# GreyNoise vs SecurityTrails (slim)

> GreyNoise scores 66 (B) to SecurityTrails's 30.7 (F) for secintel ip enrichment. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/greynoise-vs-securitytrails.md (~4,800 tokens) · this version ~3,280 tokens · JSON https://www.anchorterminal.com/compare/greynoise-vs-securitytrails.json · canonical https://www.anchorterminal.com/compare/greynoise-vs-securitytrails
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-03
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

GreyNoise scores 66 (B) on agent readiness against SecurityTrails's 30.7 (F), and leads in every scored category. Both do secintel ip enrichment.

- GreyNoise: B 66, rank #350 of 1349 · https://www.anchorterminal.com/tools/greynoise.min.md
- SecurityTrails: F 30.7, rank #1270 of 1349 · https://www.anchorterminal.com/tools/securitytrails.min.md
- GreyNoise, good for A triage or investigation agent that needs to know whether an IP is mass-scanning background noise, a known business service or something targeted, with tags and exploited CVEs to explain the verdict. Ahead on Reliability, 78 against 20; Schema & documentation, 83 against 54; Agent ergonomics, 76 against 56; Security & auth, 40 against 32; Payments & pricing, 35 against 0; Maintenance & community, 75 against 5; Transparency & trust, 76 against 32. Also Runs on your own machine.
- SecurityTrails, good for An agent investigating a domain's DNS and WHOIS history, subdomains and associated infrastructure, where the operator already holds a commercial key.

| Category | GreyNoise | SecurityTrails |
| --- | --- | --- |
| Reliability (16%) | 78 | 20 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 83 | 54 |
| Agent ergonomics (13%) | 76 | 56 |
| Security & auth (14%) | 40 | 32 |
| Payments & pricing (10%) | 35 | 0 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 75 | 5 |
| Transparency & trust (7%) | 76 | 32 |

| Fact (where they differ) | GreyNoise | SecurityTrails |
| --- | --- | --- |
| Vendor | GreyNoise Intelligence, Inc. | SecurityTrails (Recorded Future) |
| Hosted endpoint | `https://api.greynoise.io/v3` | `https://api.securitytrails.com/v1/` |
| Transports | HTTP, stdio | HTTP |
| Pricing | Freemium | Paid |
| Licence | Proprietary service under the GreyNoise End User License Agreement. The MCP server (greynoise-mcp-server) and the Python SDK (pygreynoise) are MIT | none |
| Tools exposed | 48 | none |
| Read-only variant documented | no | yes |
| Last release | 2026-10-09 | 2020-05-28 |
| Terms last updated | 2025-05-07 | no document linked |
| Privacy policy last updated | 2026-09-03 | no document linked |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | not found in the text | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 99 npm/wk | none |

