# Threat and security intelligence APIs for AI agents

> 9 security intelligence listings ranked by the Anchor benchmark. Leader VirusTotal (B). APIs an agent uses to investigate a domain, an IP address, a file hash or an exposed service. Reputation and abuse reports, scan data on open ports and certificates, DNS and WHOIS history and threat indicators. Distinct from guardrails, agent auth and secrets, which protect the agent itself. Compared on what each lookup returns, how fresh the data is, what a free key allows, redistribution terms and price per lookup.

- Canonical: https://www.anchorterminal.com/categories/security-intelligence
- Markdown: https://www.anchorterminal.com/categories/security-intelligence.md (~3,200 tokens)
- Slim: https://www.anchorterminal.com/categories/security-intelligence.min.md (~480 tokens, same facts, less prose, for token-sensitive contexts)
- JSON: https://www.anchorterminal.com/categories/security-intelligence.json (this page as data, same URL with Accept: application/json)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-03

APIs an agent uses to investigate a domain, an IP address, a file hash or an exposed service. Reputation and abuse reports, scan data on open ports and certificates, DNS and WHOIS history and threat indicators. Distinct from guardrails, agent auth and secrets, which protect the agent itself. Compared on what each lookup returns, how fresh the data is, what a free key allows, redistribution terms and price per lookup.

- Tools ranked: 9 · agent-ready (BB or better): 0 · accept x402: 0 · hosted endpoints: 7 · desk reviews by the panel: 0
- JSON: https://www.anchorterminal.com/api/v1/tools.json (list) · https://www.anchorterminal.com/api/v1/rankings.json (ranked) · https://www.anchorterminal.com/api/v1/x402.json (payable) · https://www.anchorterminal.com/api/v1/capabilities.json (by capability)
- Grades run AA, A, BB, B, C, D, E, F · methodology: https://www.anchorterminal.com/benchmark/

- Shortlist and picks by need: https://www.anchorterminal.com/best/security-intelligence/index.md
- Head-to-head comparisons (33): https://www.anchorterminal.com/compare/security-intelligence/index.md
- Capabilities in this category: secintel.reputation, secintel.exposure, secintel.dns, secintel.malware, secintel.indicators, secintel.ip-enrichment
- https://letme.dev/secintel.reputation picks the top-graded tool in this list and says how to call it direct (https://www.anchorterminal.com/letme/index.md)

## Ranking

| # | Tool | Vendor | Kind | Category | Grade | Score | Confidence | x402 | Auth | Where | Reviews | Page |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| 288 | VirusTotal | Google LLC | HTTP API | Security intel | B | 67.5 | medium | no | OAuth or key | hosted and local | none | https://www.anchorterminal.com/tools/virustotal.md |
| 350 | GreyNoise | GreyNoise Intelligence, Inc. | HTTP API | Security intel | B | 66 | medium | no | API key | hosted and local | none | https://www.anchorterminal.com/tools/greynoise.md |
| 420 | Censys | Censys, Inc. | HTTP API | Security intel | B | 64.1 | medium | no | OAuth or key | hosted | none | https://www.anchorterminal.com/tools/censys.md |
| 464 | IPinfo | IPinfo Inc. | HTTP API | Security intel | B | 62.7 | medium | no | OAuth or key | hosted and local | none | https://www.anchorterminal.com/tools/ipinfo.md |
| 771 | WhoisXML API | Whois API, Inc. | HTTP API | Security intel | C | 56.8 | medium | no | OAuth or key | hosted and local | none | https://www.anchorterminal.com/tools/whoisxml-api.md |
| 819 | AbuseIPDB | AbuseIPDB LLC | HTTP API | Security intel | C | 55.7 | medium | no | API key | local | none | https://www.anchorterminal.com/tools/abuseipdb.md |
| 1079 | Pulsedive | Pulsedive LLC | HTTP API | Security intel | D | 47.9 | medium | no | API key | local | none | https://www.anchorterminal.com/tools/pulsedive.md |
| 1221 | Shodan | Shodan | HTTP API | Security intel | E | 39.5 | medium | no | API key | hosted | none | https://www.anchorterminal.com/tools/shodan.md |
| 1270 | SecurityTrails | SecurityTrails (Recorded Future) | HTTP API | Security intel | F | 30.7 | low | no | API key | hosted | none | https://www.anchorterminal.com/tools/securitytrails.md |

Scores are from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/), with Performance and Task success pending. p95 latency and context cost come from our probes, which haven't run yet.

