analyze security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Permissions-Policy, Referrer-Policy. Use to audit live website headers; use check_headers to validate headers you already have. Free: 30/hr, Pro: 500/hr. By default header values are truncated to 500 chars (CSP can exceed 4 KB on large sites); pass include='full' for the full raw value. Returns {headers_present, headers_missing, findings, total_score}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'scan_headersArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Domain to scan live HTTP headers for (e.g. 'example.com', 'api.github.com')"}, 'include': {'enum': ['', 'full'], 'type': 'string', 'title': 'Include', 'default': '', 'description': "Detail level. Default ('') returns slim findings — raw header values capped at 500 chars with total_value_length carrying the honest pre-truncation length. Pass 'full' to restore the full raw value (useful for inspecting full CSP directives on sites like GitHub where the CSP header exceeds 4 KB). Allowed: '' or 'full'."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain'], 'properties': {'url': {'type': 'string'}, 'grade': {'type': 'string'}, 'score': {'type': 'integer'}, 'domain': {'type': 'string'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'findings': {'type': 'array'}, 'next_calls': {'type': ['array', 'null']}, 'status_code': {'type': 'integer'}, 'headers_missing': {'type': 'array'}, 'headers_present': {'type': 'array'}}}}}
seo_audit
SEO Audit
One-shot SEO audit of a domain's homepage with a 0-100 composite score + a `missing_signals` list of concrete fixes. Use BEFORE pitching SEO work to a prospect, when triaging a lead's marketing maturity, or as a structured pre-flight before deeper auditing tools (Lighthouse / SEMrush). 10 audit rules each worth 10 pts: title present, title length 30-60 chars (Google SERP truncation window), meta description present, meta description length 50-160, exactly one H1, canonical link, >=3 OG tags, JSON-LD present, image alt-text coverage (proportional), HTTPS. Strictly homepage-only — we do NOT crawl the site. Ethical floor: target's robots.txt is honoured — `Disallow: /` for ContrastAPI OR `*` returns 403 `error.code = robots_txt_disallow` and we DO NOT fetch. `Cache-Control: no-store`/`private` skips our cache write (`cache_respected=false` in the response). Per-target eTLD+1 throttle (60 req/min) prevents weaponising via subdomain rotation. All target-derived strings/lists are `_untrusted`. Free: 30/hr, Pro: 500/hr. Returns {domain, fetched_url, status_code, title_untrusted, meta_description_untrusted, canonical_url, h1_untrusted, h1_count, h2_count, h3_count, images_total, images_missing_alt, internal_link_count, external_link_count, og_tags, json_ld_present, score, missing_signals, cache_respected, summary}. Returns 502 on DNS/TCP/TLS failure; 403 `robots_txt_disallow` when the target opted out.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'seo_auditArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Registrable domain to audit SEO for (e.g. 'example.com', 'shopify.com'). No scheme, no path, no port. Strictly homepage-only — the bot fetches https://<domain>/ with HTTP fallback and audits that single page (we do NOT crawl)."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain', 'fetched_url', 'status_code', 'score'], 'properties': {'score': {'type': 'integer'}, 'domain': {'type': 'string'}, 'og_tags': {'type': 'object'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'h1_count': {'type': 'integer'}, 'h2_count': {'type': 'integer'}, 'h3_count': {'type': 'integer'}, 'next_calls': {'type': ['array', 'null']}, 'fetched_url': {'type': 'string'}, 'status_code': {'type': 'integer'}, 'h1_untrusted': {'type': 'array'}, 'images_total': {'type': 'integer'}, 'canonical_url': {'type': ['string', 'null']}, 'cache_respected': {'type': 'boolean'}, 'json_ld_present': {'type': 'boolean'}, 'missing_signals': {'type': 'array'}, 'title_untrusted': {'type': ['string', 'null']}, 'images_missing_alt': {'type': 'integer'}, 'external_link_count': {'type': 'integer'}, 'internal_link_count': {'type': 'integer'}, 'meta_description_untrusted': {'type': ['string', 'null']}}}}}
sigma_rule_lookup
