API + MCP

Threat intelligence, ready for agents.

Use public IOC, passive DNS, and feed data from applications or AI agents. Start without a key, then add your CTIDAO API key for account-aware tools.

Connect an agent Manage API key
Public access
No key
IOC, pDNS, and feeds
Agent transport
MCP
Remote Streamable HTTP
REST API
v2
Stable public reads
MCP tools
7
4 public + 3 account

// Public MCP

Start without an account

Add the remote endpoint to an MCP-compatible client. Public tools are immediately available.

{
  "mcpServers": {
    "ctidao": {
      "type": "http",
      "url": "https://ctidao.com/mcp"
    }
  }
}
30 tool calls / minute

// Authenticated MCP

Add account context

Send your API key as a Bearer token to add tools for your wallet and owned feeds.

{
  "mcpServers": {
    "ctidao": {
      "type": "http",
      "url": "https://ctidao.com/mcp",
      "headers": {
        "Authorization": "Bearer ${CTIDAO_API_KEY}"
      }
    }
  }
}
120 tool calls / minute
Remote endpointhttps://ctidao.com/mcpNo submission tools

In the authenticated example, replace ${CTIDAO_API_KEY} with the API key shown in your account.

Exact lookups also add previously unseen values to CTIDAO's neutral entity index. Hosts receive active DNS enrichment and IPs receive Team Cymru BGP/ASN enrichment in the background. A search alone never marks an entity as malicious.

// MCP tools

Useful by default. More context with a key.

The tool list adapts to the request: every client gets public research tools; a valid API key adds account-owned data.

Public tools

No authentication
ctidao_query_public_ioc

Exact IOC context, accurate pDNS totals, Top1m popularity, related entities, and matching free feeds.

ctidao_pivot_public_pdns

Up to three aggregate hostname-to-IP relationships with month-level timing.

ctidao_browse_feeds

Find active public feeds by type, access, name, or tag.

ctidao_get_free_feed_indicators

Read indicators from a public free feed.

Account tools

API key
ctidao_get_api_identity

Check the wallet, tier, and capabilities attached to an API key.

ctidao_list_my_feeds

List feeds stored under the API-key wallet and show whether each is writable.

ctidao_get_my_feed_indicators

Read indicators from a feed owned by the API-key wallet.

// Public REST API

The same public data for applications.

Use normal HTTP GET requests when a REST integration is the simpler fit. Public reads return JSON and do not require an API key.

No key required
GET /api/v2/entities?type={type}&value={indicator}

Canonical public evidence and stored context. Add readOnly=1 to skip neutral intake and enrichment scheduling. Default reads retain intake behavior. Public pDNS is paginated; pages beyond three require a session.

GET /api/v2/pdns/lookup?indicator={host|ip}&page=1&limit=25

Up to three pDNS relationships for an IP address or hostname, with month-level timing.

GET /api/v2/iocs?type={type}&limit=20

Browse indicators united from active public free feeds, with source provenance and cursor pagination.

GET /api/v2/feeds

Public Feed catalogue metadata.

// Authenticated REST API

Manage and supply your own intelligence.

These endpoints require the CTIDAO API key managed from the app. Tier and feed-ownership checks are enforced on every request.

X-API-Key required
GET /api/v2/feeds/mine

Step 1: list feeds whose stored owner is your key’s wallet. Use an ID where managementAccess is manage and canIngestViaApi is true.

POST /api/v2/feeds/{id}/indicators

Step 2: add or update 1–1,000 indicators using a writable feed ID returned above. Exact wallet ownership and current tier limits are enforced. Indicator types: ip, host, domain, url or hash.

POST /api/pdns/batches

Queue a JSON or NDJSON pDNS batch of 1–1,000 A-record observations, up to 2 MB. Whale tier is enforced for the key's wallet.

No premium bypass

MCP does not expose account research results or paid-feed delivery. App billing and subscription rules still apply.

Safe by design

MCP cannot submit or alter threat intelligence. Exact query tools may only add a neutral entity and schedule bounded background enrichment.

One account key

The same CTIDAO API key works for authenticated MCP, feed ingestion, and eligible pDNS batch submissions.