Contrastapi — Security Intelligence

SSE

by UPinar

361 downloads Not rated yet

GitHub Website SSE

About

Security intelligence API for AI models. CVE lookup with EPSS/KEV enrichment, domain reconnaissance (DNS, WHOIS, SSL, subdomains, WAF detection), and code security checks (secrets, injection, headers). No API key required.

Details

Transport: SSE

Explore

- Search 340,000+ vulnerabilities with EPSS exploit probability and CISA KEV status
- Full domain reconnaissance: DNS, WHOIS, SSL, subdomains, and WAF detection
- Secret detection for hardcoded API keys, tokens, and passwords (14 patterns)
- Injection detection for SQL, command, and path traversal patterns
- HTTP security header validation against best practices
- Dependency checking of packages against the CVE database

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name Contrastapi — Security Intelligence

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "contrastapi \u2014 security intelligence": {
            "contrastapi": {
                "url": "https://mcp.contrastcyber.com/mcp"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "contrastapi \u2014 security intelligence": {
            "contrastapi": {
                "url": "https://mcp.contrastcyber.com/mcp"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "contrastapi \u2014 security intelligence": {
            "contrastapi": {
                "url": "https://mcp.contrastcyber.com/mcp"
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "contrastapi \u2014 security intelligence": {
            "contrastapi": {
                "url": "https://mcp.contrastcyber.com/mcp"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "contrastapi \u2014 security intelligence": {
            "contrastapi": {
                "url": "https://mcp.contrastcyber.com/mcp"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "contrastapi \u2014 security intelligence": {
            "contrastapi": {
                "url": "https://mcp.contrastcyber.com/mcp"
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "contrastapi \u2014 security intelligence": {
            "contrastapi": {
                "url": "https://mcp.contrastcyber.com/mcp"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "contrastapi \u2014 security intelligence": {
            "contrastapi": {
                "url": "https://mcp.contrastcyber.com/mcp"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "contrastapi \u2014 security intelligence": {
            "contrastapi": {
                "url": "https://mcp.contrastcyber.com/mcp"
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "contrastapi \u2014 security intelligence": {
            "contrastapi": {
                "url": "https://mcp.contrastcyber.com/mcp"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "contrastapi \u2014 security intelligence": {
            "contrastapi": {
                "url": "https://mcp.contrastcyber.com/mcp"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "contrastapi \u2014 security intelligence": {
            "contrastapi": {
                "url": "https://mcp.contrastcyber.com/mcp"
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "contrastapi \u2014 security intelligence": {
            "contrastapi": {
                "url": "https://mcp.contrastcyber.com/mcp"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "contrastapi \u2014 security intelligence": {
            "contrastapi": {
                "url": "https://mcp.contrastcyber.com/mcp"
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "contrastapi \u2014 security intelligence": {
            "contrastapi": {
                "url": "https://mcp.contrastcyber.com/mcp"
            }
        }
    }
}

From the repository

Add the server to your MCP client configuration. No API key is required. The free tier allows up to 100 requests per hour.

`domain_report`

Query DNS, WHOIS, SSL, subdomains, and threat intel for a domain in one call. By default dns.txt is filtered to security-relevant entries (SPF, DMARC, DKIM, MTA-STS, TLS-RPT) and dns.total_txt_records reports the honest pre-filter count; pass include_all_txt=true for the raw TXT list. Use as a starting point for domain investigations; use audit_domain for live headers + tech stack. Response carries next_calls — chain with subdomain_enum (always emitted), ssl_check + tech_fingerprint (when an …

`audit_domain`

Perform comprehensive domain audit: combines domain_report + live HTTP security headers + technology fingerprinting. By default report.dns.txt is filtered to security-relevant entries (SPF, DMARC, DKIM, MTA-STS, TLS-RPT) and report.dns.total_txt_records reports the honest pre-filter count; pass include_all_txt=true for the raw TXT list. Use when you need the full picture (recon + active checks); use domain_report for passive-only assessment. Response carries next_calls — chain with subdomain_…

