# Threat and security intelligence APIs for AI agents (slim)

> 9 security intelligence listings ranked by the Anchor benchmark. Leader VirusTotal (B). APIs an agent uses to investigate a domain, an IP address, a file hash or an exposed service. Reputation and abuse reports, scan data on open ports and certificates, DNS and WHOIS history and threat indicators. Distinct from guardrails, agent auth and secrets, which protect the agent itself. Compared on what each lookup returns, how fresh the data is, what a free key allows, redistribution terms and price per lookup.

- Full: https://www.anchorterminal.com/categories/security-intelligence.md (~3,200 tokens) · this version ~480 tokens · JSON https://www.anchorterminal.com/categories/security-intelligence.json · canonical https://www.anchorterminal.com/categories/security-intelligence
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-03
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

- Tools: 9 · agent-ready (BB+): 0 · accept x402: 0 · JSON: https://www.anchorterminal.com/api/v1/tools.json · by capability: https://www.anchorterminal.com/api/v1/capabilities.json
- Capabilities: secintel.reputation, secintel.exposure, secintel.dns, secintel.malware, secintel.indicators, secintel.ip-enrichment

| # | Tool | Grade | Score | Confidence | x402 | Auth | Where | Slim |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| 288 | VirusTotal | B | 67.5 | medium | no | OAuth or key | hosted and local | https://www.anchorterminal.com/tools/virustotal.min.md |
| 350 | GreyNoise | B | 66 | medium | no | API key | hosted and local | https://www.anchorterminal.com/tools/greynoise.min.md |
| 420 | Censys | B | 64.1 | medium | no | OAuth or key | hosted | https://www.anchorterminal.com/tools/censys.min.md |
| 464 | IPinfo | B | 62.7 | medium | no | OAuth or key | hosted and local | https://www.anchorterminal.com/tools/ipinfo.min.md |
| 771 | WhoisXML API | C | 56.8 | medium | no | OAuth or key | hosted and local | https://www.anchorterminal.com/tools/whoisxml-api.min.md |
| 819 | AbuseIPDB | C | 55.7 | medium | no | API key | local | https://www.anchorterminal.com/tools/abuseipdb.min.md |
| 1079 | Pulsedive | D | 47.9 | medium | no | API key | local | https://www.anchorterminal.com/tools/pulsedive.min.md |
| 1221 | Shodan | E | 39.5 | medium | no | API key | hosted | https://www.anchorterminal.com/tools/shodan.min.md |
| 1270 | SecurityTrails | F | 30.7 | low | no | API key | hosted | https://www.anchorterminal.com/tools/securitytrails.min.md |