Quickstart

Get from zero to first API call in under 60 seconds.

1. Get an API key

Sign up at app.threatmap.io — you get 5,000 free credits at sign-up plus 1,000 free credits every month after. No credit card required.

2. Make your first call

Enrich an IP address across every source ThreatMap aggregates:

$ curl https://api.threatmap.io/v1/ioc \
    -H "Authorization: Bearer tm_live_..." \
    -d value="8.8.8.8"

You'll get back one normalised JSON with a unified score:

{
  "value": "8.8.8.8",
  "threatmap_score": 12,
  "sources": {
    "abuseipdb": { "score": 0, "reports": 0 },
    "greynoise": { "classification": "benign", "label": "Google" }
  },
  "asn": { "number": 15169, "owner": "Google LLC" },
  "first_seen": "2014-03-12",
  "sightings": 1284
}

3. Connect Claude (or Cursor, or Copilot)

ThreatMap ships a native MCP server. Point any MCP-compatible AI agent at ThreatMap and it can enrich IOCs, look up CVEs, scan assets, and run pivots autonomously.

Add this to your Claude Desktop config:

{
  "mcpServers": {
    "threatmap": {
      "command": "npx",
      "args": ["-y", "@threatmap/mcp"],
      "env": {
        "THREATMAP_API_KEY": "tm_live_..."
      }
    }
  }
}

Restart Claude Desktop, then ask:

Is 203.0.113.50 suspicious? What about CVE-2024-3094?

Claude calls ThreatMap automatically and gives you the answer.

4. Install an SDK (optional)

The API is plain JSON over HTTPS — any HTTP client works. Or use an official SDK:

# Python
pip install threatmap

# TypeScript / Node
npm install @threatmap/sdk

# Go
go get github.com/threatmap/go-sdk

# Rust
cargo add threatmap

Python example

import threatmap

tm = threatmap.Client(api_key="tm_live_...")

# Enrich an IOC
result = tm.ioc(value="8.8.8.8")
print("Score:", result["threatmap_score"])

# Prioritise a CVE
cve = tm.cve(id="CVE-2024-3094")
print("EPSS:", cve["epss"], "KEV:", cve["kev"])

# Pivot: find all domains sharing a certificate
sibling = tm.certificates(fingerprint="ab:cd:ef:...")
for domain in sibling["domains"]:
    print(domain)

TypeScript example

import { ThreatMap } from "@threatmap/sdk";

const tm = new ThreatMap({ apiKey: process.env.THREATMAP_API_KEY });

// Enrich in batch (up to 100 per call)
const enriched = await tm.ioc.batch([
  "8.8.8.8",
  "malicious.example.com",
  "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf653fd5f",
]);

enriched.forEach(r => console.log(r.value, "score:", r.threatmap_score));

5. BYOK (Bring Your Own Key)

If you already have a Shodan, VirusTotal, Censys, or GreyNoise license, plug your key into ThreatMap. Calls routed through your key cost 0 credits.

# Register your Shodan key
$ curl https://api.threatmap.io/v1/account/byok \
    -H "Authorization: Bearer tm_live_..." \
    -d provider="shodan" \
    -d api_key="SHODAN-KEY-..."

# Now /v1/scan and /v1/ioc calls that hit Shodan
# route through YOUR key at 0 credits

That's it. You now have unified access to 20+ threat intel sources through one API with one bill and one MCP endpoint.

Next steps