Skip to main content
Your agents already write the queries. Now they can run them. The Infrawatch MCP server puts the internet’s attack surface inside Claude, ChatGPT, Cursor, or anything else that speaks the Model Context Protocol. Ask your agent to triage an alert, scope a red team engagement, or check whether an IP has ever hosted an infostealer, and it searches 400 million services, passive DNS, fingerprints, proxy intelligence, and reporting on your behalf, then shows its working. No wrapper, no proxy, no SDK. One URL and your existing API key.

Install Claude

Install ChatGPT

Install Cursor

​
What your agent can do

Every tool is read-only. Your agent can search and read, and it cannot create, change, or delete anything in your account. Because every detection carries a taxonomy category, your agent can ask precise questions instead of keyword-matching. Categories are hierarchical, so malware/* covers every malware family path while malware/infostealer stays narrow. Your agent writes the InfraQL. You can ask in plain language and read the query it ran.

​
Before you start

You need an Infrawatch API key. Create one in API access and give it the scopes the work needs: search.view for search, reports.view for reporting, and the relevant esi.*.view scopes for project data.
Your API key is a credential. Keep it in your client’s secret storage or an environment variable, and never commit it to a repository.
The endpoint is:
Authenticate with the same X-API-Key header the REST API uses. That is the only accepted form. Bearer tokens are not accepted.

​
Claude

To share the setup with your team, commit a .mcp.json that reads the key from the environment instead of embedding it:

​
ChatGPT and Codex

Add the server to ~/.codex/config.toml. env_http_headers points at the environment variable holding your key, so the key itself stays out of the file:
Do not use bearer_token_env_var. It sends Authorization: Bearer, which this endpoint does not accept.

​
Cursor

Add Infrawatch MCP server to Cursor Click the button, confirm the server in Cursor, then replace <your-api-key> in the generated entry with your key. Or add it to ~/.cursor/mcp.json by hand:

​
Try it

Once connected, ask in plain language.

​
Triage an alert

​
Red teaming

Scope an engagement from the outside, exactly as an attacker would see it. Nothing here touches the target: it is all prior observation.
Red team work stays within your authorisation. Infrawatch reports what it has already observed from the public internet, so scoping an engagement never sends traffic to the target.

​
Hunt

Project-scoped questions need a project UUID. Ask your agent to list your projects first. It has a tool for that and will chain the two calls itself.

​
Billing

MCP is billed as ordinary API usage. There is no separate MCP plan, no per-seat charge, and no premium rate. A tool call is an API request, metered exactly as if you had called the endpoint yourself with curl. It counts against the same monthly quota, obeys the same rate limits, and is subject to the same scopes on the same key. That makes usage easy to predict: one question that takes your agent five searches costs five API requests. To watch it live, ask your agent for your current usage. It reports your quota and remaining balance, and that check is itself free.
Because everything runs on your key’s existing scopes, an agent can never reach data you could not reach yourself. Narrow the key’s scopes to narrow what your agent can see.

​
When something goes wrong

Your agent sees the API’s own error, so it can usually explain and correct itself. If no tools appear at all, check that the URL is exactly https://api.infrawatch.com/mcp/v1 and that your header name is X-API-Key.

Create an API key

Scopes, headers, and error handling for the underlying API.

Learn InfraQL

Read and adapt the queries your agent runs.