`contrast_scan`

Active website security scan: runs the ContrastScan C engine (11 modules — HTTP security headers, SSL/TLS, DNS, redirect chain, information disclosure, cookie flags, DNSSEC, HTTP methods, CORS, HTML hygiene, deep CSP analysis) against the live site and enriches the raw result with severity-ranked vulnerability findings and a letter grade. Use for a hands-on misconfiguration scan; use audit_domain for passive recon (DNS/WHOIS/SSL/threat intel) and scan_headers for headers only. Active outbound…

`tech_stack_cve_audit`

Composite tech-stack + CVE audit (MCP-only, no REST endpoint). Detects technologies on the target domain, queries CVE database for known vulnerabilities per product, enriches top-10 CVE candidates with CISA KEV federal patch deadlines, and checks public exploit / PoC availability. Identical for every tier — all data is sourced from local DB mirrors (no Shodan/AbuseIPDB), so there is no tier gating. CVE candidate batch: 50. Cost: 10 tokens per call — Free 30/hr ≈ 3 audits, Pro 500/hr ≈ 50 audi…

`threat_report`

Query comprehensive threat profile for an IP: Shodan host data, AbuseIPDB reputation, ASN/geolocation, and open ports. Use for IP investigation and SOC alert triage; for domain data use domain_report. Note: nested asn block always returns at most 50 IPv4/IPv6 prefixes — call asn_lookup with include_full_prefixes=True for the full announced-prefixes list. enrichment.vulns is severity-aware list[VulnInfo] (cve_id + severity + cvss_v3) — Phase 2 v1.16.0 BREAKING; pre-1.16 it was list[str] of CVE…

`dns_lookup`

Query all DNS record types (A, AAAA, MX, NS, TXT, CNAME, SOA) for a domain. Use for mail routing inspection, nameserver verification, or SPF/DMARC checks; for full overview use domain_report. TXT records are returned raw (no filter) — `total_txt_records` always carries the honest count (use domain_report for the security-only filtered TXT view). Free: 30/hr, Pro: 500/hr. Returns {domain, records: {a, aaaa, mx, ns, txt, total_txt_records, cname, soa}, summary}.

`whois_lookup`

Retrieve WHOIS registration data: registrar, creation/expiry dates, nameservers, status. Use to verify domain ownership, age, expiration; for full audit use domain_report. Free: 30/hr, Pro: 500/hr. Returns {domain, whois: {registrar, creation_date, expiry_date, updated_date, name_servers, status, raw_length, error}, summary}.

`ssl_check`

Analyze SSL/TLS certificate: grade (A/B/C/D/F), protocol version, cipher suite, chain, expiry, Subject Alternative Names, and structured validation findings. Invalid certs (expired, self-signed, hostname mismatch, untrusted root) are reported as findings via valid=false + validation_errors[] rather than as endpoint failures, so an unreachable cert still returns useful intel. Grade D = cert readable but invalid; F = expired, legacy TLS, or probe failure. Use to audit certificate validity and d…

`subdomain_enum`

Discover subdomains using passive methods: Certificate Transparency logs + DNS brute-force (no active probing). Use to map organization's attack surface; non-intrusive. Response carries next_calls — capped at 5 ssl_check hints (one per first-five subdomain) so triage scales to large enumerations without token bloat; pull tail entries by name when needed. Free: 30/hr, Pro: 500/hr. Returns {domain, count, subdomains, sources, found_via_wordlist, found_via_crtsh, wildcard_status, crtsh_status, w…

`tech_fingerprint`

Detect website technology stack: CMS, frameworks, CDN, analytics tools, web servers, languages (via HTTP headers + HTML analysis). Use for passive reconnaissance; for full audit use audit_domain. Free: 30/hr, Pro: 500/hr. Returns {technologies: [{name, category, confidence%, version}]}.

`threat_intel`

Check domain against abuse.ch URLhaus for known malware-distribution URLs (single source — for multi-feed correlation use ioc_lookup which adds ThreatFox and, for IPs, Feodo Tracker). Use for fast domain-level threat assessment; use phishing_check for specific URLs. Free: 30/hr, Pro: 500/hr. Returns {malware_urls, threat_tags, threat_status, summary}.

