{ "data": { "category": { "area": "developer", "capabilities": [ "secintel.reputation", "secintel.exposure", "secintel.dns", "secintel.malware", "secintel.indicators", "secintel.ip-enrichment" ], "description": "APIs an agent uses to investigate a domain, an IP address, a file hash or an exposed service. Reputation and abuse reports, scan data on open ports and certificates, DNS and WHOIS history and threat indicators. Distinct from guardrails, agent auth and secrets, which protect the agent itself. Compared on what each lookup returns, how fresh the data is, what a free key allows, redistribution terms and price per lookup.", "json": "https://www.anchorterminal.com/categories/security-intelligence.json", "name": "Security intelligence", "slug": "security-intelligence", "test": "In this run, public evidence against the published checklist. When the task suites run, the same set of known-bad and known-good domains, addresses and hashes looked up through each listing, the verdicts compared with the public record and the lookups timed. We check what came back, how old the data was, the daily quota on a free key and what the terms let an agent store.", "title": "Threat and security intelligence APIs for AI agents", "toolCount": 9, "tools": [ "virustotal", "greynoise", "censys", "ipinfo", "whoisxml-api", "abuseipdb", "pulsedive", "shodan", "securitytrails" ], "url": "https://www.anchorterminal.com/categories/security-intelligence" }, "faq": [ { "answer": "VirusTotal has the highest benchmark score of the 9 ranked threat and security intelligence APIs, 67.5 (B). GreyNoise is second with 66 (B).", "question": "What are the highest-rated threat and security intelligence APIs for AI agents?" }, { "answer": "0 of the 9 ranked here grade BB or better, the bar for agent-ready on the Anchor benchmark.", "question": "How many threat and security intelligence APIs are agent-ready?" }, { "answer": "None of the ranked listings here accepts x402 for its main call yet.", "question": "Which threat and security intelligence APIs accept x402 payments?" }, { "answer": "By the Anchor benchmark score out of 100, a weighted mean of the scored categories minus deductions for negative events, from public evidence re-checked as vendors change. Listings cannot pay for a place. The latest assessment behind this page is from 3 November 2026.", "question": "How is this list ranked?" } ], "howToChoose": [ { "label": "What one lookup returns", "detail": "Check whether a lookup returns a verdict, the evidence behind it or both, since an agent that has to explain a block needs the evidence." }, { "label": "Freshness", "detail": "Check how often scan and reputation data is refreshed and whether each record carries a timestamp, because a port that closed last week is still open in an old scan." }, { "label": "Free key quota", "detail": "Check the lookups allowed per day and per minute on a free or trial key, as an investigation of one incident can need hundreds." }, { "label": "Storing and sharing results", "detail": "Read whether results may be stored, shared with a customer or put in a report, as several vendors licence lookups for internal use only." } ], "picks": [ { "also": { "name": "GreyNoise", "slug": "greynoise", "why": "B, 66/100" }, "name": "VirusTotal", "need": "Highest score overall", "slug": "virustotal", "why": "B, 67.5/100 on the benchmark" }, { "name": "GreyNoise", "need": "Reliability", "slug": "greynoise", "why": "78/100 on reliability, against 55 for the overall leader" }, { "name": "GreyNoise", "need": "Schema \u0026 documentation", "slug": "greynoise", "why": "83/100 on schema \u0026 documentation, against 77 for the overall leader" }, { "name": "IPinfo", "need": "Agent ergonomics", "slug": "ipinfo", "why": "84/100 on agent ergonomics, against 83 for the overall leader" }, { "name": "GreyNoise", "need": "Transparency \u0026 trust", "slug": "greynoise", "why": "76/100 on transparency \u0026 trust, against 65 for the overall leader" } ], "ranked": 9, "shortlist": [ { "bestFor": "File, URL, domain and IP reputation with multi-engine evidence, and the one listing here an agent can onboard to by a single POST.", "grade": "B", "name": "VirusTotal", "position": 1, "price": "Freemium", "score": 67.5, "slug": "virustotal", "strengths": [ "An agent registers itself with `POST /api/v3/agents/register` and gets a `vtai_` token with 60 queries a minute and 1,000 a day, no VirusTotal account or card", "Remote MCP server at ai.virustotal.com/mcp with Google OAuth and three scopes, in the official registry under the VirusTotal namespace since 9 September 2026", "Every MCP tool carries readOnlyHint and destructiveHint, submissions need an `X-VTAI-Consent: standard-v1` header, and network submissions are idempotent by a caller-chosen request_id" ], "url": "https://www.anchorterminal.com/tools/virustotal", "verdict": "VTAI gives an agent a free token by one POST, 1,000 lookups a day, an OpenAPI document and an 11-tool MCP server with read-only and destructive hints. No status page, no public premium price and a public API limited to non-commercial use at 500 requests a day are