Sigma Rule Lookup
Look up a single Sigma detection rule by UUID from the SigmaHQ corpus (~3,200 rules, refreshed daily at 02:00 UTC). Returns the full rule with title, description, status (stable/test/experimental/deprecated/unsupported), level (informational/low/medium/high/critical), logsource (product/category/service), detection logic, tags (including attack.t#### ATT&CK technique refs and cve.YYYY-#### CVE refs), author, references, and modification date. Use to fetch a known rule for context (e.g., a SIEM detection that fired) or to inspect a rule discovered via REST sigma_rule_search. When a rule tags an ATT&CK technique or CVE, the response next_calls surfaces atlas_technique_lookup / cve_lookup as natural follow-ups. Free: 30/hr, Pro: 500/hr. Returns {rule, next_calls}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'sigma_rule_lookupArguments', 'required': ['rule_id'], 'properties': {'rule_id': {'type': 'string', 'title': 'Rule Id', 'maxLength': 50, 'description': "Sigma rule UUID (RFC 4122, 36 chars, hyphenated). Example: '195e1b9d-bfc2-4ffa-ab4e-35aef69815f8'. Obtained from the REST sigma_rule_search endpoint or external SIEM correlation."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['rule'], 'properties': {'rule': {'type': 'object'}, 'verdict': {'type': ['object', 'null']}, 'next_calls': {'type': ['array', 'null']}}}}}
ssl_check
SSL Check
Analyze SSL/TLS certificate: grade (A/B/C/D/F), protocol version, cipher suite, chain, expiry, Subject Alternative Names, and structured validation findings. Invalid certs (expired, self-signed, hostname mismatch, untrusted root) are reported as findings via valid=false + validation_errors[] rather than as endpoint failures, so an unreachable cert still returns useful intel. Grade D = cert readable but invalid; F = expired, legacy TLS, or probe failure. Use to audit certificate validity and detect expiring certs; for full domain audit use audit_domain. Free: 30/hr, Pro: 500/hr. Returns {grade, valid, validation_errors, protocol, cipher, issuer, subject, not_before, not_after, days_remaining, chain, san, warnings}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'ssl_checkArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Domain to check SSL/TLS certificate for (e.g. 'example.com', 'api.stripe.com')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain'], 'properties': {'san': {'type': 'array'}, 'chain': {'type': 'array'}, 'grade': {'type': 'string'}, 'valid': {'type': 'boolean'}, 'cipher': {'type': 'object'}, 'domain': {'type': 'string'}, 'issuer': {'type': 'string'}, 'subject': {'type': 'string'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'protocol': {'type': 'string'}, 'warnings': {'type': 'array'}, 'not_after': {'type': 'string'}, 'next_calls': {'type': ['array', 'null']}, 'not_before': {'type': 'string'}, 'serial_number': {'type': 'string'}, 'days_remaining': {'type': ['integer', 'null']}, 'validation_errors': {'type': 'array'}, 'signature_algorithm': {'type': ['string', 'null']}}}}}
subdomain_enum
Subdomain Enum
Discover subdomains using passive methods: Certificate Transparency logs + DNS brute-force (no active probing). Use to map organization's attack surface; non-intrusive. Response carries next_calls — capped at 5 ssl_check hints (one per first-five subdomain) so triage scales to large enumerations without token bloat; pull tail entries by name when needed. Free: 30/hr, Pro: 500/hr. Returns {domain, count, subdomains, sources, found_via_wordlist, found_via_crtsh, wildcard_status, crtsh_status, warnings, summary, next_calls}. Always check wildcard_status FIRST: 'absent' means the DNS brute-force plane was meaningful; 'present' means the zone answers every name (wildcard DNS) so wordlist results were discarded and count is a certificate-transparency LOWER BOUND — report the surface as UNKNOWN, not small, and never infer low exposure from it; 'undetermined' means a negative-control probe went unanswered, so count is unverified. Then check crtsh_status: 'ok' means the CT lookup completed (so a low count is real); 'timeout' / 'rate_limited' / 'unavailable' / 'error' means CT logs did not respond and the count is wordlist-only — the actual attack surface is likely larger, retry later or surface the limitation to the user.