## Summaries

### 288. VirusTotal, B (67.5)

VirusTotal, part of Google, aggregates verdicts from over 70 antivirus engines and URL scanners on files, URLs, domains and IP addresses. Agents call the v3 REST API with a key, or VirusTotal AI over REST and a remote MCP server. VTAI gives an agent a free token by one POST, 1,000 lookups a day, an OpenAPI document and an 11-tool MCP server with read-only and destructive hints. No status page, no public premium price and a public API limited to non-commercial use at 500 requests a day are the limits.

- Page: https://www.anchorterminal.com/tools/virustotal · Markdown: https://www.anchorterminal.com/tools/virustotal.md · JSON: https://www.anchorterminal.com/api/v1/tools/virustotal.json
- Capabilities: secintel.reputation, secintel.malware, secintel.indicators · endpoint: `https://ai.virustotal.com/mcp`

### 350. GreyNoise, B (66)

GreyNoise classifies IP addresses seen scanning the internet as benign, malicious, suspicious or unknown, with tags, exploited CVEs and business-service trust levels, through a v3 REST API, a Python SDK and an official local MCP server. A public OpenAPI document covers 70 v3 operations with typed errors, a status page lists no incident in 90 days, and `quick=true`, GNQL scrolling and bulk lookups of 10,000 IPs keep responses sized. Paid tiers have no public price, the key is one unscoped credential per workspace, and no prompt-injection guidance was found for the scanner payloads it returns.

- Page: https://www.anchorterminal.com/tools/greynoise · Markdown: https://www.anchorterminal.com/tools/greynoise.md · JSON: https://www.anchorterminal.com/api/v1/tools/greynoise.json
- Capabilities: secintel.reputation, secintel.ip-enrichment, secintel.indicators · endpoint: `https://api.greynoise.io/v3`

### 420. Censys, B (64.1)

Censys is an internet scanning and intelligence service. Its Platform API returns what an IP address, web property or certificate exposes, with DNS resolution, host history, enrichment and reputation data, through REST, a hosted MCP server, SDKs and a CLI. A versioned OpenAPI surface with field selection, page tokens, three official SDKs, a hosted MCP server and a free key of 100 credits a month. Paid enterprise access is sold by sales, scan results carry untrusted banner text with no injection guidance, and the status feed records a 13-hour outage on 30 September 2026.

- Page: https://www.anchorterminal.com/tools/censys · Markdown: https://www.anchorterminal.com/tools/censys.md · JSON: https://www.anchorterminal.com/api/v1/tools/censys.json
- Capabilities: secintel.exposure, secintel.dns, secintel.ip-enrichment, secintel.reputation, secintel.indicators · endpoint: `https://api.platform.censys.io/v3/`

### 464. IPinfo, B (62.7)

IPinfo is an IP address data service from IPinfo Inc. in Seattle. Its API returns geolocation, ASN, privacy and residential proxy signals for an address, with a free Lite tier, paid tiers, a batch endpoint and a hosted MCP server. A free Lite tier with no request cap, a public OpenAPI document, llms.txt, a batch endpoint of 1,000 lookups and a six-tool hosted MCP server with OAuth. No status page or SLA was found, the only documented error is 429, the token may travel in a query string, and city-level and privacy data need a paid plan.

- Page: https://www.anchorterminal.com/tools/ipinfo · Markdown: https://www.anchorterminal.com/tools/ipinfo.md · JSON: https://www.anchorterminal.com/api/v1/tools/ipinfo.json
- Capabilities: secintel.ip-enrichment, secintel.reputation · endpoint: `https://mcp.ipinfo.io/`

### 771. WhoisXML API, C (56.8)

WhoisXML API is a set of domain, DNS, IP and threat intelligence APIs from Whois API, Inc. Its WHOIS API returns parsed registration records for a domain or address, and a hosted MCP server bundles 35 tools on one balance. 500 free credits with no card, JSON Schema and XSD for every response, 429s with Retry-After, cache controls that set the price per lookup, and a 35-tool hosted MCP server with OAuth. Per-credit prices sit behind a calculator, the terms confine data to one site and forbid AI training on it, and the key is accepted in the query string.

