Integration

Recorded Future integration

Recorded Future Connect API for threat intelligence enrichment: look up the risk score, triggered risk rules and supporting evidence of an IP address, domain, file hash, URL or vulnerability, search each of those entity types by risk score, risk rule or observation window, resolve a free text name into a Recorded Future entity identifier, and read, triage and update the alerts raised by the alerting rules of the account.

Connect Recorded Future How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Recorded Future.Built from the 13 Recorded Future tools below, on the connection you add once.

Common Recorded Future use cases

scoring a domain extracted from a phishing email
scoring a link extracted from a suspicious email
collecting newly risky domains for a DNS blocklist
scoring the hash of an attachment before detonating it
pulling recently flagged hashes into an endpoint blocklist
scoring the source address of an alert before escalating it
collecting newly flagged phishing URLs for a proxy blocklist
pulling every address above a risk threshold into a blocklist
polling for new alerts since the last run to open cases from them
listing the vulnerabilities that became actively exploited in the last week

What you can do with Recorded Future

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Alert, 2 operations

search_alertsSearch alertsGETSearches Recorded Future alerts by trigger time, review status, rule or free text.
update_alertsUpdate alertsPOSTSets the review status, assignee or note on Recorded Future alerts in one call.

Domain, 2 operations

lookup_domainLookup domainGETReturns the Recorded Future risk assessment of one domain or hostname.
search_domainsSearch domainsGETSearches Recorded Future domains by risk score, risk rule or time window.

Hash, 2 operations

lookup_hashLookup hashGETReturns the Recorded Future risk assessment of one file hash.
search_hashesSearch hashesGETSearches Recorded Future file hashes by risk score, risk rule or time window.

Ip, 2 operations

lookup_ipLookup ipGETReturns the Recorded Future risk assessment of one IP address.
search_ipsSearch ipsGETSearches Recorded Future IP addresses by risk score, risk rule or time window.

Url, 2 operations

lookup_urlLookup urlGETReturns the Recorded Future risk assessment of one URL.
search_urlsSearch urlsGETSearches Recorded Future URLs by risk score, risk rule or time window.

Vulnerability, 2 operations

lookup_vulnerabilityLookup vulnerabilityGETReturns the Recorded Future risk assessment of one vulnerability.
search_vulnerabilitiesSearch vulnerabilitiesGETSearches Recorded Future vulnerabilities by risk score, risk rule or time window.

Entity, 1 operation

match_entityMatch entityPOSTTurns a name such as a malware family or actor into Recorded Future entity identifiers.

Use Recorded Future from Claude Code, Cursor or Codex

Connect Recorded Future in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Recorded Future operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Recorded Future

Create your workspace
Sign up free. Nothing to install.
Connect Recorded Future once
Add your Recorded Future connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Recorded Future integration FAQ

What can you do with the Recorded Future integration?

LiveContext exposes 13 operations on Recorded Future, covering alert, domain, hash and ip. Common uses include scoring a domain extracted from a phishing email, scoring a link extracted from a suspicious email and collecting newly risky domains for a DNS blocklist.