`wayback_lookup`

Retrieve Wayback Machine snapshots for a domain: first capture, latest, total count, snapshot list. Use to investigate domain history and age; for full audit use domain_report. Free: 30/hr, Pro: 500/hr. status='ok' means the count is authoritative (even when 0 → confirmed no archives). status='unavailable' means CDX timed out/rate-limited/5xx — total_snapshots is OMITTED (unknown, NOT zero) and the agent should NOT report "no snapshots"; the warnings[] array carries the cdx_* error code (cdx_…

`scan_headers`

Perform live HTTP GET and analyze security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Permissions-Policy, Referrer-Policy. Use to audit live website headers; use check_headers to validate headers you already have. Free: 30/hr, Pro: 500/hr. By default header values are truncated to 500 chars (CSP can exceed 4 KB on large sites); pass include='full' for the full raw value. Returns {headers_present, headers_missing, findings, total_score}.

`email_mx`

Analyze email security: MX records, SPF policy, DMARC policy, DKIM probe across common+date-based selectors, mail provider, grade. Use to verify email-auth setup and phishing risk; for full audit use domain_report. Free: 30/hr, Pro: 500/hr. email_security.dkim_status reports honest evidence: 'verified' iff at least one selector responded, else 'unverifiable' (custom selectors cannot be discovered without prior knowledge). Grade: when DKIM verified, A=SPF+DMARC+DKIM/B=2of3/C=1of3; when DKIM un…

`email_security_posture`

Analyze domain email authentication posture: SPF, DMARC, DKIM with numeric score and findings. Dual-use: red-team (spoofing feasibility) + blue-team (posture audit). Score 0-100, grades A+-F. DKIM probing tests common selectors + recent dates; custom selectors must be supplied. Passive DNS-only; no SMTP probe. Free: 30/hr, Pro: 500/hr.

`email_disposable`

Check if email address uses a known disposable/temporary provider (Guerrilla Mail, Temp Mail, Mailinator, etc.). Use for input validation to detect throwaway signups; for domain reputation use threat_intel. Companion email-investigation tools: email_mx (deliverability + MX trust), domain_report on the email's domain (full recon), threat_intel (malware-distribution signal on the domain). Free: 30/hr, Pro: 500/hr. Returns {disposable, domain, provider}.

`email_verify`

One-call email validation combining syntax + MX records + disposable check + role-address detection (admin@/info@/...) + free-provider classification (gmail/outlook/yahoo/...). Use BEFORE adding an email to a contact list, sending an outbound message, or auditing a lead-list dump — replaces 2-3 tool calls (email_mx + email_disposable + manual role parse) with one structured response. Deliberately does NOT do SMTP `RCPT TO` deliverability probing — Hunter.io / NeverBounce-style mailbox enumera…

`robots_txt`

Fetch + parse the target domain's robots.txt — sitemaps, per-User-agent allow/disallow rules, crawl-delay, Host directive. Use BEFORE crawling/scraping a target site (seo_audit, brand_assets, redirect_chain) to honour the site's published rules. status_code=404 means no robots.txt exists = implicit allow-all per RFC 9309 §2.4. ContrastAPI fetches with `User-agent: ContrastAPI/<version> (+https://contrastcyber.com/bot)` so site operators can identify + opt out via robots.txt; we honour `Disall…

`redirect_chain`

Walk an HTTP redirect chain hop-by-hop, returning per-hop {url, status_code, location, latency_ms}. Use to deobfuscate URL shorteners (bit.ly / t.co / lnkd.in), audit suspicious links from phishing investigations, or trace marketing tracking redirects. SSRF-guarded: each redirect target's resolved IP is re-validated before connecting (private IPs and non-HTTP schemes rejected). Up to 10 hops; loop_detected=true if a hop would revisit a previously-seen URL (we abort before the duplicate fetch)…

`brand_assets`

Scrape a domain's homepage `<head>` for public brand assets — favicon, og:image, theme-color, og:site_name, JSON-LD `Organization.logo`. Use to enrich CRM records, build company-card UIs, or correlate a lead's site to their visual identity (no manual screenshot required). Strictly homepage-only (path `/`); we do NOT crawl. Ethical floor: target's robots.txt is honoured — `Disallow: /` for ContrastAPI OR `*` returns 403 `error.code = robots_txt_disallow` and we DO NOT fetch. `Cache-Control: no…