- Page: https://www.anchorterminal.com/tools/whoisxml-api · Markdown: https://www.anchorterminal.com/tools/whoisxml-api.md · JSON: https://www.anchorterminal.com/api/v1/tools/whoisxml-api.json
- Capabilities: secintel.dns, secintel.reputation, secintel.ip-enrichment, secintel.indicators · endpoint: `https://mcp-hosted.whoisxmlapi.com/mcp`

### 819. AbuseIPDB, C (55.7)

AbuseIPDB is a crowdsourced database of IP addresses reported for abuse, run by AbuseIPDB LLC under Marathon Studios. Its API v2 returns an abuse confidence score and report history for an address, a subnet or a blacklist, and takes reports. A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.

- Page: https://www.anchorterminal.com/tools/abuseipdb · Markdown: https://www.anchorterminal.com/tools/abuseipdb.md · JSON: https://www.anchorterminal.com/api/v1/tools/abuseipdb.json
- Capabilities: secintel.reputation, secintel.indicators, secintel.ip-enrichment

### 1079. Pulsedive, D (47.9)

Pulsedive is a threat intelligence platform from Pulsedive LLC in New Jersey. Its API looks up domains, IP addresses and URLs for risk scores, linked threats and feeds, scans new indicators on demand and exports STIX over TAXII 2.1. Lookups work with no key at all, a free account allows 50 requests a day, and the docs ship llms.txt, per-endpoint OpenAPI files and timestamps for every scan. The key travels only in the query string, numeric limits live in a 2024 blog post rather than the docs, and there is no status page, SLA, security.txt or official SDK.

- Page: https://www.anchorterminal.com/tools/pulsedive · Markdown: https://www.anchorterminal.com/tools/pulsedive.md · JSON: https://www.anchorterminal.com/api/v1/tools/pulsedive.json
- Capabilities: secintel.indicators, secintel.reputation, secintel.dns, secintel.ip-enrichment

### 1221. Shodan, E (39.5)

Shodan is a search engine for internet-connected devices. Its REST API returns the open ports, banners, certificates and known vulnerabilities of an IP address, searches the index by filter, scans ranges on demand and monitors networks for change. One GET endpoint per job returns ports, banners and vulnerabilities for an IP, with `minify` and `fields` to trim responses and public plan prices from a $49 one-time Membership. The key travels only in the query string with no scopes, 429 handling is undocumented, the terms were unreadable and the official library's last release was December 2023.

- Page: https://www.anchorterminal.com/tools/shodan · Markdown: https://www.anchorterminal.com/tools/shodan.md · JSON: https://www.anchorterminal.com/api/v1/tools/shodan.json
- Capabilities: secintel.exposure, secintel.ip-enrichment, secintel.dns, secintel.indicators · endpoint: `https://api.shodan.io`

### 1270. SecurityTrails, F (30.7)

SecurityTrails is a Recorded Future company with a read-only REST API for current and historical DNS records, WHOIS, subdomains, SSL data and IP lookups, used by security teams for domain and attack surface investigation. The v1 API is read-only and reaches current and historical DNS, WHOIS, subdomain and SSL records, with llms.txt and a Markdown twin of every reference page. The key is accepted in the query string, the changelog stops in May 2020, the status page is private, and pricing, terms and privacy sat behind a Cloudflare challenge when checked.

- Page: https://www.anchorterminal.com/tools/securitytrails · Markdown: https://www.anchorterminal.com/tools/securitytrails.md · JSON: https://www.anchorterminal.com/api/v1/tools/securitytrails.json
- Capabilities: secintel.dns, secintel.exposure, secintel.ip-enrichment · endpoint: `https://api.securitytrails.com/v1/`

## How we test this category

In this run, public evidence against the published checklist. When the task suites run, the same set of known-bad and known-good domains, addresses and hashes looked up through each listing, the verdicts compared with the public record and the lookups timed. We check what came back, how old the data was, the daily quota on a free key and what the terms let an agent store. This test hasn't run yet, so Task success is pending and the grades here come from the categories assessed from public evidence.


---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp