Quickstart

1. Register, verify, and create a key

Create an account at Sign up, verify your email, then sign in. Verification does not automatically sign you in. Create an API key in the portal and save it securely; its full value is shown once.

Registration grants 100 welcome credits once. Eligible existing Free accounts receive 1,000 additive monthly credits in later UTC months. See credits.

2. Enrich one IOC

curl https://threatmap.co/api/v1/ioc \
  -H "Authorization: Bearer $THREATMAP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"value":"8.8.8.8"}'

Send one IP, domain, HTTP(S) URL, supported hash, email, or CVE per request. Comma-separated lists and malformed IPs are invalid. Inspect the returned query, provider sources, enrichment, and metadata for status and credits.

3. Connect MCP over stdio

Use Node.js 22+ and install npm install -g @threatmap_zysec/mcp. Add this configuration to a stdio-capable client and restart it:

{
  "mcpServers": {
    "threatmap": {
      "command": "threatmap-mcp",
      "env": {
        "THREATMAP_API_URL": "https://threatmap.co",
        "THREATMAP_API_KEY": "<your-api-key>"
      }
    }
  }
}

Set the API URL explicitly; the executable defaults to localhost:3000. If the client cannot find the command, use its absolute executable path.

4. Or use Streamable HTTP

{
  "mcpServers": {
    "threatmap": {
      "url": "https://threatmap.co/api/mcp",
      "headers": { "Authorization": "Bearer <your-api-key>" }
    }
  }
}

Choose one transport per server configuration. Remote clients must support Streamable HTTP and Bearer headers; syntax varies by client. Claude Desktop compatibility depends on its connector configuration. Stdio is available when a remote connector requires an unsupported OAuth flow.

Initialize, list tools, then call get_ip_report with an IP. Listing tools alone does not verify provider execution. Calls retain plan, email-verification, source configuration, rate-limit, and credit requirements.

BYOK and application integration

Configure licensed provider keys through BYOK and source preferences through Sources. BYOK removes source surcharges; successful IOC/CVE searches still cost one base credit.

Use ordinary HTTPS clients for REST. This repository does not maintain official Python, Go, or Rust SDKs or a batch IOC API. See API inputs.