the limits.", "weaknesses": [ "No status page or incident history found; status.virustotal.com does not resolve", "Premium quotas and threat context are sold by contacting sales, with no public price", "The public API is capped at 4 requests a minute and 500 a day and may not be used in commercial products" ], "where": "both", "x402": "no" }, { "bestFor": "A triage or investigation agent that needs to know whether an IP is mass-scanning background noise, a known business service or something targeted, with tags and exploited CVEs to explain the verdict.", "grade": "B", "name": "GreyNoise", "position": 2, "price": "Freemium", "score": 66, "slug": "greynoise", "strengths": [ "OpenAPI 3.0.0 document with 65 paths, descriptions on every operation, 32 enums and 400, 401, 403, 429 and 500 responses defined", "Status page on incident.io with 16 components and no incident listed in the 90 days to 3 November 2026", "`quick=true` trims an IP lookup to classification or trust level, GNQL pages with `size` up to 10,000 and a `scroll` token, and bulk lookups take 10,000 IPs a call" ], "url": "https://www.anchorterminal.com/tools/greynoise", "verdict": "A public OpenAPI document covers 70 v3 operations with typed errors, a status page lists no incident in 90 days, and `quick=true`, GNQL scrolling and bulk lookups of 10,000 IPs keep responses sized. Paid tiers have no public price, the key is one unscoped credential per workspace, and no prompt-injection guidance was found for the scanner payloads it returns.", "weaknesses": [ "Standard, Advanced and Elite tiers are contact sales with no public price, and the v3 API needs one of them or a trial", "One API key per workspace with no scopes, and no page read documents how to rotate or revoke it", "IP context returns raw HTTP paths, user agents and payloads sent by scanners, and no prompt-injection guidance was found in the docs or the MCP security page" ], "where": "both", "x402": "no" }, { "bestFor": "An agent that needs to know what a host, web property or certificate exposes right now and how that changed, with DNS resolution and enrichment on paid plans.", "grade": "B", "name": "Censys", "position": 3, "price": "$79 / mo", "score": 64.1, "slug": "censys", "strengths": [ "OpenAPI 3.1 contract, version 1.0.161, with llms.txt and Markdown twins of every docs page", "`fields` selection, `page_size` up to 100 and `page_token` pagination on search, with `next_page_token` and `total_hits` in the response", "Official SDKs in Python, Go and TypeScript regenerated from the spec, the newest Python release on 29 October 2026, plus the Apache-2.0 cencli tool" ], "url": "https://www.anchorterminal.com/tools/censys", "verdict": "A versioned OpenAPI surface with field selection, page tokens, three official SDKs, a hosted MCP server and a free key of 100 credits a month. Paid enterprise access is sold by sales, scan results carry untrusted banner text with no injection guidance, and the status feed records a 13-hour outage on 30 September 2026.", "weaknesses": [ "Status feed records a networking outage of about 13 hours on 30 September 2026, periodic query failures from 20 to 22 September and failing searches on 2 November", "No Retry-After, backoff guidance or idempotency keys found. Concurrency overruns return 429 and per-IP overruns return 503", "Personal access tokens carry no scopes or expiry. Service accounts with module roles need a Search or Core plan" ], "where": "hosted", "x402": "no" }, { "bestFor": "An agent that needs to enrich an IP with location, network and anonymiser flags at volume, free for country and ASN, paid for city and privacy signals.", "grade": "B", "name": "IPinfo", "position": 4, "price": "$26 / mo", "score": 62.7, "slug": "ipinfo", "strengths": [ "Lite tier is free with no daily or monthly limit and no card, and Core overage is priced per 1,000 requests on the public pricing page", "Public OpenAPI 3.0 document with 48 operations, plus llms.txt and llms-full.txt and Markdown twins of every docs page", "Hosted MCP server with OAuth and six read-only tools, in the official MCP registry, with per-session caching and structured error codes" ], "url": "https://www.anchorterminal.com/tools/ipinfo", "verdict": "A free Lite tier with no request cap, a public OpenAPI document, llms.txt, a batch endpoint of 1,000 lookups and a six-tool hosted MCP server with OAuth. No status page or SLA was found, the only documented error is 429, the token may travel in a query string, and city-level and privacy data need a paid plan.", "weaknesses": [ "No status page, incident history or SLA was found; the terms supply the service as is", "Only 429 is documented as an error response, and no Retry-After or backoff guidance was found", "The token is accepted as a query parameter, and no scoped or read-only tokens were found" ], "where": "both", "x402": "no" }, { "bestFor": "An agent investigating a domain's registration, history, DNS, certificates or related domains at scale, on a prepaid credit pool.", "grade": "C", "name": "WhoisXML API", "position": 5, "price": "$129 / mo", "score": 56.8, "slug": "whoisxml-api", "strengths": [ "500 free WHOIS credits on signup with no card, and 1 credit a lookup from cache or 5 for a forced refresh", "JSON Schema and XSD documents for the record, availability and error responses, with an error code table and Retry-After on 429", "Each record carries audit.createdDate and audit.updatedDate, so an agent can tell when the copy was collected" ], "url": "https://www.anchorterminal.com/tools/whoisxml-api", "verdict": "500 free credits with no card, JSON Schema and XSD for every response, 429s with Retry-After, cache controls that set the price per lookup, and a 35-tool hosted MCP server with OAuth. Per-credit prices sit behind a calculator, the terms confine data to one site and forbid AI training on it, and the key is accepted in the query string.", "weaknesses": [ "Per-credit prices are not published outside a calculator; the only public figure is from $129 a month, and orders are non-refundable", "The terms license data for one site, bar sharing it with third parties and forbid AI model training on it without written authorisation", "The docs say 200 requests a second while the terms say 50, 20 concurrent and 5 concurrent bulk" ], "where": "both", "x402": "no" }, { "bestFor": "An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident.", "grade": "C", "name": "AbuseIPDB", "position": 6, "price": "$25 / mo", "score": 55.7, "slug": "abuseipdb", "strengths": [ "1,000 checks and 1,000 reports a day on a free key with no card, and daily limits published for every endpoint and plan", "429 responses carry Retry-After and X-RateLimit headers, and errors follow the JSON API shape with a status and detail", "The terms include a service level agreement with a 99 per cent monthly availability target" ], "url": "https://www.anchorterminal.com/tools/abuseipdb", "verdict": "A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.", "weaknesses": [ "No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice", "One key per account reaches reads, reports, bulk reports and clear-address deletes, and the docs accept it as a query parameter", "No security.txt, disclosure policy or certification found, and the status page's incident history could not be read" ], "where": "local", "x402": "no" }, { "bestFor": "An agent that needs a quick risk verdict and linked threats for a domain, IP or URL with no signup, or a passive scan of a new indicator.", "grade": "D", "name": "Pulsedive", "position": 7, "price": "$29 / mo", "score": 47.9, "slug": "pulsedive", "strengths": [ "Keyless lookups and a free account with no card (50 requests a day, 500 a month per the March 2024 plan post)", "llms.txt, Markdown docs, eleven OpenAPI 3.0.3 files and a docs MCP server, all published in March 2026", "Every indicator carries stamp_seen, stamp_probed and stamp_updated, and scans can run passively or actively without storing the result" ], "url": "https://www.anchorterminal.com/tools/pulsedive", "verdict": "Lookups work with no key at all, a free account allows 50 requests a day, and the docs ship llms.txt, per-endpoint OpenAPI files and timestamps for every scan. The key travels only in the query string, numeric limits live in a 2024 blog post rather than the docs, and there is no status page, SLA, security.txt or official SDK.", "weaknesses": [ "The key is sent only as a query parameter, with no header option, scopes or rotation documented", "No status page, SLA, security.txt, disclosure policy or certification was found", "The docs give no numeric rate limits and no Retry-After; the numbers come from the vendor's plan post of 11 March 2024" ], "where": "local", "x402": "no" }, { "bestFor": "An agent that needs to know what is exposed on an IP or a range, which ports, products and CVEs, and to watch a network for change.", "grade": "E", "name": "Shodan", "position": 8, "price": "$49 / mo", "score": 39.5, "slug": "shodan", "strengths": [ "Host lookup returns ports, banners, certificates, hostnames, tags and known CVEs for an IP, with `history=true` for every banner ever seen", "`minify` on host lookups and search, and `fields` on search, cut responses to the fields an agent needs; results page 100 at a time", "Public OpenAPI 3.0.0 document and an API reference with example requests and responses for all 44 operations" ], "url": "https://www.anchorterminal.com/tools/shodan", "verdict": "One GET endpoint per job returns ports, banners and vulnerabilities for an IP, with `minify` and `fields` to trim responses and public plan prices from a $49 one-time Membership. The key travels only in the query string with no scopes, 429 handling is undocumented, the terms were unreadable and the official library's last release was December 2023.", "weaknesses": [ "The API key is sent only as `key=` in the query string, with no scopes, no read-only key and no header option documented", "No 429, Retry-After or backoff guidance in the reference. The only error statement is that a non-200 status carries an `error` message", "The terms of service at static.shodan.io were not read, because that host answers 403 to robots.txt. The privacy policy is undated, names no entity and allows