# Best threat and security intelligence APIs for AI agents (slim)

> VirusTotal (B), GreyNoise (B) and Censys (B) lead the 9 ranked threat and security intelligence APIs. Picks by need, strengths, weaknesses and prices from the Anchor benchmark.

- Full: https://www.anchorterminal.com/best/security-intelligence/index.md (~5,950 tokens) · this version ~1,380 tokens · JSON https://www.anchorterminal.com/best/security-intelligence/index.json · canonical https://www.anchorterminal.com/best/security-intelligence/
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-03
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

All 9 ranked threat and security intelligence APIs on the Anchor benchmark, with a pick for each need and where each one falls short. Scores come from public evidence, re-checked as vendors change.

- Ranked: 9 · agent-ready (BB or better): 0 · accept x402: 0 · hosted endpoints: 7
- Full ranked table: https://www.anchorterminal.com/categories/security-intelligence.md
- Head-to-head comparisons: https://www.anchorterminal.com/compare/security-intelligence/index.md (33)
- Methodology: https://www.anchorterminal.com/benchmark/index.md

## The shortlist

| # | Tool | Grade | Score | Best for | Price | Where |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [VirusTotal](https://www.anchorterminal.com/tools/virustotal.md) | B | 67.5 | File, URL, domain and IP reputation with multi-engine evidence, and the one listing here an agent can onboard to by a single POST. | Freemium | Hosted and local |
| 2 | [GreyNoise](https://www.anchorterminal.com/tools/greynoise.md) | B | 66 | A triage or investigation agent that needs to know whether an IP is mass-scanning background noise, a known business service or something targeted, with tags and exploited CVEs to explain the verdict. | Freemium | Hosted and local |
| 3 | [Censys](https://www.anchorterminal.com/tools/censys.md) | B | 64.1 | An agent that needs to know what a host, web property or certificate exposes right now and how that changed, with DNS resolution and enrichment on paid plans. | $79 / mo | Hosted |
| 4 | [IPinfo](https://www.anchorterminal.com/tools/ipinfo.md) | B | 62.7 | An agent that needs to enrich an IP with location, network and anonymiser flags at volume, free for country and ASN, paid for city and privacy signals. | $26 / mo | Hosted and local |
| 5 | [WhoisXML API](https://www.anchorterminal.com/tools/whoisxml-api.md) | C | 56.8 | An agent investigating a domain's registration, history, DNS, certificates or related domains at scale, on a prepaid credit pool. | $129 / mo | Hosted and local |
| 6 | [AbuseIPDB](https://www.anchorterminal.com/tools/abuseipdb.md) | C | 55.7 | An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident. | $25 / mo | Local |
| 7 | [Pulsedive](https://www.anchorterminal.com/tools/pulsedive.md) | D | 47.9 | An agent that needs a quick risk verdict and linked threats for a domain, IP or URL with no signup, or a passive scan of a new indicator. | $29 / mo | Local |
| 8 | [Shodan](https://www.anchorterminal.com/tools/shodan.md) | E | 39.5 | An agent that needs to know what is exposed on an IP or a range, which ports, products and CVEs, and to watch a network for change. | $49 / mo | Hosted |
| 9 | [SecurityTrails](https://www.anchorterminal.com/tools/securitytrails.md) | F | 30.7 | An agent investigating a domain's DNS and WHOIS history, subdomains and associated infrastructure, where the operator already holds a commercial key. | Paid | Hosted |

## Picks by need

- Highest score overall: [VirusTotal](https://www.anchorterminal.com/tools/virustotal.md), B, 67.5/100 on the benchmark. Also [GreyNoise](https://www.anchorterminal.com/tools/greynoise.md), B, 66/100.
- Reliability: [GreyNoise](https://www.anchorterminal.com/tools/greynoise.md), 78/100 on reliability, against 55 for the overall leader.
- Schema & documentation: [GreyNoise](https://www.anchorterminal.com/tools/greynoise.md), 83/100 on schema & documentation, against 77 for the overall leader.
- Agent ergonomics: [IPinfo](https://www.anchorterminal.com/tools/ipinfo.md), 84/100 on agent ergonomics, against 83 for the overall leader.
- Transparency & trust: [GreyNoise](https://www.anchorterminal.com/tools/greynoise.md), 76/100 on transparency & trust, against 65 for the overall leader.

## How to choose

- What one lookup returns: Check whether a lookup returns a verdict, the evidence behind it or both, since an agent that has to explain a block needs the evidence.
- Freshness: Check how often scan and reputation data is refreshed and whether each record carries a timestamp, because a port that closed last week is still open in an old scan.
- Free key quota: Check the lookups allowed per day and per minute on a free or trial key, as an investigation of one incident can need hundreds.
- Storing and sharing results: Read whether results may be stored, shared with a customer or put in a report, as several vendors licence lookups for internal use only.

- How the benchmark tests this category: In this run, public evidence against the published checklist. When the task suites run, the same set of known-bad and known-good domains, addresses and hashes looked up through each listing, the verdicts compared with the public record and the lookups timed. We check what came back, how old the data was, the daily quota on a free key and what the terms let an agent store.

Each listing's verdict, strengths and weaknesses: https://www.anchorterminal.com/best/security-intelligence/index.md