Integration

SecurityTrails integration

SecurityTrails (a Recorded Future company) is a DNS, domain and IP intelligence API. An agent can read a domain's current DNS records, subdomains, tags, WHOIS and SSL certificates, its DNS and WHOIS history and associated domains, search domains and IPs by attributes or the SecurityTrails query language, explore neighbouring IPs, IP WHOIS and user agents, list a company's IP ranges, and check its monthly quota. With an Attack Surface Intelligence (ASI) subscription it can also list projects, assets, exposures and signatures, tag assets and start report downloads. Not exposed: the zone-file feed downloads and gzip report files (binary archives), the scroll cursor route, and the ASI JSON-filter search, filter aggregation, bulk tag-by-filter and static-asset rule routes. Authentication is an API key sent in the APIKEY header; every call counts against the plan's monthly quota.

Connect SecurityTrails How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in SecurityTrails.Built from the 38 SecurityTrails tools below, on the connection you add once.

What you can do with SecurityTrails

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Asset tag, 4 operations

apply_asset_tagApply asset tagPUTApplies one user-defined tag to an asset, creating the tag if it does not exist. Tagging is asynchronous: if complete is false, check task_ids with get_tag_task_status.
bulk_update_asset_tagsBulk update asset tagsPOSTAdds and removes tags on several assets at once, keyed by asset. Tagging is asynchronous: if complete is false, check task_ids with get_tag_task_status.
remove_asset_tagRemove asset tagDELETERemoves one user-defined tag from an asset; succeeds even if the tag was not on it. Tagging is asynchronous: if complete is false, check task_ids with get_tag_task_status.
update_asset_tagsUpdate asset tagsPOSTAdds and removes user-defined tags on one asset in a single call. Tagging is asynchronous: if complete is false, check task_ids with get_tag_task_status.

Asset, 2 operations

find_assetsFind assetsGETLists the assets (domains, hosts, IPs) of an ASI project, filtered by query parameters (type, tags, DNS, ports, technologies, certificates, exposures). Pass meta.pagination.next_cursor as cursor for more.
get_assetGet assetGETReturns one asset of an ASI project. Only custom_tags is included by default; list other details (dns_records, whois, open ports, certificates, exposures...) in additional_fields.

Domain, 2 operations

get_domainGet domainGETReturns a domain's current DNS records (A, AAAA, MX, NS, SOA, TXT) with first-seen dates and, per value, how many other domains share it, plus its Alexa rank.
search_domainsSearch domainsPOSTSearches domains by attributes (IP or CIDR, apex domain, keyword, MX, NS, CNAME, TLD, WHOIS email or organization and more) sent in filter. Returns matching domains one page at a time.

Project tag, 2 operations

create_project_tagCreate project tagPOSTCreates a user-defined tag in an ASI project, to apply to assets later; returns the existing tag if it already exists.
list_project_tagsList project tagsGETLists the user-defined tags of an ASI project.

Report download, 2 operations

get_download_statusGet download statusGETReturns the state of a report download started by start_report_download: downloading (call again), completed (csv_file.link and json_file.link hold temporary signed URLs) or error.
start_report_downloadStart report downloadGETStarts generating an ASI project report (exposures-issue, exposures-host or vulnerable-products) and returns its uuid. Call get_download_status with that uuid until status is completed.

Signature, 2 operations

get_signatureGet signatureGETReturns one exposure signature (name, severity, vulnerabilities and more), whether or not it affects the project. Extra enrichments go in additional_fields.
list_signaturesList signaturesGETLists exposure signatures by CVE, severity or free text, whether or not they affect an asset in the project, without affected-asset details. Pass next_cursor as cursor for more.

Account usage, 1 operation

get_account_usageGet account usageGETReturns the account's API usage for the current month (current_monthly_usage) and the monthly quota of its plan (allowed_monthly_usage).

Api key, 1 operation

pingPingGETTests the API key: answers success true when the key is valid and the account can reach the SecurityTrails API.

Asset exposure, 1 operation

list_asset_exposuresList asset exposuresGETLists the exposures found on one asset of an ASI project: signature, vulnerabilities, severity and the ports each one was seen on.