sharing with advertisers" ], "where": "hosted", "x402": "no" }, { "bestFor": "An agent investigating a domain's DNS and WHOIS history, subdomains and associated infrastructure, where the operator already holds a commercial key.", "grade": "F", "name": "SecurityTrails", "position": 9, "price": "Paid", "score": 30.7, "slug": "securitytrails", "strengths": [ "Read-only v1 API, by the overview's own statement, covering current DNS, DNS history by record type, WHOIS history, subdomains, SSL data, associated domains and IP lookups", "llms.txt with a Markdown twin of every reference page, generated from an OpenAPI document with typed parameters and example responses", "ASI Project API with cursor pagination (limit 1 to 1,000), seven filter operators and an enrichments list that returns only the blocks asked for" ], "url": "https://www.anchorterminal.com/tools/securitytrails", "verdict": "The v1 API is read-only and reaches current and historical DNS, WHOIS, subdomain and SSL records, with llms.txt and a Markdown twin of every reference page. The key is accepted in the query string, the changelog stops in May 2020, the status page is private, and pricing, terms and privacy sat behind a Cloudflare challenge when checked.", "weaknesses": [ "Pricing, terms, privacy, the security page and security.txt on securitytrails.com answered a Cloudflare challenge on 3 November 2026, so none was read", "One API key with no scopes found, documented as `apikey` in the query string on every v1 reference page as well as in an `APIKEY` header", "The docs changelog's dated entries stop on 28 May 2020, and the status page at securitytrails.statuspage.io is inactive and private" ], "where": "hosted", "x402": "no" } ], "updated": "2026-11-03" }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/best/security-intelligence/", "json": "https://www.anchorterminal.com/best/security-intelligence/index.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/best/security-intelligence/index.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/best/security-intelligence/index.min.md" }, "markdown": "All 9 ranked threat and security intelligence APIs on the Anchor benchmark, with a pick for each need and where each one falls short. Scores come from public evidence, re-checked as vendors change.\n\n- Ranked: 9 · agent-ready (BB or better): 0 · accept x402: 0 · hosted endpoints: 7\n- Full ranked table: https://www.anchorterminal.com/categories/security-intelligence.md\n- Head-to-head comparisons: https://www.anchorterminal.com/compare/security-intelligence/index.md (33)\n- Methodology: https://www.anchorterminal.com/benchmark/index.md\n\n## The shortlist\n\n| # | Tool | Grade | Score | Best for | Price | Where |\n| --- | --- | --- | --- | --- | --- | --- |\n| 1 | [VirusTotal](https://www.anchorterminal.com/tools/virustotal.md) | B | 67.5 | File, URL, domain and IP reputation with multi-engine evidence, and the one listing here an agent can onboard to by a single POST. | Freemium | Hosted and local |\n| 2 | [GreyNoise](https://www.anchorterminal.com/tools/greynoise.md) | B | 66 | A triage or investigation agent that needs to know whether an IP is mass-scanning background noise, a known business service or something targeted, with tags and exploited CVEs to explain the verdict. | Freemium | Hosted and local |\n| 3 | [Censys](https://www.anchorterminal.com/tools/censys.md) | B | 64.1 | An agent that needs to know what a host, web property or certificate exposes right now and how that changed, with DNS resolution and enrichment on paid plans. | $79 / mo | Hosted |\n| 4 | [IPinfo](https://www.anchorterminal.com/tools/ipinfo.md) | B | 62.7 | An agent that needs to enrich an IP with location, network and anonymiser flags at volume, free for country and ASN, paid for city and privacy signals. | $26 / mo | Hosted and local |\n| 5 | [WhoisXML API](https://www.anchorterminal.com/tools/whoisxml-api.md) | C | 56.8 | An agent investigating a domain's registration, history, DNS, certificates or related domains at scale, on a prepaid credit pool. | $129 / mo | Hosted and local |\n| 6 | [AbuseIPDB](https://www.anchorterminal.com/tools/abuseipdb.md) | C | 55.7 | An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident. | $25 / mo | Local |\n| 7 | [Pulsedive](https://www.anchorterminal.com/tools/pulsedive.md) | D | 47.9 | An agent that needs a quick risk verdict and linked threats for a domain, IP or URL with no signup, or a passive scan of a new indicator. | $29 / mo | Local |\n| 8 | [Shodan](https://www.anchorterminal.com/tools/shodan.md) | E | 39.5 | An agent that needs to know what is exposed on an IP or a range, which ports, products and CVEs, and to watch a network for change. | $49 / mo | Hosted |\n| 9 | [SecurityTrails](https://www.anchorterminal.com/tools/securitytrails.md) | F | 30.7 | An agent investigating a domain's DNS and WHOIS history, subdomains and associated infrastructure, where the operator already holds a commercial key. | Paid | Hosted |\n\n## Picks by need\n\n- Highest score overall: [VirusTotal](https://www.anchorterminal.com/tools/virustotal.md), B, 67.5/100 on the benchmark. Also [GreyNoise](https://www.anchorterminal.com/tools/greynoise.md), B, 66/100.