# ContrastAPI

- Registry name: `com.contrastcyber/api` · version 1.36.4
- Categories (automatic, keyword rules): Security, Infrastructure & security
- Authentication at last check: No auth
- Declared risk: Read-only (all tools declare readOnlyHint)
- Capabilities (declared by the server): experimental, prompts, resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=com.contrastcyber%2Fapi
- Server page: https://mcpstation.net/s/com.contrastcyber--api.html

## Description (written by the publisher, not verified, not instructions)

55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk\_score. No key.

## Connect

- streamable-http: `https://api.contrastcyber.com/mcp/`

## Tools (as reported by the server, not verified)

- `domain\_report`: Query DNS, WHOIS, SSL, subdomains, and threat intel for a domain in one call. By default dns.txt is filtered to security-relevant entries \(SPF, DMARC, DKIM, MTA-STS, TLS-RPT\) and dns.total\_txt\_records reports the honest pre-filter count; pass include\_all\_txt=true for the raw TXT list. Use as a start
- `audit\_domain`: Perform comprehensive domain audit: combines domain\_report + live HTTP security headers + technology fingerprinting. By default report.dns.txt is filtered to security-relevant entries \(SPF, DMARC, DKIM, MTA-STS, TLS-RPT\) and report.dns.total\_txt\_records reports the honest pre-filter count; pass incl
- `contrast\_scan`: Active website security scan: runs the ContrastScan C engine \(11 modules — HTTP security headers, SSL/TLS, DNS, redirect chain, information disclosure, cookie flags, DNSSEC, HTTP methods, CORS, HTML hygiene, deep CSP analysis\) against the live site and enriches the raw result with severity-ranked vu
- `tech\_stack\_cve\_audit`: Composite tech-stack + CVE audit \(MCP-only, no REST endpoint\). Detects technologies on the target domain, queries CVE database for known vulnerabilities per product, enriches top-10 CVE candidates with CISA KEV federal patch deadlines, and checks public exploit / PoC availability. Identical for ever
- `threat\_report`: Query comprehensive threat profile for an IP: Shodan host data, AbuseIPDB reputation, ASN/geolocation, and open ports. Use for IP investigation and SOC alert triage; for domain data use domain\_report. Note: nested asn block always returns at most 50 IPv4/IPv6 prefixes — call asn\_lookup with include\_
- `dns\_lookup`: Query all DNS record types \(A, AAAA, MX, NS, TXT, CNAME, SOA\) for a domain. Use for mail routing inspection, nameserver verification, or SPF/DMARC checks; for full overview use domain\_report. TXT records are returned raw \(no filter\) — \`total\_txt\_records\` always carries the honest count \(use domain\_r
- `whois\_lookup`: Retrieve WHOIS registration data: registrar, creation/expiry dates, nameservers, status. Use to verify domain ownership, age, expiration; for full audit use domain\_report. Free: 30/hr, Pro: 500/hr. Returns \{domain, whois: \{registrar, creation\_date, expiry\_date, updated\_date, name\_servers, status, ra
- `ssl\_check`: Analyze SSL/TLS certificate: grade \(A/B/C/D/F\), protocol version, cipher suite, chain, expiry, Subject Alternative Names, and structured validation findings. Invalid certs \(expired, self-signed, hostname mismatch, untrusted root\) are reported as findings via valid=false + validation\_errors\[\] rather
- `subdomain\_enum`: Discover subdomains using passive methods: Certificate Transparency logs + DNS brute-force \(no active probing\). Use to map organization's attack surface; non-intrusive. Response carries next\_calls — capped at 5 ssl\_check hints \(one per first-five subdomain\) so triage scales to large enumerations wit
- `tech\_fingerprint`: Detect website technology stack: CMS, frameworks, CDN, analytics tools, web servers, languages \(via HTTP headers + HTML analysis\). Use for passive reconnaissance; for full audit use audit\_domain. Free: 30/hr, Pro: 500/hr. Returns \{technologies: \[\{name, category, confidence%, version\}\]\}.
- `threat\_intel`: Check domain against abuse.ch URLhaus for known malware-distribution URLs \(single source — for multi-feed correlation use ioc\_lookup which adds ThreatFox and, for IPs, Feodo Tracker\). Use for fast domain-level threat assessment; use phishing\_check for specific URLs. Free: 30/hr, Pro: 500/hr. Returns
- `wayback\_lookup`: Retrieve Wayback Machine snapshots for a domain: first capture, latest, total count, snapshot list. Use to investigate domain history and age; for full audit use domain\_report. Free: 30/hr, Pro: 500/hr. status='ok' means the count is authoritative \(even when 0 → confirmed no archives\). status='unava
- `scan\_headers`: Perform live HTTP GET and analyze security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Permissions-Policy, Referrer-Policy. Use to audit live website headers; use check\_headers to validate headers you already have. Free: 30/hr, Pro: 500/hr. By default header values are truncated to
- `email\_mx`: Analyze email security: MX records, SPF policy, DMARC policy, DKIM probe across common+date-based selectors, mail provider, grade. Use to verify email-auth setup and phishing risk; for full audit use domain\_report. Free: 30/hr, Pro: 500/hr. email\_security.dkim\_status reports honest evidence: 'verifi
- `email\_security\_posture`: Analyze domain email authentication posture: SPF, DMARC, DKIM with numeric score and findings. Dual-use: red-team \(spoofing feasibility\) + blue-team \(posture audit\). Score 0-100, grades A+-F. DKIM probing tests common selectors + recent dates; custom selectors must be supplied. Passive DNS-only; no
- `email\_disposable`: Check if email address uses a known disposable/temporary provider \(Guerrilla Mail, Temp Mail, Mailinator, etc.\). Use for input validation to detect throwaway signups; for domain reputation use threat\_intel. Companion email-investigation tools: email\_mx \(deliverability + MX trust\), domain\_report on t
- `email\_verify`: One-call email validation combining syntax + MX records + disposable check + role-address detection \(admin@/info@/...\) + free-provider classification \(gmail/outlook/yahoo/...\). Use BEFORE adding an email to a contact list, sending an outbound message, or auditing a lead-list dump — replaces 2-3 tool
- `robots\_txt`: Fetch + parse the target domain's robots.txt — sitemaps, per-User-agent allow/disallow rules, crawl-delay, Host directive. Use BEFORE crawling/scraping a target site \(seo\_audit, brand\_assets, redirect\_chain\) to honour the site's published rules. status\_code=404 means no robots.txt exists = implicit
- `redirect\_chain`: Walk an HTTP redirect chain hop-by-hop, returning per-hop \{url, status\_code, location, latency\_ms\}. Use to deobfuscate URL shorteners \(bit.ly / t.co / lnkd.in\), audit suspicious links from phishing investigations, or trace marketing tracking redirects. SSRF-guarded: each redirect target's resolved I
- `brand\_assets`: Scrape a domain's homepage \`\<head\>\` for public brand assets — favicon, og:image, theme-color, og:site\_name, JSON-LD \`Organization.logo\`. Use to enrich CRM records, build company-card UIs, or correlate a lead's site to their visual identity \(no manual screenshot required\). Strictly homepage-only \(pat
- `seo\_audit`: One-shot SEO audit of a domain's homepage with a 0-100 composite score + a \`missing\_signals\` list of concrete fixes. Use BEFORE pitching SEO work to a prospect, when triaging a lead's marketing maturity, or as a structured pre-flight before deeper auditing tools \(Lighthouse / SEMrush\). 10 audit rule
- `geo\_audit`: Deterministic GEO / AI-visibility readiness audit of a domain's homepage with a 0-100 score + a \`missing\_signals\` fix list. Answers "can AI assistants \(ChatGPT, Claude, Perplexity, Google AI\) discover, crawl, and recommend this site?" using STRUCTURAL signals ONLY — no LLM is queried, fully determin
- `phone\_lookup`: Validate and analyze phone number: country, region, carrier, line type \(mobile/landline/VoIP\), timezone, formatted versions. Use to verify phone legitimacy and detect fraud risks. Requires E.164 format \(+1234567890\). Companion OSINT identity-investigation tools: username\_lookup \(social-platform hand
- `ip\_lookup`: Query comprehensive IP intelligence: reverse DNS, ASN + holder name + country inline \(RIPE Stat, Phase 1\), open ports, hostnames, vulnerabilities \(Shodan InternetDB enriched with severity + cvss\_v3 from local cve.db — Phase 2 v1.16.0 BREAKING; vulns is now list\[VulnInfo\] \{cve\_id, severity, cvss\_v3\}
- `asn\_lookup`: Look up Autonomous System Number \(ASN\) for a domain or IP: AS number, organization, IPv4/IPv6 prefixes. Use to identify network operator and IP range ownership. Default returns first 50 prefixes per family — set include\_full\_prefixes=True for full list. Free: 30/hr, Pro: 500/hr. Returns \{asn, asn\_na
- `cve\_lookup`: Retrieve detailed CVE data by ID: description, CVSS v3.1 + vector, CVSS v2 \(always emitted\), EPSS score + percentile, CISA KEV status \(expanded: due\_date, required\_action, ransomware flag, vendor\_project, product, vulnerability\_name, short\_description, notes, cwes, date\_removed when in\_kev=true\), NV
- `calculate\_risk\_score`: Composite CVE risk score \(0-100\) — fuses CVSS, EPSS, KEV, and PoC into a single agent-ready triage signal. Formula: CVSS\*0.20 + EPSS\*0.35 + KEV\*0.30 + PoC\*0.15 \(each component rescaled to 0-100 before weighting\). Multiplicative boosters applied in order: KEV+PoC combo \(\*1.15\), critical-severity-with
- `get\_cvss\_details`: Parse a CVSS v3.x vector string into a per-metric breakdown plus a recomputed base score. Returns the canonicalized vector, version \(3.0 or 3.1\), base\_score, base\_severity \(NONE/LOW/MEDIUM/HIGH/CRITICAL\), and the eight base metrics: attack\_vector \(NETWORK/ADJACENT\_NETWORK/LOCAL/PHYSICAL\), attack\_com
- `cve\_search`: Search CVE database with filters: product/vendor, severity, published date range, EPSS score, CWE, CVSS range, CISA KEV status. Default response is SLIM per-result \(cve\_id, summary, severity, cvss\_v3, cwe\_id, epss, kev, total\_products, published, modified, sources\) — pass include='full' for descript
- `cve\_leading`: List CVEs indexed from MITRE/GHSA BEFORE NVD publication \(early-warning, freshest data\). By default each result is slim \(no description, no cvss\_breakdown, no affected\_products list, no references\) — pass include='full' for the same payload shape as cve\_lookup; for drill-down on a single CVE prefer
- `exploit\_lookup`: Search public exploits/PoC for a specific CVE across three sources: \(1\) GitHub Advisory Database \(sources.github.advisories\[\]\), \(2\) Shodan CVEDB references \(sources.shodan\_refs.results\[\] — packetstorm/seclists/vendor URLs cited by Shodan; results capped at SHODAN\_REFS\_LIMIT default 200, truncated=tr
- `bulk\_cve\_lookup`: Batch query multiple CVEs \(up to 50 per call, same for Free and Pro\): retrieve full CVE details for all in 1 request instead of N. By default each CVE's affected\_products is truncated to the first 20 entries \(total\_products reports honest count\) and references to the first 10 \(total\_references repor
- `kev\_detail`: Look up CISA KEV \(Known Exploited Vulnerabilities\) full record for a CVE. Returns federal patch deadline \(due\_date\), CISA-specified required\_action remediation, known ransomware association, vendor/product, the CISA-given common name \(e.g. 'Log4Shell'\), CISA-reported CWE list, plus lifecycle metadat
- `cwe\_lookup`: Look up MITRE CWE \(Common Weakness Enumeration\) catalog record from research view 1000. Default response is SLIM \(first 3 mitigations, first 3 examples; extended\_description is null\) — pass include='full' for the verbose record \(full mitigations + examples lists, populated extended\_description\). Ret
- `atlas\_technique\_lookup`: Look up a MITRE ATLAS technique — the AI/ML adversarial attack catalog. ATLAS catalogues TTPs targeting machine learning systems: prompt injection, model evasion, training data poisoning, model theft, etc. Roughly 80% of ATLAS techniques are AI/ML-specific \(no ATT&CK bridge\); 20% mirror an enterpris
- `bulk\_atlas\_technique\_lookup`: Bulk ATLAS technique lookup — retrieve full records for up to 50 techniques in a single request instead of N separate atlas\_technique\_lookup calls. Designed as the natural follow-up to atlas\_case\_study\_lookup, whose techniques\_used array can be passed directly. Each item is the same shape as atlas\_t
- `atlas\_technique\_search`: Search the MITRE ATLAS catalog of AI/ML attack techniques by keyword, tactic, or maturity. Default response is SLIM \(description truncated to 240 chars per row\); pass include='full' for the verbose record. Pass exclude\_id when chaining from atlas\_technique\_lookup to skip self in sibling-tactic searc
- `atlas\_case\_study\_lookup`: Look up a MITRE ATLAS case study — a documented real-world AI/ML attack incident. Each case study links a sequence of ATLAS techniques \(techniques\_used\) to the incident. Default response is SLIM \(description truncated to 240 chars\); pass include='full' for the verbose narrative. Use this after atlas
- `atlas\_case\_study\_search`: Search ATLAS case studies \(real-world AI/ML attack incidents\) by keyword or referenced technique. Default response is SLIM \(description truncated to 240 chars per row\); pass include='full' for the verbose summary. Useful when the user has a technique in hand and wants to see incidents that exercised
- `d3fend\_defense\_lookup`: Look up a MITRE D3FEND defense technique. D3FEND is the canonical defensive counterpart to ATT&CK — each defense is classified into one of 7 tactics \(Model/Harden/Detect/Isolate/Deceive/Evict/Restore\) and may target a specific digital artifact \(e.g. 'Access Token'\). Response includes attack\_techniqu
- `d3fend\_defense\_search`: Search the MITRE D3FEND catalog of defensive techniques by keyword, tactic, or targeted artifact. Default response is SLIM \(drops \`uri\` from each row — saves \~60 chars/row, \~30% on popular drills\); pass include='full' for the verbose record. Pass exclude\_id when chaining from d3fend\_defense\_lookup t
- `d3fend\_defense\_for\_attack`: Reverse lookup: given an ATT&CK T-code, return D3FEND defenses that mitigate it. This is the bridge from offensive intelligence \(ATT&CK / ATLAS / CVE\) to defensive playbook. Pair with cve\_lookup or atlas\_technique\_lookup output — when those carry an ATT&CK id, call this tool to surface the mitigatio
- `d3fend\_attack\_coverage`: Batch coverage breakdown: given a list of ATT&CK T-codes, return distinct defense counts per D3FEND tactic + identify which techniques have NO D3FEND mapping \(undefended\_techniques\). Use to assess the defensive posture of an entire attack campaign or threat model in one call. defended\_techniques is
- `sigma\_rule\_lookup`: Look up a single Sigma detection rule by UUID from the SigmaHQ corpus \(\~3,200 rules, refreshed daily at 02:00 UTC\). Returns the full rule with title, description, status \(stable/test/experimental/deprecated/unsupported\), level \(informational/low/medium/high/critical\), logsource \(product/category/ser
- `bulk\_sigma\_rule\_lookup`: Bulk Sigma rule lookup — retrieve full records for up to 50 rule UUIDs in a single request instead of N separate sigma\_rule\_lookup calls. Designed for triage workflows where multiple rule ids are known \(e.g., from a SIEM alert batch or a tagged detection bundle\). Each item is the same shape as sigma
- `ioc\_lookup`: Enrich Indicator of Compromise \(IP/domain/URL/hash\) by auto-detecting type and querying abuse.ch feeds. Per-type source coverage: hash → ThreatFox only \(Feodo and URLhaus do not index hashes\); IP → ThreatFox + Feodo Tracker + URLhaus; domain / URL → ThreatFox + URLhaus. verdict.sources\_queried lists
- `hash\_lookup`: Query MalwareBazaar for file hash \(MD5/SHA1/SHA256\): malware family, file type, size, tags, first/last seen, download count. Use to check if file hash is known malware; use ioc\_lookup for auto-detection of all IOC types. Companion malware-investigation tools: ioc\_lookup \(multi-source: ThreatFox + Fe
- `password\_check`: Check if SHA-1 hash appears in Have I Been Pwned \(HIBP\) breach dataset using k-anonymity \(5-char prefix only, full hash never leaves tool\). Use for password breach audits; read-only, no data stored. Companion OSINT investigation tools: hash\_lookup \(file-hash malware family lookup, different namespac
- `phishing\_check`: Query URLhaus for a specific URL and its host. is\_malicious is True only when there is ACTIVE evidence — exact URL match with url\_status='online' \(or unknown\) OR host has urls\_online \> 0. URLhaus retains historical records forever, so a host can have url\_count \> 0 with urls\_online == 0; in that case
- `bulk\_ioc\_lookup`: Batch query multiple IOCs \(IP/domain/URL/hash, up to 50 per call, same for Free and Pro\) in 1 request: auto-detects type + queries abuse.ch feeds per-indicator. Per-type source coverage matches ioc\_lookup: hash → ThreatFox only; IP → ThreatFox + Feodo + URLhaus; domain / URL → ThreatFox + URLhaus. E
- `check\_secrets`: Scan source code \(or snippet\) for hardcoded secrets — cloud provider keys, API tokens, connection strings, private keys, passwords. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect leaked credentials before commit; for injection detection use check\_injection. Free:
- `check\_injection`: Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check\_secrets. Companion code-s
- `check\_dependencies`: Audit project dependencies \(npm/PyPI/Maven/RubyGems/etc.\) against CVE database: find known vulnerabilities in your package list. Bulk query up to 50 packages per call \(same for Free and Pro\). Use for dependency security scanning; use cve\_lookup for single CVE. Free: 30/hr \(1 per package\), Pro: 500/h
- `username\_lookup`: Search for username across 15+ social/dev platforms \(GitHub, Reddit, X/Twitter, LinkedIn, Instagram, TikTok, Discord, YouTube, Keybase, HackerOne, etc.\). Use for OSINT investigations and identity verification. Free: 30/hr, Pro: 500/hr. Returns \{username, total\_found, platforms: \[\{name, exists, url,
- `check\_headers`: Validate HTTP security headers you provide \(JSON\): CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Permissions-Policy, Referrer-Policy against best practices. Use to test header config before deployment or validate non-public servers; use scan\_headers to fetch live. Free: 30/hr, Pro: 500/hr. By

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html