ContrastAPI is a security intelligence MCP server for AI agents, designed to provide agents with well-sourced answers about vulnerabilities, threats, and attack surface, drawing on authoritative sources such as NVD, CISA KEV, FIRST EPSS, MITRE ATLAS, and D3FEND, rather than guesswork.
Main capabilities
- Vulnerability intelligence: CVE/KEV/CWE lookups, combined with EPSS exploit probability and composite risk scoring.
- Threat intelligence: IOC enrichment, MITRE ATLAS and D3FEND frameworks, Sigma detection rules.
- Attack surface investigation: domain and IP investigation, DNS, WHOIS, SSL, subdomains, email security posture (SPF/DMARC).
- Code security: code scanning to detect secret leaks and injection issues.
- Real-time network intelligence: tools such as robots_txt, redirect_chain, email_verify, brand_assets, seo_audit, geo_audit, with clear ethical boundaries: rate limiting per target, respecting robots.txt, no SMTP probing.
How to use
- Connect to AI agents as an MCP server, providing 55 tools, 7 resources, and 3 prompts.
- Claude Desktop: download the .mcpb file from the latest release and double-click to install (or via Claude Desktop → Settings → Extensions → Install Extension…), no registration or API key required, 55 tools available immediately.
- Other clients: Python SDK, Node SDK, cURL, and VS Code support are provided; see the mcp-setup and quickstart documentation.
- Online API: api.contrastcyber.com, providing REST reference documentation, including 60+ endpoints, authentication, rate limits, token costs, and response envelope descriptions.
- OpenAPI specification: openapi.json.
- Also available via Smithery, npm, VS Code Marketplace, Awesome OSINT MCP, RapidAPI.
Response features
- Responses include verdict block: deterministic, falsifiable_fields, data_age_seconds, sources_queried/sources_unavailable, completeness, making it easy to verify that the agent independently re-derives specific fields from upstream authorities (NVD, RDAP, CT logs, URLhaus). You can probe "verdict_metadata": true via GET /v1/capabilities.
- CVE responses embed next_calls: list[PivotHint], i.e. {tool, input, reason} triples, suggesting the next MCP tool that should be called (for example, suggesting kev_detail when kev.in_kev=true, and suggesting cwe_lookup when cwe_id is set), enabling the agent to chain workflows without manual prompting.
Use cases
- AI agents need to answer questions about vulnerabilities, threats, and attack surface based on authoritative sources.
- Security analysts performing CVE/KEV lookups, IOC enrichment, domain/IP investigation, and email security posture assessment.
- Developers scanning code for secret leaks and injection issues.
- Need to integrate security intelligence tools into MCP-compatible AI workflows.
Limitations
- Free, no API key required, no registration required.
- Network intelligence tools respect robots.txt, rate limit per target, and do not perform SMTP probing.
- Other specific limitations (such as rate limit details and token costs) require reference to the official API documentation.