\n- Reliability: [GreyNoise](https://www.anchorterminal.com/tools/greynoise.md), 78/100 on reliability, against 55 for the overall leader.\n- Schema \u0026 documentation: [GreyNoise](https://www.anchorterminal.com/tools/greynoise.md), 83/100 on schema \u0026 documentation, against 77 for the overall leader.\n- Agent ergonomics: [IPinfo](https://www.anchorterminal.com/tools/ipinfo.md), 84/100 on agent ergonomics, against 83 for the overall leader.\n- Transparency \u0026 trust: [GreyNoise](https://www.anchorterminal.com/tools/greynoise.md), 76/100 on transparency \u0026 trust, against 65 for the overall leader.\n\n## How to choose\n\n- What one lookup returns: Check whether a lookup returns a verdict, the evidence behind it or both, since an agent that has to explain a block needs the evidence.\n- Freshness: Check how often scan and reputation data is refreshed and whether each record carries a timestamp, because a port that closed last week is still open in an old scan.\n- Free key quota: Check the lookups allowed per day and per minute on a free or trial key, as an investigation of one incident can need hundreds.\n- Storing and sharing results: Read whether results may be stored, shared with a customer or put in a report, as several vendors licence lookups for internal use only.\n\n- How the benchmark tests this category: In this run, public evidence against the published checklist. When the task suites run, the same set of known-bad and known-good domains, addresses and hashes looked up through each listing, the verdicts compared with the public record and the lookups timed. We check what came back, how old the data was, the daily quota on a free key and what the terms let an agent store.\n\n## Each one in detail\n\n### 1. VirusTotal, B 67.5/100\n\nVirusTotal, part of Google, aggregates verdicts from over 70 antivirus engines and URL scanners on files, URLs, domains and IP addresses. Agents call the v3 REST API with a key, or VirusTotal AI over REST and a remote MCP server.\n\n- Verdict: VTAI gives an agent a free token by one POST, 1,000 lookups a day, an OpenAPI document and an 11-tool MCP server with read-only and destructive hints. No status page, no public premium price and a public API limited to non-commercial use at 500 requests a day are the limits.\n- Best for: File, URL, domain and IP reputation with multi-engine evidence, and the one listing here an agent can onboard to by a single POST.\n- Strength: An agent registers itself with `POST /api/v3/agents/register` and gets a `vtai_` token with 60 queries a minute and 1,000 a day, no VirusTotal account or card\n- Strength: Remote MCP server at ai.virustotal.com/mcp with Google OAuth and three scopes, in the official registry under the VirusTotal namespace since 9 September 2026\n- Strength: Every MCP tool carries readOnlyHint and destructiveHint, submissions need an `X-VTAI-Consent: standard-v1` header, and network submissions are idempotent by a caller-chosen request_id\n- Weakness: No status page or incident history found; status.virustotal.com does not resolve\n- Weakness: Premium quotas and threat context are sold by contacting sales, with no public price\n- Weakness: The public API is capped at 4 requests a minute and 500 a day and may not be used in commercial products\n- Price: Freemium · Auth: OAuth or key · x402: No · Where: Hosted and local\n- Full assessment: https://www.anchorterminal.com/tools/virustotal.md\n\n### 2. GreyNoise, B 66/100\n\nGreyNoise classifies IP addresses seen scanning the internet as benign, malicious, suspicious or unknown, with tags, exploited CVEs and business-service trust levels, through a v3 REST API, a Python SDK and an official local MCP server.\n\n- Verdict: A public OpenAPI document covers 70 v3 operations with typed errors, a status page lists no incident in 90 days, and `quick=true`, GNQL scrolling and bulk lookups of 10,000 IPs keep responses sized. Paid tiers have no public price, the key is one unscoped credential per workspace, and no prompt-injection guidance was found for the scanner payloads it returns.\n- Best for: A triage or investigation agent that needs to know whether an IP is mass-scanning background noise, a known business service or something targeted, with tags and exploited CVEs to explain the verdict.\n- Strength: OpenAPI 3.0.0 document with 65 paths, descriptions on every operation, 32 enums and 400, 401, 403, 429 and 500 responses defined\n- Strength: Status page on incident.io with 16 components and no incident listed in the 90 days to 3 November 2026\n- Strength: `quick=true` trims an IP lookup to classification or trust level, GNQL pages with `size` up to 10,000 and a `scroll` token, and bulk lookups take 10,000 IPs a call\n- Weakness: Standard, Advanced and Elite tiers are contact sales with no public price, and the v3 API needs one of them or a trial\n- Weakness: One API key per workspace with no scopes, and no page read documents how to rotate or revoke it\n- Weakness: IP context returns raw HTTP paths, user agents and payloads sent by scanners, and no prompt-injection guidance was found in the docs or the MCP security page\n- Price: Freemium · Auth: API key · x402: No · Where: Hosted and local\n- Full assessment: https://www.anchorterminal.com/tools/greynoise.md\n- Against #1: https://www.anchorterminal.com/compare/greynoise-vs-virustotal.md\n\n### 3. Censys, B 64.1/100\n\nCensys is an internet scanning and intelligence service. Its Platform API returns what an IP address, web property or certificate exposes, with DNS resolution, host history, enrichment and reputation data, through REST, a hosted MCP server, SDKs and a CLI.