Security

Data source: NIST NVD, RDAP, Cloudflare DoH, IODA (Georgia Tech)

MCP MCP Protocol

Endpoint https://context.gnist.ai/mcp/cyber-intelligence/

nobloat — strip report_feedback tool URL-based auth (for clients without header support)

claude_desktop_config.json

{
  "mcpServers": {
    "gnist-cyber-intelligence": {
      "url": "https://context.gnist.ai/mcp/cyber-intelligence/",
      "headers": {
        "Gnist-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Shell

curl -X POST "https://context.gnist.ai/mcp/cyber-intelligence/" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Gnist-API-Key: YOUR_API_KEY" \
  -d '{"jsonrpc": "2.0", "method": "tools/call", "id": 1, "params": {"name": "investigate_domain", "arguments": {"domain": "example"}}}'

API REST API

API Root https://context.gnist.ai/rest/cyber-intelligence/

6 endpoints available:

GET /rest/cyber-intelligence/investigate_domain
GET /rest/cyber-intelligence/search_vulnerabilities
GET /rest/cyber-intelligence/get_outage_overview
GET /rest/cyber-intelligence/full_cyber_investigation
GET /rest/cyber-intelligence/list_cyber_intelligence_sources
GET /rest/cyber-intelligence/report_feedback

Shell

curl "https://context.gnist.ai/rest/cyber-intelligence/investigate_domain?domain=example" \
  -H "Gnist-API-Key: YOUR_API_KEY"

Python

import httpx

resp = httpx.get(
    "https://context.gnist.ai/rest/cyber-intelligence/investigate_domain",
    headers={"Gnist-API-Key": "YOUR_API_KEY"},
    params={
        "domain": "example"
},
)
print(resp.json())

OpenAPI Spec · Full API Docs

CLI Command Line

Command gc cyber-intelligence

CLI documentation will be available when the GnistAI SDK is published.

Install

pip install gnistai

Available Tools (6)

investigate_domain

Investigate a domain by querying WHOIS and DNS records in parallel.

Parameter	Type	Required	Description
`domain`	`string`	required	Domain name to investigate (e.g. example.com).

search_vulnerabilities

Search the NVD for CVE vulnerabilities matching a keyword.

Parameter	Type	Required	Description
`keyword`	`string`	required	Search keyword for CVE vulnerabilities (e.g. 'Apache', 'log4j').
`limit`	`integer`	optional	Max results. (default: 10)

get_outage_overview

Get internet outage alerts from IODA (Internet Outage Detection and Analysis).

Parameter	Type	Required	Description
`country_code`	`any`	optional	ISO country code to filter (e.g. 'US', 'NO').
`hours`	`number`	optional	Lookback window in hours. (default: 24)
`limit`	`integer`	optional	Max alerts. (default: 20)

full_cyber_investigation

Run a full cyber intelligence investigation across all four sources in parallel.

Parameter	Type	Required	Description
`query`	`string`	required	Investigation label or summary term.
`domain`	`any`	optional	Domain to investigate (WHOIS + DNS).
`vulnerability_keyword`	`any`	optional	CVE vulnerability search keyword.
`country_code`	`any`	optional	ISO country code for outage alerts.
`outage_hours`	`number`	optional	Outage lookback window in hours. (default: 24)
`limit`	`integer`	optional	Max results per source. (default: 10)