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'subdomain_enumArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Root domain to enumerate subdomains for (e.g. 'example.com', 'tesla.com')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain'], 'properties': {'count': {'type': 'integer'}, 'domain': {'type': 'string'}, 'sources': {'type': 'array'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'warnings': {'type': 'array'}, 'next_calls': {'type': ['array', 'null']}, 'subdomains': {'type': 'array'}, 'crtsh_status': {'type': 'string'}, 'found_via_crtsh': {'type': 'integer'}, 'wildcard_status': {'type': 'string'}, 'found_via_wordlist': {'type': 'integer'}}}}}
tech_fingerprint
Tech Fingerprint
Detect website technology stack: CMS, frameworks, CDN, analytics tools, web servers, languages (via HTTP headers + HTML analysis). Use for passive reconnaissance; for full audit use audit_domain. Free: 30/hr, Pro: 500/hr. Returns {technologies: [{name, category, confidence%, version}]}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'tech_fingerprintArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Domain to fingerprint (e.g. 'example.com', 'shopify.com')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain'], 'properties': {'count': {'type': 'integer'}, 'domain': {'type': 'string'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'categories': {'type': 'object'}, 'next_calls': {'type': ['array', 'null']}, 'technologies': {'type': 'array'}}}}}
tech_stack_cve_audit
Tech Stack CVE Audit
Composite tech-stack + CVE audit (MCP-only, no REST endpoint). Detects technologies on the target domain, queries CVE database for known vulnerabilities per product, enriches top-10 CVE candidates with CISA KEV federal patch deadlines, and checks public exploit / PoC availability. Identical for every tier — all data is sourced from local DB mirrors (no Shodan/AbuseIPDB), so there is no tier gating. CVE candidate batch: 50. Cost: 10 tokens per call — Free 30/hr ≈ 3 audits, Pro 500/hr ≈ 50 audits. Returns {domain, technologies, cves_by_tech, kev_findings, exploit_findings, summary, next_calls}.
Lecture seule
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'tech_stack_cve_auditArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'maxLength': 253, 'minLength': 1, 'description': "Target domain to fingerprint and CVE-audit (e.g. 'example.com'). IPs and internal hostnames are rejected."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain', 'technologies', 'summary'], 'properties': {'domain': {'type': 'string'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'next_calls': {'type': ['array', 'null']}, 'cves_by_tech': {'type': 'object'}, 'kev_findings': {'type': 'array'}, 'technologies': {'type': 'object'}, 'exploit_findings': {'type': 'array'}}}}}
threat_intel
Threat Intel
Check domain against abuse.ch URLhaus for known malware-distribution URLs (single source — for multi-feed correlation use ioc_lookup which adds ThreatFox and, for IPs, Feodo Tracker). Use for fast domain-level threat assessment; use phishing_check for specific URLs. Free: 30/hr, Pro: 500/hr. Returns {malware_urls, threat_tags, threat_status, summary}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'threat_intelArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Domain to check for threats (e.g. 'suspicious-site.com', 'example.com')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain', 'urlhaus_status'], 'properties': {'tags': {'type': 'array'}, 'urls': {'type': 'array'}, 'domain': {'type': 'string'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'url_count': {'type': 'integer'}, 'next_calls': {'type': ['array', 'null']}, 'urls_online': {'type': 'integer'}, 'threat_types': {'type': 'array'}, 'urlhaus_status': {'type': 'string'}}}}}
threat_report
Threat Report