\n\n- Verdict: A versioned OpenAPI surface with field selection, page tokens, three official SDKs, a hosted MCP server and a free key of 100 credits a month. Paid enterprise access is sold by sales, scan results carry untrusted banner text with no injection guidance, and the status feed records a 13-hour outage on 30 September 2026.\n- Best for: An agent that needs to know what a host, web property or certificate exposes right now and how that changed, with DNS resolution and enrichment on paid plans.\n- Strength: OpenAPI 3.1 contract, version 1.0.161, with llms.txt and Markdown twins of every docs page\n- Strength: `fields` selection, `page_size` up to 100 and `page_token` pagination on search, with `next_page_token` and `total_hits` in the response\n- Strength: Official SDKs in Python, Go and TypeScript regenerated from the spec, the newest Python release on 29 October 2026, plus the Apache-2.0 cencli tool\n- Weakness: Status feed records a networking outage of about 13 hours on 30 September 2026, periodic query failures from 20 to 22 September and failing searches on 2 November\n- Weakness: No Retry-After, backoff guidance or idempotency keys found. Concurrency overruns return 429 and per-IP overruns return 503\n- Weakness: Personal access tokens carry no scopes or expiry. Service accounts with module roles need a Search or Core plan\n- Price: $79 / mo · Auth: OAuth or key · x402: No · Where: Hosted\n- Full assessment: https://www.anchorterminal.com/tools/censys.md\n- Against #1: https://www.anchorterminal.com/compare/censys-vs-virustotal.md\n\n### 4. IPinfo, B 62.7/100\n\nIPinfo is an IP address data service from IPinfo Inc. in Seattle. Its API returns geolocation, ASN, privacy and residential proxy signals for an address, with a free Lite tier, paid tiers, a batch endpoint and a hosted MCP server.\n\n- Verdict: A free Lite tier with no request cap, a public OpenAPI document, llms.txt, a batch endpoint of 1,000 lookups and a six-tool hosted MCP server with OAuth. No status page or SLA was found, the only documented error is 429, the token may travel in a query string, and city-level and privacy data need a paid plan.\n- Best for: An agent that needs to enrich an IP with location, network and anonymiser flags at volume, free for country and ASN, paid for city and privacy signals.\n- Strength: Lite tier is free with no daily or monthly limit and no card, and Core overage is priced per 1,000 requests on the public pricing page\n- Strength: Public OpenAPI 3.0 document with 48 operations, plus llms.txt and llms-full.txt and Markdown twins of every docs page\n- Strength: Hosted MCP server with OAuth and six read-only tools, in the official MCP registry, with per-session caching and structured error codes\n- Weakness: No status page, incident history or SLA was found; the terms supply the service as is\n- Weakness: Only 429 is documented as an error response, and no Retry-After or backoff guidance was found\n- Weakness: The token is accepted as a query parameter, and no scoped or read-only tokens were found\n- Price: $26 / mo · Auth: OAuth or key · x402: No · Where: Hosted and local\n- Full assessment: https://www.anchorterminal.com/tools/ipinfo.md\n- Against #1: https://www.anchorterminal.com/compare/ipinfo-vs-virustotal.md\n\n### 5. WhoisXML API, C 56.8/100\n\nWhoisXML API is a set of domain, DNS, IP and threat intelligence APIs from Whois API, Inc. Its WHOIS API returns parsed registration records for a domain or address, and a hosted MCP server bundles 35 tools on one balance.\n\n- Verdict: 500 free credits with no card, JSON Schema and XSD for every response, 429s with Retry-After, cache controls that set the price per lookup, and a 35-tool hosted MCP server with OAuth. Per-credit prices sit behind a calculator, the terms confine data to one site and forbid AI training on it, and the key is accepted in the query string.\n- Best for: An agent investigating a domain's registration, history, DNS, certificates or related domains at scale, on a prepaid credit pool.