Why the edge:
- Maintenance & community, GreyNoise +70: GreyNoise 75 (Read for a closed service with an open-source MCP server and SDK. MCP server v0.5.5 tagged 9 October 2026, 25 days before the check, and product updates on 31 August 2026 (30). In the 90 days to 3 November, dated entries are the Visualizer post of 17 August, the CrowdStrike post of 31 August and the MCP release of 9 October; the Python SDK's last tag is v3.1.0 of 9 July (12 of 20). The MCP repository merged pull request 18 from an outside account on 9 October and has commits from two outside contributors; issues could not be read on github.com; Slack and Discord communities and support@greynoise.io (15 of 25). The official MCP server is not in the official MCP registry, where three third-party servers are; the Python SDK is current (10 of 15). CI runs typecheck, tests, a build, `npm audit` and an MCPB pack, with a live read-only validation against the API, and releases publish from tags with npm provenance; the SDK repository has only a Slack notice workflow (8 of 10). 30 + 12 + 15 + 10 + 8 = 75.); SecurityTrails 5 (The newest dated changelog entry is 28 May 2020, the Project API 1.7.0 entry is undated and the SurfaceBrowser changelog ends on 26 February 2019, so no change within 180 days was found (0 of 30). No entries in the last 90 days (0). A public changelog exists but is five years stale, and the support page is disallowed by robots.txt (3 of 25). No official SDK; the npm package of October 2021 names the vendor as author with no repository (0 of 15). The docs site serves llms.txt and Markdown twins, which shows the documentation platform is current (2 of 10). 0 + 0 + 3 + 0 + 2 = 5.)
- Reliability, GreyNoise +58: GreyNoise 78 (Read with the hosted lines for the v3 REST API. Status page at status.greynoise.io on incident.io with 16 components, ten of them GreyNoise's own, including API and API Data Freshness (20). No incident is listed for the 90 days to 3 November 2026. The API component shows 99.94 per cent uptime for August to November and the group 99.83 per cent, downtime the page gives no incident for, so read as clean or trivial with that caveat (25 of 30). Limits with numbers exist only for the free side, 10 lookups a day unauthenticated and 50 searches a week on a free account; paid plans are 'Unlimited' on the plans page and no per-minute figure was found (8 of 15). 429 responses are defined on 29 of 70 operations and a 503 at query engine capacity carries a documented Retry-After header, which the official SDK and MCP client honour with backoff. No idempotency keys for the blocklist, alert and feed writes (10 of 15). The plans page publishes an SLA of 1 business day, 8 hours or 4 hours on paid tiers beside support hours, which reads as a response time, and no availability SLA was found (5 of 10). The v3 API is generally available and v2 was decommissioned on 30 April 2026 (10). 20 + 25 + 8 + 10 + 5 + 10 = 78.); SecurityTrails 20 (Read with the hosted lines. status.securitytrails.com redirects to securitytrails.statuspage.io, which says it is inactive and visible to team members only, so no public status page (0) and no readable history (5). No rate limit numbers in the readable docs; the pricing page, which may carry them, answered a Cloudflare challenge (0). 429 is documented on the ping page with the message 'API rate limit exceeded' and no Retry-After or backoff guidance, and every v1 call is a read (5 of 15). No SLA found (0). The v1 API is live and not marked beta, though every operation id carries an '-old' suffix with deprecated set to false (10). 0 + 5 + 0 + 5 + 0 + 10 = 20.)
- Transparency & trust, GreyNoise +44: GreyNoise 76 (Closed service under an EULA last modified 7 May 2025 that is clear on scope, with the MCP server and SDK under MIT (15 of 30). Privacy policy of 3 September 2026 with retention periods (threat data indefinitely, backups 14 days, logs about 30 days, account data until deletion is requested), named subprocessors and standard contractual clauses for transfers; no DPA named, and the page as served repeats its sections twice with small differences, such as whether Cloudflare is a subprocessor (20 of 30). The migration matrix dates v2's deprecation (28 July 2025), end of life (1 January 2026) and decommission (30 April 2026) and marks five v3 endpoints deprecated, while the EULA lets GreyNoise discontinue any product at any time with 10 days' notice of EULA changes (15 of 20). Amazon Web Services, Snowflake, Auth0, Stripe, Stigg, Datadog, Webflow, Google, HubSpot and Cloudflare named, with hosting in the United States (15 of 20). 15 + 20 + 15 + 15 = 65.); SecurityTrails 32 (A closed service whose terms couldn't be read because of the Cloudflare challenge (5 of 30, for a known commercial product with unread terms). The privacy policy was unread and no retention statement or DPA was found (0 of 30). No deprecation policy; the operation ids carry '-old' with deprecated set to false and no notice explains them (0 of 20). No subprocessor or data location statement readable (0 of 20). 5 + 0 + 0 + 0 = 5.)