Query comprehensive threat profile for an IP: Shodan host data, AbuseIPDB reputation, ASN/geolocation, and open ports. Use for IP investigation and SOC alert triage; for domain data use domain_report. Note: nested asn block always returns at most 50 IPv4/IPv6 prefixes — call asn_lookup with include_full_prefixes=True for the full announced-prefixes list. enrichment.vulns is severity-aware list[VulnInfo] (cve_id + severity + cvss_v3) — Phase 2 v1.16.0 BREAKING; pre-1.16 it was list[str] of CVE IDs. Free: 30/hr (costs 6 tokens), Pro: 500/hr. Returns {ip, enrichment, abuseipdb, shodan, asn, threat_level}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'threat_reportArguments', 'required': ['ip'], 'properties': {'ip': {'type': 'string', 'title': 'Ip', 'description': "Public IPv4 or IPv6 address to investigate (e.g. '8.8.8.8', '1.1.1.1'). Private/reserved IPs are rejected."}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['ip'], 'properties': {'ip': {'type': 'string'}, 'asn': {'type': 'object'}, 'ptr': {'type': ['string', 'null']}, 'shodan': {'type': 'object'}, 'country': {'type': ['string', 'null']}, 'firehol': {'type': ['object', 'null']}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'asn_name': {'type': ['string', 'null']}, 'tor_exit': {'type': 'boolean'}, 'abuseipdb': {'type': 'object'}, 'enrichment': {'type': 'object'}, 'next_calls': {'type': ['array', 'null']}, 'risk_score': {'type': 'integer'}, 'threat_level': {'type': 'string'}, 'is_datacenter': {'type': 'boolean'}, 'cloud_provider': {'type': ['string', 'null']}, 'severity_label': {'type': 'string'}}}}}
username_lookup
Username Lookup
Search for username across 15+ social/dev platforms (GitHub, Reddit, X/Twitter, LinkedIn, Instagram, TikTok, Discord, YouTube, Keybase, HackerOne, etc.). Use for OSINT investigations and identity verification. Free: 30/hr, Pro: 500/hr. Returns {username, total_found, platforms: [{name, exists, url, status_code}]}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'username_lookupArguments', 'required': ['username'], 'properties': {'username': {'type': 'string', 'title': 'Username', 'description': "Username string to search across platforms, without @ prefix (e.g. 'torvalds', 'johndoe', 'elonmusk')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': [], 'properties': {'error': {'type': ['string', 'null']}, 'results': {'type': 'array'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'username': {'type': 'string'}, 'next_calls': {'type': ['array', 'null']}, 'found_count': {'type': 'integer'}, 'checked_count': {'type': 'integer'}}}}}
wayback_lookup
Wayback Lookup
Retrieve Wayback Machine snapshots for a domain: first capture, latest, total count, snapshot list. Use to investigate domain history and age; for full audit use domain_report. Free: 30/hr, Pro: 500/hr. status='ok' means the count is authoritative (even when 0 → confirmed no archives). status='unavailable' means CDX timed out/rate-limited/5xx — total_snapshots is OMITTED (unknown, NOT zero) and the agent should NOT report "no snapshots"; the warnings[] array carries the cdx_* error code (cdx_timeout/cdx_rate_limited/cdx_unavailable/cdx_error/cdx_parse_error/cdx_body_too_large). Heavy domains (kernel.org, microsoft.com, archive.org itself) frequently time out the CDX endpoint despite having millions of snapshots — fall back to archive_url for manual inspection. Returns {domain, status, total_snapshots, first_seen, last_seen, years_online, snapshots, archive_url, summary, warnings}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'wayback_lookupArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Domain to look up in web archives (e.g. 'example.com', 'archive.org')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain'], 'properties': {'domain': {'type': 'string'}, 'status': {'type': 'string'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'warnings': {'type': 'array'}, 'last_seen': {'type': ['string', 'null']}, 'snapshots': {'type': 'array'}, 'first_seen': {'type': ['string', 'null']}, 'next_calls': {'type': ['array', 'null']}, 'archive_url': {'type': 'string'}, 'years_online': {'type': ['integer', 'null']}, 'total_snapshots': {'type': ['integer', 'null']}}}}}
whois_lookup
WHOIS Lookup
Retrieve WHOIS registration data: registrar, creation/expiry dates, nameservers, status. Use to verify domain ownership, age, expiration; for full audit use domain_report. Free: 30/hr, Pro: 500/hr. Returns {domain, whois: {registrar, creation_date, expiry_date, updated_date, name_servers, status, raw_length, error}, summary}.
Lecture seule
Accès externe
Idempotent
Schéma d’entrée
{'type': 'object', 'title': 'whois_lookupArguments', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'title': 'Domain', 'description': "Root domain to query WHOIS for (e.g. 'example.com', 'github.com')"}}}
Schéma de sortie
{'type': 'object', 'required': ['result'], 'properties': {'result': {'type': 'object', 'required': ['domain', 'whois'], 'properties': {'whois': {'type': 'object'}, 'domain': {'type': 'string'}, 'summary': {'type': 'string'}, 'verdict': {'type': ['object', 'null']}, 'next_calls': {'type': ['array', 'null']}}}}}
Historique
Modifications récentes des outils
Ajouté
check_headers
17 September 2026 12:34
Ajouté
username_lookup
17 September 2026 12:34
Ajouté
check_dependencies
17 September 2026 12:34
Ajouté
check_injection
17 September 2026 12:34
Ajouté
check_secrets
17 September 2026 12:34
Ajouté
bulk_ioc_lookup
17 September 2026 12:34
Ajouté
phishing_check
17 September 2026 12:34
Ajouté
password_check
17 September 2026 12:34
Ajouté
hash_lookup
17 September 2026 12:34
Ajouté
ioc_lookup
17 September 2026 12:34
Ajouté
bulk_sigma_rule_lookup
17 September 2026 12:34
Ajouté
sigma_rule_lookup
17 September 2026 12:34
Ajouté
d3fend_attack_coverage
17 September 2026 12:34
Ajouté
d3fend_defense_for_attack
17 September 2026 12:34
Ajouté
d3fend_defense_search
17 September 2026 12:34
Ajouté
d3fend_defense_lookup
17 September 2026 12:34
Ajouté
atlas_case_study_search
17 September 2026 12:34
Ajouté
atlas_case_study_lookup
17 September 2026 12:34
Ajouté
atlas_technique_search
17 September 2026 12:34
Ajouté
bulk_atlas_technique_lookup
17 September 2026 12:34
Ajouté
atlas_technique_lookup
17 September 2026 12:34
Ajouté
cwe_lookup
17 September 2026 12:34
Ajouté
kev_detail
17 September 2026 12:34
Ajouté
bulk_cve_lookup
17 September 2026 12:34
Ajouté
exploit_lookup
17 September 2026 12:34
Ajouté
cve_leading
17 September 2026 12:34
Ajouté
cve_search
17 September 2026 12:34
Ajouté
get_cvss_details
17 September 2026 12:34
Ajouté
calculate_risk_score
17 September 2026 12:34
Ajouté
cve_lookup
17 September 2026 12:34
Découvrir
Serveurs MCP similaires
hyperion
com.thetempleofdoom.hyperion/hyperion
Acts as a paid MCP tool marketplace and utility gateway with server discovery, HTTP and JavaScript tools, research, data conversi…
Vee3
io.github.Vee3io/vee3
Manages Clerk authentication infrastructure, including users, organizations, domains, sessions, tokens, OAuth, SSO, machines, per…
IA-QA — 130+ QA & Dev Tools for AI Agents
io.github.JcJamet/ia-qa-toolbox
Provides deterministic QA, evaluation, testing, code analysis, prompt and RAG checks, model comparison, and web security diagnost…
validoria-mcp
com.validoria/validoria-mcp
Runs continuous website, API, and webshop tests covering security, SEO, performance, accessibility, browser journeys, and inciden…
HubVibe: Pay-per-Call Tools for AI Agents: Web Search, Email Verify, KYC, Stocks, Crypto, News, Data
io.github.Its-fortunatefolly/hubvibe
Offers paid utilities for web audits, HTTP fetching and extraction, BigQuery analysis, LLM processing, code execution, blockchain…
developer-tools
net.programmes/developer-tools
Provides general-purpose developer utilities for encoding, hashing, encryption, JSON, HTML, CSS, networking, and related data tra…
Qiniso
io.github.qinisolabs/qiniso
Provides deterministic formatting, parsing, holiday and tax lookups, address handling, and checksum or structure validation for i…
CipherHUB Cryptography Toolkit
io.github.bowenerchen/cipherhub
Provides cryptographic operations including key generation, encryption, signing, verification, hashing, certificates, CMS, COSE, …