Integrations · MCP

An MCP server your agents can trust.

SecurityAlert.ai speaks the Model Context Protocol at https://securityalert.ai/mcp (revision 2026-07-28, streamable HTTP). Claude, Torq HyperSOC, Tines agents and in-house assistants can query lookalike-domain verdicts, newly observed domains, asset exposure and actor pivots directly, grounded in data we collect ourselves.

Read-only by design

Every tool is read only, annotated readOnlyHint: true, and that is the product position rather than a limitation: a person approves anything that acts on the outside world. Agents see drafted actions and route the approval link to a human; there is no tool that files anything.

Tenant scoping is identical to the dashboard and REST API. A credential sees exactly the brands its owner can see.
Tools the caller lacks permission for are omitted from tools/list, not advertised and refused.
Every tool call is recorded in the account audit log (mcp.tool_call).
Per-credential rate limit: 120 requests per minute, reported in X-RateLimit headers.

Authentication

API-key authentication is available today on Business plans and above:

API key (server-to-server): mint one at Settings → API keys with the MCP scope, then send Authorization: Bearer sa_live_...

OAuth discovery metadata is published at /.well-known/oauth-protected-resource, but the hosted OAuth connection is still in final end-to-end verification. Use an API key until that verification is complete.

Tools

domain_verdictOne compact, citation-backed answer to "is this domain impersonating us?": monitoring signals, registry first-seen from our own zone-file diffs, the human verdict if one was recorded, the automatic-triage assessment, and any cached AI investigation.

nod_lookupWhen a domain first appeared in the gTLD zone files, from daily ICANN CZDS diffs across 15 TLDs plus a Certificate Transparency fast path, with an explicit coverage statement.

list_brand_findingsActive impersonation findings for your brands, matching the dashboard exactly.

asset_exposurePorts, CVEs (with KEV flag), takeover findings and registration facts for a host or IP in your monitored estate.

registrant_pivotOther domains our self-collected WHOIS index attributes to the operator of a lookalike already flagged in your estate. Identity signals outrank infrastructure signals; never a general people search.

nameserver_pivotDomains sharing distinctive nameservers, from our weekly build over the gTLD zones.

search_threat_actorsThe tracked actor catalog: MITRE ATT&CK groups plus ransomware leak-site operators.

list_action_proposalsDrafted takedowns awaiting human approval, with the approval link. Read only, on purpose.

Try it

curl -s https://securityalert.ai/mcp \
  -H "Authorization: Bearer sa_live_..." \
  -H "Content-Type: application/json" \
  -H "MCP-Protocol-Version: 2026-07-28" \
  -H "Mcp-Method: tools/list" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{"_meta":{
    "io.modelcontextprotocol/protocolVersion":"2026-07-28",
    "io.modelcontextprotocol/clientCapabilities":{}}}}'

Example prompts once connected: "Is examp1e-mybrand.com impersonating us?", "Which of my findings registered in the last 48 hours look staged for phishing?", "What else does the operator of this lookalike run?"

Data handling

Tool results contain findings and asset data from your own tenancy, which the connected AI client will process like any other conversation content. Connect the server only to AI tooling your organisation has approved. Calls are logged to your audit trail with the credential used; revoking the key or the OAuth grant severs access immediately. Details in the privacy policy and trust center.