C
ContrastAPI
20 endpointslive29 security tools for AI agents — CVE, OSINT, threat intel, code security. No API key needed. (MCP server com.contrastcyber/api, aggregated from the official registry)
$Set up https://cracked-ai-pearl.vercel.app/SKILL.md, and then use Cracked to show me what I can do for ContrastAPI.
| Endpoint | What it does | Price | Health |
|---|---|---|---|
| Domain Report /domain_report | Query DNS, WHOIS, SSL, subdomains, and threat intel for a domain in one call. By default dns.txt is filtered to security-relevant entries (SPF, DMARC, DKIM, MTA | $0.0020 per call | unknown |
| Audit Domain /audit_domain | Perform comprehensive domain audit: combines domain_report + live HTTP security headers + technology fingerprinting. By default report.dns.txt is filtered to se | $0.0020 per call | unknown |
| Contrast Scan /contrast_scan | Active website security scan: runs the ContrastScan C engine (11 modules — HTTP security headers, SSL/TLS, DNS, redirect chain, information disclosure, cookie f | $0.0020 per call | unknown |
| Tech Stack CVE Audit /tech_stack_cve_audit | Composite tech-stack + CVE audit (MCP-only, no REST endpoint). Detects technologies on the target domain, queries CVE database for known vulnerabilities per pro | $0.0020 per call | unknown |
| Threat Report /threat_report | Query comprehensive threat profile for an IP: Shodan host data, AbuseIPDB reputation, ASN/geolocation, and open ports. Use for IP investigation and SOC alert tr | $0.0020 per call | unknown |
| DNS Lookup /dns_lookup | Query all DNS record types (A, AAAA, MX, NS, TXT, CNAME, SOA) for a domain. Use for mail routing inspection, nameserver verification, or SPF/DMARC checks; for f | $0.0020 per call | unknown |
| WHOIS Lookup /whois_lookup | Retrieve WHOIS registration data: registrar, creation/expiry dates, nameservers, status. Use to verify domain ownership, age, expiration; for full audit use dom | $0.0020 per call | unknown |
| SSL Check /ssl_check | Analyze SSL/TLS certificate: grade (A/B/C/D/F), protocol version, cipher suite, chain, expiry, Subject Alternative Names, and structured validation findings. In | $0.0020 per call | unknown |
| Subdomain Enum /subdomain_enum | Discover subdomains using passive methods: Certificate Transparency logs + DNS brute-force (no active probing). Use to map organization's attack surface; non-in | $0.0020 per call | unknown |
| Tech Fingerprint /tech_fingerprint | Detect website technology stack: CMS, frameworks, CDN, analytics tools, web servers, languages (via HTTP headers + HTML analysis). Use for passive reconnaissanc | $0.0020 per call | unknown |
| Threat Intel /threat_intel | Check domain against abuse.ch URLhaus for known malware-distribution URLs (single source — for multi-feed correlation use ioc_lookup which adds ThreatFox and, f | $0.0020 per call | unknown |
| Wayback Lookup /wayback_lookup | Retrieve Wayback Machine snapshots for a domain: first capture, latest, total count, snapshot list. Use to investigate domain history and age; for full audit us | $0.0020 per call | unknown |
| Scan Headers /scan_headers | Perform live HTTP GET and analyze security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Permissions-Policy, Referrer-Policy. Use to audit live w | $0.0020 per call | unknown |
| Email MX /email_mx | Analyze email security: MX records, SPF policy, DMARC policy, DKIM probe across common+date-based selectors, mail provider, grade. Use to verify email-auth setu | $0.0020 per call | unknown |
| Email Security Posture /email_security_posture | Analyze domain email authentication posture: SPF, DMARC, DKIM with numeric score and findings. Dual-use: red-team (spoofing feasibility) + blue-team (posture au | $0.0020 per call | unknown |
| Email Disposable /email_disposable | Check if email address uses a known disposable/temporary provider (Guerrilla Mail, Temp Mail, Mailinator, etc.). Use for input validation to detect throwaway si | $0.0020 per call | unknown |
| Email Verify /email_verify | One-call email validation combining syntax + MX records + disposable check + role-address detection (admin@/info@/...) + free-provider classification (gmail/out | $0.0020 per call | unknown |
| Robots.txt /robots_txt | Fetch + parse the target domain's robots.txt — sitemaps, per-User-agent allow/disallow rules, crawl-delay, Host directive. Use BEFORE crawling/scraping a target | $0.0020 per call | unknown |
| Redirect Chain /redirect_chain | Walk an HTTP redirect chain hop-by-hop, returning per-hop {url, status_code, location, latency_ms}. Use to deobfuscate URL shorteners (bit.ly / t.co / lnkd.in), | $0.0020 per call | unknown |
| Brand Assets /brand_assets | Scrape a domain's homepage `<head>` for public brand assets — favicon, og:image, theme-color, og:site_name, JSON-LD `Organization.logo`. Use to enrich CRM recor | $0.0020 per call | unknown |