`seo_audit`

One-shot SEO audit of a domain's homepage with a 0-100 composite score + a `missing_signals` list of concrete fixes. Use BEFORE pitching SEO work to a prospect, when triaging a lead's marketing maturity, or as a structured pre-flight before deeper auditing tools (Lighthouse / SEMrush). 10 audit rules each worth 10 pts: title present, title length 30-60 chars (Google SERP truncation window), meta description present, meta description length 50-160, exactly one H1, canonical link, >=3 OG tags, …

`geo_audit`

Deterministic GEO / AI-visibility readiness audit of a domain's homepage with a 0-100 score + a `missing_signals` fix list. Answers "can AI assistants (ChatGPT, Claude, Perplexity, Google AI) discover, crawl, and recommend this site?" using STRUCTURAL signals ONLY — no LLM is queried, fully deterministic. 7 weighted rules: llms.txt present (15), AI-crawler robots.txt access — 9 crawlers incl. GPTBot/ClaudeBot/PerplexityBot/Google-Extended/CCBot (25 — the dominant signal; blocking = invisible …

`phone_lookup`

Validate and analyze phone number: country, region, carrier, line type (mobile/landline/VoIP), timezone, formatted versions. Use to verify phone legitimacy and detect fraud risks. Requires E.164 format (+1234567890). Companion OSINT identity-investigation tools: username_lookup (social-platform handle correlation), email_disposable (throwaway-mail signal on associated email). Free: 30/hr, Pro: 500/hr. Returns {valid, country, region, carrier, carrier_status, line_type, timezone, formats}. car…

`ip_lookup`

Query comprehensive IP intelligence: reverse DNS, ASN + holder name + country inline (RIPE Stat, Phase 1), open ports, hostnames, vulnerabilities (Shodan InternetDB enriched with severity + cvss_v3 from local cve.db — Phase 2 v1.16.0 BREAKING; vulns is now list[VulnInfo] {cve_id, severity, cvss_v3} dicts, pre-1.16 it was list[str] of CVE IDs; unknown CVEs emit severity='UNKNOWN' / cvss_v3=null — do NOT infer benign), cloud provider, Tor exit status, and reputation. cloud_provider uses two-tie…

`asn_lookup`

Look up Autonomous System Number (ASN) for a domain or IP: AS number, organization, IPv4/IPv6 prefixes. Use to identify network operator and IP range ownership. Default returns first 50 prefixes per family — set include_full_prefixes=True for full list. Free: 30/hr, Pro: 500/hr. Returns {asn, asn_name, ipv4_prefixes, ipv6_prefixes, ipv4_count, ipv6_count}.

`cve_lookup`

Retrieve detailed CVE data by ID: description, CVSS v3.1 + vector, CVSS v2 (always emitted), EPSS score + percentile, CISA KEV status (expanded: due_date, required_action, ransomware flag, vendor_project, product, vulnerability_name, short_description, notes, cwes, date_removed when in_kev=true), NVD vulnerability_status (Analyzed/Modified/Awaiting Analysis/Deferred/Rejected/Withdrawn), cve_tags ('disputed' triggers [DISPUTED] summary prefix), affected products (CPE), references, patch availa…

`calculate_risk_score`

Composite CVE risk score (0-100) — fuses CVSS, EPSS, KEV, and PoC into a single agent-ready triage signal. Formula: CVSS*0.20 + EPSS*0.35 + KEV*0.30 + PoC*0.15 (each component rescaled to 0-100 before weighting). Multiplicative boosters applied in order: KEV+PoC combo (*1.15), critical-severity-with-high-EPSS (CVSS>=9 AND EPSS>0.7, *1.10), recently published (within last 7 days, *1.05). Final score clamped to [0, 100]. Label bands: CRITICAL>=90, HIGH>=70, MEDIUM>=40, LOW<40. Urgency text enco…

`get_cvss_details`

Parse a CVSS v3.x vector string into a per-metric breakdown plus a recomputed base score. Returns the canonicalized vector, version (3.0 or 3.1), base_score, base_severity (NONE/LOW/MEDIUM/HIGH/CRITICAL), and the eight base metrics: attack_vector (NETWORK/ADJACENT_NETWORK/LOCAL/PHYSICAL), attack_complexity (LOW/HIGH), privileges_required (NONE/LOW/HIGH), user_interaction (NONE/REQUIRED), scope (UNCHANGED/CHANGED), and the three impact metrics confidentiality_impact / integrity_impact / availa…

`cve_search`

Search CVE database with filters: product/vendor, severity, published date range, EPSS score, CWE, CVSS range, CISA KEV status. Default response is SLIM per-result (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources) — pass include='full' for description, cvss_breakdown, affected_products, references, first_seen_*. Verdict (sources_queried, falsifiable_fields, completeness, data_age) is at the response root — applies to the whole batch, not per…

`cve_leading`

List CVEs indexed from MITRE/GHSA BEFORE NVD publication (early-warning, freshest data). By default each result is slim (no description, no cvss_breakdown, no affected_products list, no references) — pass include='full' for the same payload shape as cve_lookup; for drill-down on a single CVE prefer cve_lookup. Use for threat intelligence on emerging CVEs; use cve_search for published NVD data. Verdict (sources_queried, falsifiable_fields, completeness, data_age) is at the response root — appl…

`exploit_lookup`

Search public exploits/PoC for a specific CVE across three sources: (1) GitHub Advisory Database (sources.github.advisories[]), (2) Shodan CVEDB references (sources.shodan_refs.results[] — packetstorm/seclists/vendor URLs cited by Shodan; results capped at SHODAN_REFS_LIMIT default 200, truncated=true when capped, count is the honest upstream total), (3) ExploitDB CSV mirror (exploits[] array, with edb_id + author + verified flag — these are the actual ExploitDB entries). Use to assess if a v…

`bulk_cve_lookup`

Batch query multiple CVEs (up to 50 per call, same for Free and Pro): retrieve full CVE details for all in 1 request instead of N. By default each CVE's affected_products is truncated to the first 20 entries (total_products reports honest count) and references to the first 10 (total_references reports honest count); pass include_affected_products=true / include_full_references=true to return full lists. Pass include_reference_tags=true to receive references_full=[{url, tags, source}] per CVE …

`kev_detail`

Look up CISA KEV (Known Exploited Vulnerabilities) full record for a CVE. Returns federal patch deadline (due_date), CISA-specified required_action remediation, known ransomware association, vendor/product, the CISA-given common name (e.g. 'Log4Shell'), CISA-reported CWE list, plus lifecycle metadata: date_updated (when CISA last revised the entry), date_removed (set when CISA removed the CVE from the catalog — null while still active), and updated_at (our DB sync freshness). Returns 404 when…

`cwe_lookup`

Look up MITRE CWE (Common Weakness Enumeration) catalog record from research view 1000. Default response is SLIM (first 3 mitigations, first 3 examples; extended_description is null) — pass include='full' for the verbose record (full mitigations + examples lists, populated extended_description). Returns description, abstract type (Pillar/Class/Base/Variant/Compound), status (Stable/Draft/Incomplete/Deprecated), exploit likelihood, recommended mitigations, observed example CVEs, parent_cwe (wa…

`atlas_technique_lookup`

Look up a MITRE ATLAS technique — the AI/ML adversarial attack catalog. ATLAS catalogues TTPs targeting machine learning systems: prompt injection, model evasion, training data poisoning, model theft, etc. Roughly 80% of ATLAS techniques are AI/ML-specific (no ATT&CK bridge); 20% mirror an enterprise ATT&CK technique via attack_reference_id — use that to pivot to D3FEND defenses (d3fend_defense_for_attack) and CVE search. Sub-techniques inherit `tactics` from the parent (inherited_tactics=tru…

`bulk_atlas_technique_lookup`

Bulk ATLAS technique lookup — retrieve full records for up to 50 techniques in a single request instead of N separate atlas_technique_lookup calls. Designed as the natural follow-up to atlas_case_study_lookup, whose techniques_used array can be passed directly. Each item is the same shape as atlas_technique_lookup, including parent-tactics inheritance for sub-techniques (inherited_tactics=true flag) and per-item next_calls (D3FEND bridge when attack_reference_id present, sibling-technique sea…

