API + MCP

Threat intelligence, ready for agents.

Use public IOC, passive DNS, and feed data from applications or AI agents. Start without a key, then add your CTIDAO API key for account-aware tools.

Connect an agent Manage API key
Public access
No key
IOC, pDNS, and feeds
Agent transport
MCP
Remote Streamable HTTP
REST API
v2
Stable public reads
MCP tools
7
4 public + 3 account

// Public MCP

Start without an account

Add the remote endpoint to an MCP-compatible client. Public tools are immediately available.

{
  "mcpServers": {
    "ctidao": {
      "type": "http",
      "url": "https://ctidao.com/mcp"
    }
  }
}
30 tool calls / minute

// Authenticated MCP

Add account context

Send your API key as a Bearer token to add tools for your wallet and owned feeds.

{
  "mcpServers": {
    "ctidao": {
      "type": "http",
      "url": "https://ctidao.com/mcp",
      "headers": {
        "Authorization": "Bearer ${CTIDAO_API_KEY}"
      }
    }
  }
}
120 tool calls / minute
Remote endpointhttps://ctidao.com/mcpNo submission tools

Exact lookups also add previously unseen values to CTIDAO's neutral entity index. Hosts receive active DNS enrichment and IPs receive Team Cymru BGP/ASN enrichment in the background. A search alone never marks an entity as malicious.

// MCP tools

Useful by default. More context with a key.

The tool list adapts to the request: every client gets public research tools; a valid API key adds account-owned data.

Public tools

No authentication
ctidao_query_public_ioc

Exact IOC context, related entities, pDNS preview, and matching free feeds.

ctidao_pivot_public_pdns

Up to three aggregate hostname-to-IP relationships with month-level timing.

ctidao_browse_feeds

Find active public feeds by type, access, name, or tag.

ctidao_get_free_feed_indicators

Read indicators from a public free feed.

Account tools

API key
ctidao_get_api_identity

Check the wallet, tier, and capabilities attached to an API key.

ctidao_list_my_feeds

List feeds stored under the API-key wallet and show whether each is writable.

ctidao_get_my_feed_indicators

Read indicators from a feed owned by the API-key wallet.

// Public REST API

The same public data for applications.

Use normal HTTP GET requests when a REST integration is the simpler fit. Public reads return JSON and do not require an API key.

No key required
GET /api/v2/entities?type=host&value=example.org

Canonical public entity context without creating a public search-history entry.

GET /api/v2/pdns/lookup?indicator=example.org

Public pDNS preview for an exact hostname or IP.

GET /api/v2/iocs?type=ip&limit=20

Browse indicators united from active public free feeds, with source provenance and cursor pagination.

GET /api/v2/feeds?access=free&limit=20

Browse active public feed metadata.

// Authenticated REST API

Manage and supply your own intelligence.

These endpoints require the CTIDAO API key managed from the app. Tier and feed-ownership checks are enforced on every request.

X-API-Key required
GET /api/v2/feeds/mine

List feed IDs owned by the API-key wallet and check managementAccess before ingestion.

POST /api/v2/feeds/{id}/indicators

Submit verified indicators to a manageable feed owned by the API-key wallet.

POST /api/pdns/batches

Submit an idempotent pDNS batch from an eligible Whale account.

No premium bypass

MCP does not expose private research results or paid-feed delivery. App billing and subscription rules still apply.

Safe by design

MCP cannot submit or alter threat intelligence. Exact query tools may only add a neutral entity and schedule bounded background enrichment.

One account key

The same CTIDAO API key works for authenticated MCP, feed ingestion, and eligible pDNS batch submissions.