\n- Strength: 500 free WHOIS credits on signup with no card, and 1 credit a lookup from cache or 5 for a forced refresh\n- Strength: JSON Schema and XSD documents for the record, availability and error responses, with an error code table and Retry-After on 429\n- Strength: Each record carries audit.createdDate and audit.updatedDate, so an agent can tell when the copy was collected\n- Weakness: Per-credit prices are not published outside a calculator; the only public figure is from $129 a month, and orders are non-refundable\n- Weakness: The terms license data for one site, bar sharing it with third parties and forbid AI model training on it without written authorisation\n- Weakness: The docs say 200 requests a second while the terms say 50, 20 concurrent and 5 concurrent bulk\n- Price: $129 / mo · Auth: OAuth or key · x402: No · Where: Hosted and local\n- Full assessment: https://www.anchorterminal.com/tools/whoisxml-api.md\n- Against #1: https://www.anchorterminal.com/compare/virustotal-vs-whoisxml-api.md\n\n### 6. AbuseIPDB, C 55.7/100\n\nAbuseIPDB is a crowdsourced database of IP addresses reported for abuse, run by AbuseIPDB LLC under Marathon Studios. Its API v2 returns an abuse confidence score and report history for an address, a subnet or a blacklist, and takes reports.\n\n- Verdict: A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.\n- Best for: An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident.\n- Strength: 1,000 checks and 1,000 reports a day on a free key with no card, and daily limits published for every endpoint and plan\n- Strength: 429 responses carry Retry-After and X-RateLimit headers, and errors follow the JSON API shape with a status and detail\n- Strength: The terms include a service level agreement with a 99 per cent monthly availability target\n- Weakness: No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice\n- Weakness: One key per account reaches reads, reports, bulk reports and clear-address deletes, and the docs accept it as a query parameter\n- Weakness: No security.txt, disclosure policy or certification found, and the status page's incident history could not be read\n- Price: $25 / mo · Auth: API key · x402: No · Where: Local\n- Full assessment: https://www.anchorterminal.com/tools/abuseipdb.md\n- Against #1: https://www.anchorterminal.com/compare/abuseipdb-vs-virustotal.md\n\n### 7. Pulsedive, D 47.9/100\n\nPulsedive is a threat intelligence platform from Pulsedive LLC in New Jersey. Its API looks up domains, IP addresses and URLs for risk scores, linked threats and feeds, scans new indicators on demand and exports STIX over TAXII 2.1.\n\n- Verdict: Lookups work with no key at all, a free account allows 50 requests a day, and the docs ship llms.txt, per-endpoint OpenAPI files and timestamps for every scan. The key travels only in the query string, numeric limits live in a 2024 blog post rather than the docs, and there is no status page, SLA, security.txt or official SDK.\n- Best for: An agent that needs a quick risk verdict and linked threats for a domain, IP or URL with no signup, or a passive scan of a new indicator.\n- Strength: Keyless lookups and a free account with no card (50 requests a day, 500 a month per the March 2024 plan post)\n- Strength: llms.txt, Markdown docs, eleven OpenAPI 3.0.3 files and a docs MCP server, all published in March 2026\n- Strength: Every indicator carries stamp_seen, stamp_probed and stamp_updated, and scans can run passively or actively without storing the result\n- Weakness: The key is sent only as a query parameter, with no header option, scopes or rotation documented\n- Weakness: No status page, SLA, security.txt, disclosure policy or certification was found\n- Weakness: The docs give no numeric rate limits and no Retry-After; the numbers come from the vendor's plan post of 11 March 2024\n- Price: $29 / mo · Auth: API key · x402: No · Where: Local\n- Full assessment: https://www.anchorterminal.com/tools/pulsedive.md\n- Against #1: https://www.anchorterminal.com/compare/pulsedive-vs-virustotal.md\n\n### 8. Shodan, E 39.5/100\n\nShodan is a search engine for internet-connected devices. Its REST API returns the open ports, banners, certificates and known vulnerabilities of an IP address, searches the index by filter, scans ranges on demand and monitors networks for change.\n\n- Verdict: One GET endpoint per job returns ports, banners and vulnerabilities for an IP, with `minify` and `fields` to trim responses and public plan prices from a $49 one-time Membership. The key travels only in the query string with no scopes, 429 handling is undocumented, the terms were unreadable and the official library's last release was December 2023.\n- Best for: An agent that needs to know what is exposed on an IP or a range, which ports, products and CVEs, and to watch a network for change.\n- Strength: Host lookup returns ports, banners, certificates, hostnames, tags and known CVEs for an IP, with `history=true` for every banner ever seen\n- Strength: `minify` on host lookups and search, and `fields` on search, cut responses to the fields an agent needs; results page 100 at a time\n- Strength: Public OpenAPI 3.0.0 document and an API reference with example requests and responses for all 44 operations\n- Weakness: The API key is sent only as `key=` in the query string, with no scopes, no read-only key and no header option documented\n- Weakness: No 429, Retry-After or backoff guidance in the reference. The only error statement is that a non-200 status carries an `error` message\n- Weakness: The terms of service at static.shodan.io were not read, because that host answers 403 to robots.txt. The privacy policy is undated, names no entity and allows sharing with advertisers\n- Price: $49 / mo · Auth: API key · x402: No · Where: Hosted\n- Full assessment: https://www.anchorterminal.com/tools/shodan.md\n\n### 9. SecurityTrails, F 30.7/100\n\nSecurityTrails is a Recorded Future company with a read-only REST API for current and historical DNS records, WHOIS, subdomains, SSL data and IP lookups, used by security teams for domain and attack surface investigation.