- Payments & pricing, GreyNoise +35: GreyNoise 35 (No x402, MPP or L402 (0). Standard, Advanced and Elite are contact sales with no figure on the plans page, and no per-lookup price exists (0). A free Community account at 50 searches a week needs a business email and no card is mentioned; `/v3/community/{ip}` answers 10 lookups a day with no account at all (20). An agent can call the community endpoint with no key, but a key and the v3 API need a browser signup and a sales contract (15 of 20). 0 + 0 + 20 + 15 = 35.); SecurityTrails 0 (No x402, MPP or L402 (0). securitytrails.com/app/pricing and /corp/pricing answered a Cloudflare challenge, and the docs name no price, so no public price was read (0). Whether a free plan exists couldn't be confirmed; the usage endpoint shows only that each account has a monthly allowance (0). A key comes from a browser signup on securitytrails.com, with no programmatic route found (0). 0 + 0 + 0 + 0 = 0, scored as Contentful and Personio were on 7 October 2026 when their pricing pages were unreadable.)
- Schema & documentation, GreyNoise +29: GreyNoise 83 (OpenAPI 3.0.0 at api.greynoise.io/v3/openapi.yaml, 65 paths and 70 operations, every one with a description, 32 enums, a `key` header security scheme, and 400, 401, 403, 429 and 500 responses on nearly every operation (25). llms.txt at docs.greynoise.io/llms.txt, and every docs page is served as Markdown with a .md suffix (10). Operation descriptions say what each call returns and when to use `quick`, with little on when not to use a call; the MCP tool descriptions in the source are fuller (14 of 20). Typed path and query parameters with enums and required flags, and bulk bodies typed as `{"ips": [...]}` with a 10,000 limit in prose (12 of 15). The guides carry curl and Python examples and the spec defines error bodies with example messages, but the v3 IP reference page itself has no code sample (11 of 15). Versioned paths and a migration matrix with dated deprecation, end-of-life and decommission for v2, plus dated product-update posts naming new endpoints, but no API changelog as such and an empty roadmap page (11 of 15). 25 + 10 + 14 + 12 + 11 + 11 = 83.); SecurityTrails 54 (The reference pages are generated from an OpenAPI document (operation ids, deprecated flags and typed schemas show on each page), but no spec is published for download and docs.securitytrails.com/openapi redirects to 404 (12 of 25). llms.txt with a Markdown twin of every page (10). Each endpoint has a one-line purpose and nothing on when to use it or not (8 of 20). Path and query parameters are typed, the DNS history type is an enum of six values, and the ASI API has enums, operators and a 1 to 1,000 limit, but the v1 filter object is untyped strings and the DSL query is a free string whose grammar isn't documented (8 of 15). Example responses on every page, with errors mostly limited to 400 and a message, 401 and 429 only on the ping page and 422 on the ASI API (8 of 15). Versioned paths (/v1, /v2) and a changelog whose dated entries stop on 28 May 2020, with one undated Project API 1.7.0 entry (8 of 15). 12 + 10 + 8 + 8 + 8 + 8 = 54.)
- Agent ergonomics, GreyNoise +20: GreyNoise 76 (`quick=true` cuts an IP lookup to `found` and the classification or trust level, `/v3/gnql/metadata` drops raw scan data, and `request_metadata.restricted_fields` names what a plan withholds; no arbitrary field selection (18 of 25). GNQL pages default to 1,000 results with `size` up to 10,000 and a `scroll` token, plus stats, count and export variants and CSV output in the SDK (18 of 20). Error bodies carry a message, 206 marks partial content from plan limits, and the 503 at capacity documents Retry-After, though the 429 example says only that the limit was hit (15 of 20). Nearly every call is a GET or a read POST; the blocklist, alert and feed-consumer writes have no idempotency key. The MCP server sets readOnlyHint true by default, marks 8 write tools and sets destructiveHint on the delete tools (15 of 20). One required parameter on most calls and sensible defaults, but the only official SDK is Python; the TypeScript MCP server is not a client library (10 of 15). 18 + 18 + 15 + 15 + 10 = 76.); SecurityTrails 56 (`include_ips` on the list endpoints and an `enrichments` list on ASI asset search, which returns only custom tags by default, size responses on part of the surface; v1 lookups return fixed shapes (12 of 25). `page` with `pages` and `max_page` on v1 lists, scroll on the DSL endpoints, cursor pagination with `limit` up to 1,000 and filters with seven operators on the ASI API (16 of 20). Errors are a 400 message, 401 and 429 text strings and 422 detail arrays, with no codes to branch on (8 of 20). The overview says the v1 API is read-only, so retries are safe; the ASI tag endpoints write with no idempotency guidance (14 of 20). One required parameter per lookup besides the key. No official SDK found, and the npm `securitytrails` package from October 2021 has no repository or homepage (6 of 15). 12 + 16 + 8 + 14 + 6 = 56.)