Integration

CIRCL hashlookup integration

CIRCL hashlookup, run by the Luxembourg CERT, is a free public database of known-file hashes (NIST NSRL RDS sets, Windows builds, Ubuntu, Kali, Fedora EPEL, openSUSE and other distribution packages, CDNJS, Snap). Look up an MD5, SHA-1 or SHA-256 to learn which file and product it belongs to, its source and a trust score from 0 to 100 (50 means no opinion), check lists of MD5 or SHA-1 hashes at once, walk the parent packages and child files of a SHA-1, and read database statistics and the most queried hashes. A match only gives context for forensics: on its own it does not say whether a file is malicious. Records are passed through as the vendor publishes them, including package metadata such as the distribution's maintainer contact string or the Snap publisher id. CIRCL counts every lookup, and the most queried SHA-1 values, found or not, are published by get_top_queried_hashes: do not look up hashes of files that must stay confidential. No credential is needed; the service is free and best-effort, with no published rate limit, and its data is licensed CC-BY (credit CIRCL hashlookup when you reuse it). The search session routes are not exposed: the feature is disabled on the public service.

Connect CIRCL hashlookup How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in CIRCL hashlookup.Built from the 9 CIRCL hashlookup tools below, on the connection you add once.

What you can do with CIRCL hashlookup

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Hash, 6 operations

bulk_lookup_md5Bulk lookup md5POSTLooks up several MD5 hashes in one call and returns the record of each hash found in the database; read only, nothing is stored. Pass the hashes as a list.
bulk_lookup_sha1Bulk lookup sha1POSTLooks up several SHA-1 hashes in one call and returns the record of each hash found in the database; read only, nothing is stored. Pass the hashes as a list.
get_top_queried_hashesGet top queried hashesGETReturns the most queried SHA-1 hashes on the service (about 100 of each kind) with their query counts: nx lists those not in the database, exist those found.
lookup_md5Lookup md5GETLooks up one MD5 hash and returns the known file record: file name, size, other hashes, product, source and hashlookup:trust (0 to 100, 50 is no opinion). HTTP 404 means the hash is unknown.
lookup_sha1Lookup sha1GETLooks up one SHA-1 hash and returns the known file record: file name, size, other hashes, product, source and hashlookup:trust (0 to 100, 50 is no opinion). HTTP 404 means the hash is unknown.
lookup_sha256Lookup sha256GETLooks up one SHA-256 hash and returns the known file record: file name, size, other hashes, product, source and hashlookup:trust (0 to 100, 50 is no opinion). HTTP 404 means the hash is unknown.

Child, 1 operation

list_childrenList childrenGETLists the SHA-1 of the children (files contained in a package or archive) of a SHA-1, one page at a time: pass cursor 0 first, then the returned cursor. Fails with HTTP 404 when the hash has no known child.

Database, 1 operation

get_database_infoGet database infoGETReturns statistics about the hashlookup database: the NSRL version loaded and the total number of hashes stored.

Parent, 1 operation

list_parentsList parentsGETLists the SHA-1 of the parents (packages or archives that contain the file) of a SHA-1, one page at a time: pass cursor 0 first, then the returned cursor. Fails with HTTP 404 when the hash has no known parent.

Use CIRCL hashlookup from Claude Code, Cursor or Codex

Connect CIRCL hashlookup in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its CIRCL hashlookup operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect CIRCL hashlookup

Create your workspace
Sign up free. Nothing to install.
Connect CIRCL hashlookup once
CIRCL hashlookup needs no credential, so its tools work immediately.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.