\n\n- Verdict: The v1 API is read-only and reaches current and historical DNS, WHOIS, subdomain and SSL records, with llms.txt and a Markdown twin of every reference page. The key is accepted in the query string, the changelog stops in May 2020, the status page is private, and pricing, terms and privacy sat behind a Cloudflare challenge when checked.\n- Best for: An agent investigating a domain's DNS and WHOIS history, subdomains and associated infrastructure, where the operator already holds a commercial key.\n- Strength: Read-only v1 API, by the overview's own statement, covering current DNS, DNS history by record type, WHOIS history, subdomains, SSL data, associated domains and IP lookups\n- Strength: llms.txt with a Markdown twin of every reference page, generated from an OpenAPI document with typed parameters and example responses\n- Strength: ASI Project API with cursor pagination (limit 1 to 1,000), seven filter operators and an enrichments list that returns only the blocks asked for\n- Weakness: Pricing, terms, privacy, the security page and security.txt on securitytrails.com answered a Cloudflare challenge on 3 November 2026, so none was read\n- Weakness: One API key with no scopes found, documented as `apikey` in the query string on every v1 reference page as well as in an `APIKEY` header\n- Weakness: The docs changelog's dated entries stop on 28 May 2020, and the status page at securitytrails.statuspage.io is inactive and private\n- Price: Paid · Auth: API key · x402: No · Where: Hosted\n- Full assessment: https://www.anchorterminal.com/tools/securitytrails.md\n\n## Head to head\n\n- [GreyNoise vs VirusTotal](https://www.anchorterminal.com/compare/greynoise-vs-virustotal.md)\n- [Censys vs VirusTotal](https://www.anchorterminal.com/compare/censys-vs-virustotal.md)\n- [IPinfo vs VirusTotal](https://www.anchorterminal.com/compare/ipinfo-vs-virustotal.md)\n- [VirusTotal vs WhoisXML API](https://www.anchorterminal.com/compare/virustotal-vs-whoisxml-api.md)\n- [Censys vs GreyNoise](https://www.anchorterminal.com/compare/censys-vs-greynoise.md)\n- [GreyNoise vs IPinfo](https://www.anchorterminal.com/compare/greynoise-vs-ipinfo.md)\n- [GreyNoise vs WhoisXML API](https://www.anchorterminal.com/compare/greynoise-vs-whoisxml-api.md)\n- [Censys vs IPinfo](https://www.anchorterminal.com/compare/censys-vs-ipinfo.md)\n- [Censys vs WhoisXML API](https://www.anchorterminal.com/compare/censys-vs-whoisxml-api.md)\n- [IPinfo vs WhoisXML API](https://www.anchorterminal.com/compare/ipinfo-vs-whoisxml-api.md)\n\n## Questions\n\n### What are the highest-rated threat and security intelligence APIs for AI agents?\n\nVirusTotal has the highest benchmark score of the 9 ranked threat and security intelligence APIs, 67.5 (B). GreyNoise is second with 66 (B).\n\n### How many threat and security intelligence APIs are agent-ready?\n\n0 of the 9 ranked here grade BB or better, the bar for agent-ready on the Anchor benchmark.\n\n### Which threat and security intelligence APIs accept x402 payments?\n\nNone of the ranked listings here accepts x402 for its main call yet.\n\n### How is this list ranked?\n\nBy the Anchor benchmark score out of 100, a weighted mean of the scored categories minus deductions for negative events, from public evidence re-checked as vendors change. Listings cannot pay for a place. The latest assessment behind this page is from 3 November 2026.\n\n## How this list is made\n\nThe order is the Anchor benchmark score, the same number as on each listing. Each listing is graded from public evidence against the benchmark checklist, and the picks are worked out from those grades, prices and facts. No listing pays for its place, and paid audits or listing help never change a score.\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Best of", "url": "https://www.anchorterminal.com/best/" }, { "name": "Security intelligence", "url": "" } ], "description": "VirusTotal (B), GreyNoise (B) and Censys (B) lead the 9 ranked threat and security intelligence APIs. Picks by need, strengths, weaknesses and prices from the Anchor benchmark.", "facts": [ "VirusTotal B", "GreyNoise B", "Censys B" ], "h1": "Best threat and security intelligence APIs for AI agents", "image": "https://www.anchorterminal.com/assets/og/best-security-intelligence.png", "path": "/best/security-intelligence/", "published": "", "section": "tools", "title": "Best threat and security intelligence APIs for AI agents in 2026", "toc": null, "updated": "2026-11-03", "url": "https://www.anchorterminal.com/best/security-intelligence/" }, "tokens": { "markdown": 5950, "slim": 1380 }, "version": 1 }