English Français العربية

ContrastAPI

Official registry Productivity

55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http contrastapi 'https://api.contrastcyber.com/mcp/'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "contrastapi": {
            "type": "http",
            "url": "https://api.contrastcyber.com/mcp/"
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. ContrastAPI — 55 Security Tools + 7 MCP Resources for AI Agents
  2. Documentation
  3. Setup (MCP)
  4. SDKs
  5. Links

ContrastAPI — 55 Security Tools + 7 MCP Resources for AI Agents

Security intelligence, built for AI agents. Give your agent grounded answers about vulnerabilities, threats, and attack surface — backed by authoritative sources (NVD, CISA KEV, FIRST EPSS, MITRE ATLAS & D3FEND), never guesswork. CVE/KEV/CWE lookup with EPSS exploit-probability and composite risk scoring, domain & IP investigation, IOC enrichment, code-security checks, and live web intelligence. 55 tools, 7 Resources, and 3 Prompts — free, no API key, no signup.

中文 · Live: api.contrastcyber.com

Documentation

  • API Documentation — REST reference: 60+ endpoints, authentication, rate limits, token costs, and response envelope.
  • MCP Documentation — MCP tool-selection guide, 7 Resources, 3 Prompts, and copy-paste agent prompts.

Setup (MCP)

Any MCP client
{
  "mcpServers": {
    "contrastapi": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://api.contrastcyber.com/mcp/"]
    }
  }
}

Restart your agent. Other clients (Python SDK, Node SDK, cURL, VS Code): mcp-setup · quickstart

Claude Desktop — one-click extension

Grab the .mcpb file from the latest release and double-click it (or Claude Desktop → Settings → Extensions → Install Extension…). No signup, no API key — all 55 tools ready immediately.

SDKs

pip install contrastapi      # Python 3.10+ — sync + async, typed responses, shortcut helpers
npm install contrastapi      # Node 14+ — concrete TypeScript types, 14 namespaces

Both SDKs cover every HTTP endpoint and MCP tool — CVE/KEV/CWE, ATLAS, D3FEND, Sigma rules, email security posture, domain, IP, IOC, code security, and web intelligence — with wire-exact response shapes and a typed exception hierarchy that mirrors the API error envelope. They also expose MCP Resources for browsing the ATLAS, D3FEND, and CWE catalogs (see docs/MCP_Documentation.md) and a conditional triage Prompt (see docs/MCP_Documentation.md#contrast-triage). Web-intelligence tools — robots_txt, redirect_chain, email_verify, brand_assets, seo_audit, geo_audit — ship with an explicit ethical floor: per-target throttling, robots.txt respected, no SMTP probing.

OpenAPI: openapi.json

Also available on

Smithery · npm · VS Code Marketplace · Awesome OSINT MCP · RapidAPI

Multi-agent verdict metadata

Responses include a verdict block — deterministic, falsifiable_fields, data_age_seconds, sources_queried / sources_unavailable, completeness — so a verifier agent can independently re-derive specific fields from the upstream authority (NVD, RDAP, CT logs, URLhaus). Probe GET /v1/capabilities for "verdict_metadata": true.

CVE responses also embed next_calls: list[PivotHint] — {tool, input, reason} triples that suggest the next MCP tool to call (e.g. kev_detail when kev.in_kev=true, cwe_lookup when cwe_id is set). Agents chain workflows without manual prompting.

MIT

Frequently asked questions

What is ContrastAPI?

55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.

How do I install ContrastAPI?

It runs as a remote server. In Claude Code: claude mcp add --transport http contrastapi 'https://api.contrastcyber.com/mcp/'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does ContrastAPI need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is ContrastAPI open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains ContrastAPI?

It is published by UPinar. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.