`atlas_technique_search`

Search the MITRE ATLAS catalog of AI/ML attack techniques by keyword, tactic, or maturity. Default response is SLIM (description truncated to 240 chars per row); pass include='full' for the verbose record. Pass exclude_id when chaining from atlas_technique_lookup to skip self in sibling-tactic searches. Use this to discover techniques matching a threat-model question, e.g. 'what techniques target LLM serving infrastructure?'. Drill into atlas_technique_lookup with any returned technique_id fo…

`atlas_case_study_lookup`

Look up a MITRE ATLAS case study — a documented real-world AI/ML attack incident. Each case study links a sequence of ATLAS techniques (techniques_used) to the incident. Default response is SLIM (description truncated to 240 chars); pass include='full' for the verbose narrative. Use this after atlas_technique_search to find which incidents have exercised a given technique. Drill into the full techniques_used array via bulk_atlas_technique_lookup in a single call (next_calls emits exactly that…

`atlas_case_study_search`

Search ATLAS case studies (real-world AI/ML attack incidents) by keyword or referenced technique. Default response is SLIM (description truncated to 240 chars per row); pass include='full' for the verbose summary. Useful when the user has a technique in hand and wants to see incidents that exercised it. Drill via atlas_case_study_lookup for the full procedure list. Free: 30/hr, Pro: 500/hr. Returns {query, total, results [{case_study_id, name, description (truncated by default), techniques_us…

`d3fend_defense_lookup`

Look up a MITRE D3FEND defense technique. D3FEND is the canonical defensive counterpart to ATT&CK — each defense is classified into one of 7 tactics (Model/Harden/Detect/Isolate/Deceive/Evict/Restore) and may target a specific digital artifact (e.g. 'Access Token'). Response includes attack_techniques: the list of ATT&CK T-codes this defense mitigates. Use after d3fend_defense_search for the full record + ATT&CK chain. Returns 404 when the slug is not in the synced D3FEND catalog. Free: 30/hr…

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "contrastapi \u2014 security intelligence": {
            "contrastapi": {
                "url": "https://mcp.contrastcyber.com/mcp"
            }
        }
    }
}

McpServers

{
    "contrastapi": {
        "url": "https://mcp.contrastcyber.com/mcp"
    }
}

ContrastAPI — 55 Security Tools + 7 MCP Resources for AI Agents

Security intelligence, built for AI agents.Give your agent grounded answers about vulnerabilities, threats, and attack surface — backed by authoritative sources (NVD, CISA KEV, FIRST EPSS, MITRE ATLAS & D3FEND), never guesswork. CVE/KEV/CWE lookup with EPSS exploit-probability and composite risk scoring, domain & IP investigation, IOC enrichment, code-security checks, and live web intelligence.55 tools, 7 Resources, and 3 Prompts — free, no API key, no signup.

- API Documentation— REST reference: 60+ endpoints, authentication, rate limits, token costs, and response envelope.
- MCP Documentation— MCP tool-selection guide, 7 Resources, 3 Prompts, and copy-paste agent prompts.

{ "mcpServers": { "contrastapi": { "command": "npx", "args": ["-y", "mcp-remote", "https://api.contrastcyber.com/mcp/"] } } }

Restart your agent. Other clients (Python SDK, Node SDK, cURL, VS Code):mcp-setup·quickstart

Grab the.mcpbfile from thelatest releaseand double-click it (or Claude Desktop →Settings → Extensions → Install Extension…). No signup, no API key — all 55 tools ready immediately.

pip install contrastapi # Python 3.10+ — sync + async, typed responses, shortcut helpers npm install contrastapi # Node 14+ — concrete TypeScript types, 14 namespaces

Both SDKs cover every HTTP endpoint and MCP tool — CVE/KEV/CWE, ATLAS, D3FEND, Sigma rules, email security posture, domain, IP, IOC, code security, and web intelligence — with wire-exact response shapes and a typed exception hierarchy that mirrors the API error envelope. They also expose MCP Resources for browsing the ATLAS, D3FEND, and CWE catalogs (see docs/MCP_Documentation.md) and a conditional triage Prompt (see docs/MCP_Documentation.md#contrast-triage). Web-intelligence tools —robots_txt,redirect_chain,email_verify,brand_assets,seo_audit,geo_audit— ship with an explicit ethical floor: per-target throttling, robots.txt respected, no SMTP probing.

