Category · Developer & infrastructure
Threat and security intelligence APIs for AI agents
APIs an agent uses to investigate a domain, an IP address, a file hash or an exposed service. Reputation and abuse reports, scan data on open ports and certificates, DNS and WHOIS history and threat indicators. Distinct from guardrails, agent auth and secrets, which protect the agent itself. Compared on what each lookup returns, how fresh the data is, what a free key allows, redistribution terms and price per lookup.
Best threat and security intelligence APIs for AI agents, the shortlist33 head-to-head comparisons
Capability keys secintel.reputation · secintel.exposure · secintel.dns · secintel.malware · secintel.indicators · secintel.ip-enrichment · All tools
letme.dev/secintel.reputation picks the top-graded tool in this list and says how to call it direct (how letme works).
The same listing from the live API. Graded results come first, then the official MCP registry when no graded-only filter is set.
https://www.anchorterminal.com/api/v1/searchFilters
| Compare | # | Tool | Category | Grade | Score | Agent rating | p95 | Context | Price / x402 | Auth | Where | Details |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 288 | VirusTotalGoogle LLC · HTTP API | Security intel | B | 67.5 | none | n/a | n/a | Freemium | OAuth or key | Hosted and local | ||
|
VirusTotal, part of Google, aggregates verdicts from over 70 antivirus engines and URL scanners on files, URLs, domains and IP addresses. Agents call the v3 REST API with a key, or VirusTotal AI over REST and a remote MCP server. Top strength An agent registers itself with Top weakness No status page or incident history found; status.virustotal.com does not resolve |
||||||||||||
| 350 | GreyNoiseGreyNoise Intelligence, Inc. · HTTP API | Security intel | B | 66 | none | n/a | n/a | Freemium | API key | Hosted and local | ||
|
GreyNoise classifies IP addresses seen scanning the internet as benign, malicious, suspicious or unknown, with tags, exploited CVEs and business-service trust levels, through a v3 REST API, a Python SDK and an official local MCP server. Top strength OpenAPI 3.0.0 document with 65 paths, descriptions on every operation, 32 enums and 400, 401, 403, 429 and 500 responses defined Top weakness Standard, Advanced and Elite tiers are contact sales with no public price, and the v3 API needs one of them or a trial |
||||||||||||
| 420 | CensysCensys, Inc. · HTTP API | Security intel | B | 64.1 | none | n/a | n/a | $79 / mo | OAuth or key | Hosted | ||
|
Censys is an internet scanning and intelligence service. Its Platform API returns what an IP address, web property or certificate exposes, with DNS resolution, host history, enrichment and reputation data, through REST, a hosted MCP server, SDKs and a CLI. Top strength OpenAPI 3.1 contract, version 1.0.161, with llms.txt and Markdown twins of every docs page Top weakness Status feed records a networking outage of about 13 hours on 30 September 2026, periodic query failures from 20 to 22 September and failing searches on 2 November |
||||||||||||
| 464 | IPinfoIPinfo Inc. · HTTP API | Security intel | B | 62.7 | none | n/a | n/a | $26 / mo | OAuth or key | Hosted and local | ||
|
IPinfo is an IP address data service from IPinfo Inc. in Seattle. Its API returns geolocation, ASN, privacy and residential proxy signals for an address, with a free Lite tier, paid tiers, a batch endpoint and a hosted MCP server. Top strength Lite tier is free with no daily or monthly limit and no card, and Core overage is priced per 1,000 requests on the public pricing page Top weakness No status page, incident history or SLA was found; the terms supply the service as is |
||||||||||||
| 771 | WhoisXML APIWhois API, Inc. · HTTP API | Security intel | C | 56.8 | none | n/a | n/a | $129 / mo | OAuth or key | Hosted and local | ||
|
WhoisXML API is a set of domain, DNS, IP and threat intelligence APIs from Whois API, Inc. Its WHOIS API returns parsed registration records for a domain or address, and a hosted MCP server bundles 35 tools on one balance. Top strength 500 free WHOIS credits on signup with no card, and 1 credit a lookup from cache or 5 for a forced refresh Top weakness Per-credit prices are not published outside a calculator; the only public figure is from $129 a month, and orders are non-refundable |
||||||||||||
| 819 | AbuseIPDBAbuseIPDB LLC · HTTP API | Security intel | C | 55.7 | none | n/a | n/a | $25 / mo | API key | Local | ||
|
AbuseIPDB is a crowdsourced database of IP addresses reported for abuse, run by AbuseIPDB LLC under Marathon Studios. Its API v2 returns an abuse confidence score and report history for an address, a subnet or a blacklist, and takes reports. Top strength 1,000 checks and 1,000 reports a day on a free key with no card, and daily limits published for every endpoint and plan Top weakness No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice |
||||||||||||
| 1079 | PulsedivePulsedive LLC · HTTP API | Security intel | D | 47.9 | none | n/a | n/a | $29 / mo | API key | Local | ||
|
Pulsedive is a threat intelligence platform from Pulsedive LLC in New Jersey. Its API looks up domains, IP addresses and URLs for risk scores, linked threats and feeds, scans new indicators on demand and exports STIX over TAXII 2.1. Top strength Keyless lookups and a free account with no card (50 requests a day, 500 a month per the March 2024 plan post) Top weakness The key is sent only as a query parameter, with no header option, scopes or rotation documented |
||||||||||||
| 1221 | ShodanShodan · HTTP API | Security intel | E | 39.5 | none | n/a | n/a | $49 / mo | API key | Hosted | ||
|
Shodan is a search engine for internet-connected devices. Its REST API returns the open ports, banners, certificates and known vulnerabilities of an IP address, searches the index by filter, scans ranges on demand and monitors networks for change. Top strength Host lookup returns ports, banners, certificates, hostnames, tags and known CVEs for an IP, with Top weakness The API key is sent only as |
||||||||||||
| 1270 | SecurityTrailsSecurityTrails (Recorded Future) · HTTP API | Security intel | F | 30.7 | none | n/a | n/a | Paid | API key | Hosted | ||
|
SecurityTrails is a Recorded Future company with a read-only REST API for current and historical DNS records, WHOIS, subdomains, SSL data and IP lookups, used by security teams for domain and attack surface investigation. Top strength Read-only v1 API, by the overview's own statement, covering current DNS, DNS history by record type, WHOIS history, subdomains, SSL data, associated domains and IP lookups Top weakness Pricing, terms, privacy, the security page and security.txt on securitytrails.com answered a Cloudflare challenge on 3 November 2026, so none was read |
||||||||||||
Nothing matches these filters. .
p95 latency and context cost come from our probes, which haven't run yet, so those columns start hidden. Grades run from AA to F, and agent-ready means BB or better. Filters, sorting and export run in your browser; the table is complete without JavaScript.
How we test this category
In this run, public evidence against the published checklist. When the task suites run, the same set of known-bad and known-good domains, addresses and hashes looked up through each listing, the verdicts compared with the public record and the lookups timed. We check what came back, how old the data was, the daily quota on a free key and what the terms let an agent store. This test hasn't run yet, so Task success is pending and the grades here come from the categories assessed from public evidence.
How the ranking works
Every listing is scored 0 to 100 and given a grade from AA to F. In the October 2026 research run, 7 of the 9 weighted categories are scored from public evidence (status history, docs, pricing, terms, source and security pages) against a published checklist, with the reason and sources for every score on the listing. Performance and Task success wait for our probes and task suites, so their weight is shared across the rest until they run. Negative events deduct up to 15 points. Read the methodology.
For companies
Do agents find, use and choose your tools?
An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.