Quickstart

1. Register, verify, and create a key

Create an account at Sign up, verify your email, then sign in. Verification does not automatically sign you in. Create an API key in the portal and save it securely; its full value is shown once.

Each new key belongs to one project. Choose a project when creating it; select Default explicitly if that is where you want the key to work. The same key selects that project for REST and MCP requests, so no project header is needed. You may set an optional monthly credit cap for the key. The project's API keys tab shows the masked key and this month's credits used against that cap.

Registration grants 100 welcome credits once. Eligible existing Free accounts receive 1,000 additive monthly credits in later UTC months. See credits.

2. Enrich one IOC

curl https://threatmap.co/api/v1/ioc \
  -H "Authorization: Bearer $THREATMAP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"value":"8.8.8.8"}'

Send one IP, domain, HTTP(S) URL, supported hash, email, or CVE per request. Comma-separated lists and malformed IPs are invalid. Inspect the returned query, provider sources, enrichment, and metadata for status and credits.

3. Connect MCP over stdio

Use Node.js 22+ and install npm install -g @threatmap_zysec/mcp. Add this configuration to a stdio-capable client and restart it:

{
  "mcpServers": {
    "threatmap": {
      "command": "threatmap-mcp",
      "env": {
        "THREATMAP_API_URL": "https://threatmap.co",
        "THREATMAP_API_KEY": "<your-api-key>"
      }
    }
  }
}

Set the API URL explicitly; the executable defaults to localhost:3000. If the client cannot find the command, use its absolute executable path.

4. Or use Streamable HTTP

{
  "mcpServers": {
    "threatmap": {
      "url": "https://threatmap.co/api/mcp",
      "headers": { "Authorization": "Bearer <your-api-key>" }
    }
  }
}

Choose one transport per server configuration. Remote clients must support Streamable HTTP and Bearer headers; syntax varies by client. Claude Desktop compatibility depends on its connector configuration. Stdio is available when a remote connector requires an unsupported OAuth flow.

Initialize, list tools, then call get_ip_report with an IP. Listing tools alone does not verify provider execution. Calls retain plan, email-verification, source configuration, rate-limit, and credit requirements.

BYOK and application integration

Configure licensed provider keys through BYOK and source preferences through Sources. BYOK removes source surcharges; successful IOC/CVE searches still cost one base credit.

Use ordinary HTTPS clients for REST. This repository does not maintain official Python, Go, or Rust SDKs or a batch IOC API. See API inputs.