Smithery·npm·VS Code Marketplace·Awesome OSINT MCP·RapidAPI

Responses include averdictblock —deterministic,falsifiable_fields,data_age_seconds,sources_queried/sources_unavailable,completeness— so a verifier agent can independently re-derive specific fields from the upstream authority (NVD, RDAP, CT logs, URLhaus). ProbeGET /v1/capabilitiesfor"verdict_metadata": true.

CVE responses also embednext_calls: list[PivotHint]—{tool, input, reason}triples that suggest the next MCP tool to call (e.g.kev_detailwhenkev.in_kev=true,cwe_lookupwhencwe_idis set). Agents chain workflows without manual prompting.

Semantic search through Dickens' classic tale. Find passages by meaning, theme, or concept - not just keywords.

MCP server for the AI Dev Jobs board - 8,400+ open AI/ML engineering roles at 489 companies. Search by role, location, salary, experience level. Live MCP endpoint aidevboard.com/mcp with 4 tools.

API for AI agents to search, license, and download b-roll video clips and voiceovers. Pay-per-request, no human interaction required.

Keyless remote MCP connector to search flights, hotels, and experiences at all-in prices (every mandatory tax and fee included) and book on breckenwander.com.

EU legal research for AI agents: semantic + full-text search over ~48,000 EUR-Lex acts including consolidated versions, daily drift monitoring, answers with verifiable CELEX citations. German, English, French. Remote MCP server at https://conformi.eu/api/mcp — free tier, no key required for article and timeline tools.

Corpus search and linguistic analysis for AI Agents

Destiny Codex turns the Destiny 2 Manifest (gibberish hash-reference JSON) into clean, AI-readable text. CLI + MCP server with 9 tools: search, filter, get, relationships, graph traversal, item comparison. Works for 100% of the manifest - all 83 definition tables supported generically.

Server that connects Claude/Cursor to the FatSecret Platform API. Search foods, track your diet, manage recipes, and monitor weight directly from your AI assistant.

Open-source Node.js FHIR MCP server with SMART Backend Services, metadata-aware search/CRUD tools, compact responses, FHIRPath filtering, safe pagination, audit events, and terminology lookup.

Geospatial data for AI agents via OpenStreetMap — geocoding, reverse geocoding, POI search, routing, and area statistics. No API key required.

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Explore

Setting up with Highlight

From the repository

domain_report

audit_domain

contrast_scan

tech_stack_cve_audit

threat_report

dns_lookup

whois_lookup

ssl_check

subdomain_enum

tech_fingerprint

threat_intel

wayback_lookup

scan_headers

email_mx

email_security_posture

email_disposable

email_verify

robots_txt

redirect_chain

brand_assets

seo_audit

geo_audit

phone_lookup

ip_lookup

asn_lookup

cve_lookup

calculate_risk_score

get_cvss_details

cve_search

cve_leading

exploit_lookup

bulk_cve_lookup

kev_detail

cwe_lookup

atlas_technique_lookup

bulk_atlas_technique_lookup

atlas_technique_search

atlas_case_study_lookup

atlas_case_study_search

d3fend_defense_lookup

Claude Desktop / Cursor

McpServers

ContrastAPI — 55 Security Tools + 7 MCP Resources for AI Agents

More like this

Sequential Thinking

Aws Kb Retrieval Server

Memory

Brave Search

`domain_report`

`audit_domain`

`contrast_scan`

`tech_stack_cve_audit`

`threat_report`

`dns_lookup`

`whois_lookup`

`ssl_check`

`subdomain_enum`

`tech_fingerprint`

`threat_intel`

`wayback_lookup`

`scan_headers`

`email_mx`

`email_security_posture`

`email_disposable`

`email_verify`

`robots_txt`

`redirect_chain`

`brand_assets`

`seo_audit`

`geo_audit`

`phone_lookup`

`ip_lookup`

`asn_lookup`

`cve_lookup`

`calculate_risk_score`

`get_cvss_details`

`cve_search`

`cve_leading`

`exploit_lookup`

`bulk_cve_lookup`

`kev_detail`

`cwe_lookup`

`atlas_technique_lookup`

`bulk_atlas_technique_lookup`

`atlas_technique_search`

`atlas_case_study_lookup`

`atlas_case_study_search`

`d3fend_defense_lookup`