UPinar/contrastapi

**Security intelligence, built for AI agents.** Give your agent grounded answers about vulnerabilities, threats, and attack surface — backed by authoritative sources (NVD, CISA KEV, FIRST EPSS, MITRE ATLAS & D3FEND), never guesswork. CVE/KEV/CWE lookup with EPSS exploit-probability and composite risk scoring, domain & IP investigation, IOC enrichment, code-security checks, and live web intelligence. **55 tools, 7 Resources, and 3 Prompts — free, no API key, no signup.**
中文 · **Live:** api.contrastcyber.com
---
Documentation
- **API Documentation** — REST reference: 60+ endpoints, authentication, rate limits, token costs, and response envelope.
- **MCP Documentation** — MCP tool-selection guide, 7 Resources, 3 Prompts, and copy-paste agent prompts.
Setup (MCP)
Any MCP client
Restart your agent. Other clients (Python SDK, Node SDK, cURL, VS Code): **mcp-setup** · **quickstart**
Claude Desktop — one-click extension
Grab the .mcpb file from the **latest release** and double-click it (or Claude Desktop → **Settings → Extensions → Install Extension…**). No signup, no API key — all 55 tools ready immediately.
SDKs
Both SDKs cover every HTTP endpoint and MCP tool — CVE/KEV/CWE, ATLAS, D3FEND, Sigma rules, email security posture, domain, IP, IOC, code security, and web intelligence — with wire-exact response shapes and a typed exception hierarchy that mirrors the API error envelope. They also expose MCP Resources for browsing the ATLAS, D3FEND, and CWE catalogs (see docs/MCP_Documentation.md) and a conditional triage Prompt (see docs/MCP_Documentation.md#contrast-triage). Web-intelligence tools — robots_txt, redirect_chain, email_verify, brand_assets, seo_audit, geo_audit — ship with an explicit ethical floor: per-target throttling, robots.txt respected, no SMTP probing.
Links
**OpenAPI:** openapi.json
Also available on
Smithery · npm · VS Code Marketplace · Awesome OSINT MCP · RapidAPI
Multi-agent verdict metadata
Responses include a verdict block — deterministic, falsifiable_fields, data_age_seconds, sources_queried / sources_unavailable, completeness — so a verifier agent can independently re-derive specific fields from the upstream authority (NVD, RDAP, CT logs, URLhaus). Probe GET /v1/capabilities for "verdict_metadata": true.