API + MCP

Threat intelligence, ready for agents.

Use public IOC, passive DNS, and feed data from applications or AI agents. Start without a key, then add your CTIDAO API key for account-aware tools.

Connect an agent Manage API key
Public access
No key
IOC, pDNS, and feeds
Agent transport
MCP
Remote Streamable HTTP
REST API
v2
Stable public reads
MCP tools
7
4 public + 3 account

// Public MCP

Start without an account

Add the remote endpoint to an MCP-compatible client. Public tools are immediately available.

{
  "mcpServers": {
    "ctidao": {
      "type": "http",
      "url": "https://ctidao.com/mcp"
    }
  }
}
30 tool calls / minute

// Authenticated MCP

Add account context

Send your API key as a Bearer token to add tools for your wallet and owned feeds.

{
  "mcpServers": {
    "ctidao": {
      "type": "http",
      "url": "https://ctidao.com/mcp",
      "headers": {
        "Authorization": "Bearer ${CTIDAO_API_KEY}"
      }
    }
  }
}
120 tool calls / minute
Remote endpointhttps://ctidao.com/mcpNo submission tools

Exact lookups also add previously unseen values to CTIDAO's neutral entity index. Hosts receive active DNS enrichment and IPs receive Team Cymru BGP/ASN enrichment in the background. A search alone never marks an entity as malicious.

// MCP tools

Useful by default. More context with a key.

The tool list adapts to the request: every client gets public research tools; a valid API key adds account-owned data.

Public tools

No authentication
ctidao_query_public_ioc

Exact IOC context, related entities, pDNS preview, and matching free feeds.

ctidao_pivot_public_pdns

Up to three aggregate hostname-to-IP relationships with month-level timing.

ctidao_browse_feeds

Find active public feeds by type, access, name, or tag.

ctidao_get_free_feed_indicators

Read indicators from a public free feed.

Account tools

API key
ctidao_get_api_identity

Check the wallet, tier, and capabilities attached to an API key.

ctidao_list_my_feeds

List feeds owned by the API-key wallet.

ctidao_get_my_feed_indicators

Read indicators from a feed owned by the API-key wallet.

// Public REST API

The same public data for applications.

Use normal HTTP GET requests when a REST integration is the simpler fit. Public reads return JSON and do not require an API key.

GET /api/v2/entities?type=host&value=example.org

Canonical public entity context without creating a public search-history entry.

GET /api/v2/pdns/lookup?indicator=example.org

Public pDNS preview for an exact hostname or IP.

GET /api/v2/iocs?type=ip&limit=20

Browse public IOC rows with filters and cursor pagination.

GET /api/v2/feeds?access=free&limit=20

Browse active public feed metadata.

Full endpoint reference, write examples, and key management are in the API dashboard.

No premium bypass

MCP does not expose private research results or paid-feed delivery. Dashboard billing and subscription rules still apply.

Safe by design

MCP cannot submit or alter threat intelligence. Exact query tools may only add a neutral entity and schedule bounded background enrichment.

One account key

The same CTIDAO API key works for authenticated MCP, feed ingestion, and eligible pDNS batch submissions.