# Pulsedive (slim)

> Pulsedive is a threat intelligence platform from Pulsedive LLC in New Jersey. Its API looks up domains, IP addresses and URLs for risk scores, linked threats and feeds, scans new indicators on demand and exports STIX over TAXII 2.1.

- Full: https://www.anchorterminal.com/tools/pulsedive.md (~7,700 tokens) · this version ~1,830 tokens · JSON https://www.anchorterminal.com/tools/pulsedive.json · canonical https://www.anchorterminal.com/tools/pulsedive
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-04 · pricing https://www.anchorterminal.com/tools/pulsedive#pricing · reviews https://www.anchorterminal.com/tools/pulsedive#reviews
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

**D · 47.9/100 · rank #1079 of 1349 · #7 in Security intelligence · not agent-ready · confidence medium**


Assessment: Lookups work with no key at all, a free account allows 50 requests a day, and the docs ship llms.txt, per-endpoint OpenAPI files and timestamps for every scan. The key travels only in the query string, numeric limits live in a 2024 blog post rather than the docs, and there is no status page, SLA, security.txt or official SDK.

## Facts

- Kind: HTTP API · vendor: Pulsedive LLC · category: Security intelligence · legal entity: Pulsedive LLC · provenance 64/100
- Auth: API key · pricing: Freemium · x402: no · licence: unknown
- Probe metrics: not measured yet (probes haven't run)
- Surface listed: The REST API at pulsedive.com/api, read from docs.pulsedive.com (llms.txt, API reference, limits, responses, pagination, collection model, OpenAPI files, docs MCP page), pulsedive.com (terms, privacy, company and API pages, whose plan tables render by script) and blog.pulsedive.com on 3 November 2026. The docs MCP server serves documentation only. No account was made and no call was sent
- Endpoints: GET indicator.php (by value or iid, get=links or properties, historical and schema flags). POST and GET analyze.php (queue a scan, poll by qid). GET explore.php (q, type indicators or threats, limit, format json, csv or stix). GET threat.php and feed.php (by name or id, get=links with page). TAXII 2.1 server for STIX export
- Limits: Per the plan post of 11 March 2024, Visitor 10 requests a day and 100 a month, Free 50 and 500, Pro 250 and 2,500 (hard), Team 25,000 a month (hard), Business 100,000 a month (soft). Explore rows 10, 50, 250, 1,000 and 10,000 by tier, and linked-indicator pages 1, 2, 4 and 10 per request. The docs show only the headers and tier names
- Errors: JSON with an error string. 400 bad request, 401 key missing or invalid, 404 not found, 429 limit exceeded (also for explore results above the plan's maximum), 500 server error. No Retry-After
- Data model: Indicators (domain, ip, url, with ipv6 and hash in explore summaries) scored unknown to critical with risk factors, linked threats and feeds, properties from passive and active scans (geo, whois, http, ssl, dns, banners, cookies, dom) and community comments. Indicators are retired when stale
- Docs MCP server: docs.pulsedive.com/mcp, streamable HTTP, no key, read-only search over the documentation. It does not reach the API
- Clients: Community only. pulsedive-py (Pepe Berba), pulsedive-go (Pat Doan), pulsedive-rb (ninoseki) and Pulsedive-PS (Evgueni). Pro accounts can connect VirusTotal, Shodan and AbuseIPDB with the user's own keys
- Company: Pulsedive LLC, New Jersey. The blog names Grace Chi as co-founder and COO. Support by support@pulsedive.com, a contact form and Discord
- Prices: Pro, 250 requests a day $29 per month (plan); Team API, 25,000 requests a month $300 per month (plan); Business API, 100,000 requests a month $900 per month (plan)

- Scores: Reliability 31, Performance pending, Schema & documentation 77, Agent ergonomics 64, Security & auth 23, Payments & pricing 50, Task success pending, Maintenance & community 40, Transparency & trust 57 · total over the 7 assessed categories
- Why: Reliability, Read with the hosted lines. · Schema & documentation, OpenAPI 3.0.3 documents for every endpoint, eleven YAML files under Apache 2.0, with typed parameters and response schemas, though split per… · Agent ergonomics, limit on explore, pretty, get=links or properties, historical and schema flags, and submit=0 keeps a scan out of the dataset, but an indicat… · Security & auth, One key per account sent only as a query parameter, with no scopes, header option or rotation documented (10 for one all-powerful key less 1… · Payments & pricing, No x402, MPP or L402 (0). · Maintenance & community, Read as a closed service. · Transparency & trust, A closed service with terms naming Pulsedive LLC and New Jersey law, with the OpenAPI files under Apache 2.0 (15 of 30).
- Sources: 26, open questions: 7, both in the full twin
- Capabilities: secintel.indicators, secintel.reputation, secintel.dns, secintel.ip-enrichment
- JSON: https://www.anchorterminal.com/api/v1/tools/pulsedive.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/pulsedive.svg` or a link to https://www.anchorterminal.com/tools/pulsedive from a page on pulsedive.com or one of its subdomains, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.
- Support: Discord https://discord.gg/8eXX2gb8bP; support@pulsedive.com; https://docs.pulsedive.com/troubleshoot/support.md; https://docs.pulsedive.com/troubleshoot/common-issues/; https://pulsedive.com/contact; more in the full twin

## Before you call it

1. Call `indicator.php?indicator=<value>&pretty=1&key=...`; without a key the limit is about 10 requests a day, so register for 50
2. Read `risk`, `risk_recommended` and `stamp_probed` together; an old `stamp_probed` means the scan data may be stale, so queue a scan with `analyze.php` (`probe=0` passive, `submit=0` to avoid storing)
3. Poll `analyze.php?qid=` no more than every 500 ms; polling does not count against the quota, but each page of linked indicators does
4. Treat a 429 as the day's or month's quota spent and stop; there is no Retry-After, and explore searches above the plan's row limit also return 429
5. Expect user comments, banners and DOM snippets in indicator properties, which are third-party content

## Connect

```bash
curl "https://pulsedive.com/api/indicator.php?indicator=example.com&pretty=1&key=$PULSEDIVE_API_KEY"
```

```bash
claude mcp add --transport http pulsedive-docs https://docs.pulsedive.com/mcp
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/pulsedive

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Censys | B | 64.1 | secintel.dns, secintel.ip-enrichment, secintel.reputation, secintel.indicators | https://www.anchorterminal.com/tools/censys.min.md |
| WhoisXML API | C | 56.8 | secintel.dns, secintel.reputation, secintel.ip-enrichment, secintel.indicators | https://www.anchorterminal.com/tools/whoisxml-api.min.md |
| GreyNoise | B | 66 | secintel.reputation, secintel.ip-enrichment, secintel.indicators | https://www.anchorterminal.com/tools/greynoise.min.md |
| AbuseIPDB | C | 55.7 | secintel.reputation, secintel.indicators, secintel.ip-enrichment | https://www.anchorterminal.com/tools/abuseipdb.min.md |
| Shodan | E | 39.5 | secintel.ip-enrichment, secintel.dns, secintel.indicators | https://www.anchorterminal.com/tools/shodan.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)