Asset filter, 1 operation

get_asset_filtersGet asset filtersGETReturns the values an ASI project's assets take for filterable fields, with asset counts per value, to build find_assets filters. Pick fields with filter_fields.

Associated domain, 1 operation

list_associated_domainsList associated domainsGETLists domains related to the given domain (for example sharing its owner), with registrar, mail and host providers and company name, one page at a time.

Company ip range, 1 operation

list_company_associated_ipsList company associated ipsGETLists the IP ranges (CIDR blocks) associated with the company that owns a domain, one page at a time.

Dns history, 1 operation

list_dns_historyList dns historyGETLists a domain's historical DNS records of one type (a, aaaa, mx, ns, soa or txt): each value with the dates it was first and last seen and the organizations behind it.

Domain search stats, 1 operation

get_domain_search_statsGet domain search statsPOSTReturns counts for a domain search (domain_count, hostname_count, tld_count) without listing the domains. Takes the same filter object as search_domains.

Domain tag, 1 operation

list_domain_tagsList domain tagsGETLists the tags SecurityTrails has assigned to a domain (categories describing the site).

Domain whois, 1 operation

get_domain_whoisGet domain whoisGETReturns a domain's current WHOIS record: registrar, creation, update and expiry dates, status, name servers and contacts, each value with how many other domains share it.

Exposure, 1 operation

list_exposuresList exposuresGETLists the exposure signatures found in an ASI project with the number of affected assets each, filterable by CVE, CWE, CVSS score or severity. Pass next_cursor as cursor for more.

Exposure asset, 1 operation

list_exposure_assetsList exposure assetsGETLists the assets of an ASI project affected by one exposure signature. Pass meta.pagination.next_cursor as cursor for the next page.

Exposure evidence, 1 operation

get_exposure_evidenceGet exposure evidencePOSTReturns the scan evidence for up to 30 evidence identifiers of an ASI project.

Ip, 1 operation

search_ipsSearch ipsPOSTSearches IP addresses with a SecurityTrails query language (DSL) query (for example ptr_part = 'ns1'). Returns matching IPs with PTR and open ports, one page at a time.

Ip search stats, 1 operation

get_ip_search_statsGet ip search statsPOSTReturns statistics for an IP search query: total matching IPs, the most common PTR patterns and the most common open ports. Takes the same DSL query as search_ips.

Ip useragent, 1 operation

list_ip_useragentsList ip useragentsGETLists the user agents seen from an IPv4 address: client, device, operating system, the raw user agent string and when it was last seen.

Ip whois, 1 operation

get_ip_whoisGet ip whoisGETReturns the current WHOIS record of an IPv4 address: the registry source, abuse contact email and the contacts of the block owner.

Nearby ip, 1 operation

list_nearby_ipsList nearby ipsGETLists the IP blocks around an IP address, with how many hostnames point to each; the block containing the given IP is marked current.

Project, 1 operation

list_projectsList projectsGETLists the Attack Surface Intelligence projects the key's user can access; each project's id is the project_id of the other ASI tools.

Ssl certificate, 1 operation

list_domain_ssl_certificatesList domain ssl certificatesGETLists TLS certificates seen for a domain or subdomain: names covered, fingerprints, issuer, validity dates. Filter with status (valid by default) and include_subdomains.

Static asset rule, 1 operation

list_static_asset_rulesList static asset rulesGETLists the static asset rules of an ASI project (assets added to or excluded from it by hand), filterable by type, membership, asset and date. Pass next_cursor as cursor for more.

Subdomain, 1 operation

list_subdomainsList subdomainsGETLists the known subdomains of a domain, as labels without the parent domain (api, mail, www).

Tag task, 1 operation

get_tag_task_statusGet tag task statusGETReturns the status of an asynchronous tagging task, using a task id returned by a tagging tool whose answer had complete false.

Whois history, 1 operation

list_whois_historyList whois historyGETLists a domain's historical WHOIS records: registrar, dates, status, name servers and contacts for each period the record was seen, one page at a time.

Use SecurityTrails from Claude Code, Cursor or Codex

Connect SecurityTrails in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its SecurityTrails operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect SecurityTrails

Create your workspace
Sign up free. Nothing to install.
Connect SecurityTrails once
Add your SecurityTrails connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.