Start here. Classifies the target (public IP, domain or URL, CVE ID, or "software version" such as "nginx 1.20.1") and runs the baseline lookups in code: Shodan, VirusTotal, AbuseIPDB, the registry owner and the keyless threat lists for an IP; DNS, VirusTotal, and the same IP checks for a domain's primary IP. Returns an investigation_id to pass to every other tool, the baseline results and next_steps.

depth sets the tool-call budget and detail: "Quick Scan" (8 calls), "Standard Analysis" (15), "Comprehensive Investigation" (25), "Expert Deep Dive" (40). Private, reserved and cloud-metadata IPs are refused.

Resolve a domain to its public IPv4/IPv6 addresses. Already run for a domain target; use it for other domains you discover.

Shodan host lookup: open ports, services, product versions, hosting org/ASN. Accepts a public IP or a domain (its primary IP is used). Quota-limited: call once per distinct IP. Without SHODAN_API_KEY it falls back to Shodan's free InternetDB: open ports, software, OS and CVEs, but no banners or organisation.

VirusTotal reputation: how many security engines flag the IP/domain as malicious or suspicious. Needs VIRUSTOTAL_API_KEY.

AbuseIPDB abuse reports and confidence score for a public IP address (not domains). Needs ABUSEIPDB_API_KEY.

Best tool for software risk. Finds CVEs whose NVD CPE data confirms they affect this exact product version, ranks them by CISA KEV status, EPSS and CVSS, gives each one's patch status and the minimum safe version, and reports CVEs ruled out. Use for every product with a known version (e.g. from Shodan). software_name e.g. 'nginx', 'Apache httpd', 'OpenSSH'; version e.g. '1.20.1' or '8.9p1' (omit only if unknown).

Who a public IP's network is registered to (organisation, range, country, abuse contact), from the regional internet registry over RDAP. Already run for an IP target; use it for other IPs you find. No key.

Keyless reputation for a public IP: Spamhaus DROP (networks hijacked or run by criminals) and GreyNoise (whether it scans the internet, or is a known business service). Already run for an IP target. GreyNoise allows 10 lookups a day without GREYNOISE_API_KEY.

Hostnames under a domain that have had TLS certificates, from public certificate transparency logs (crt.sh, or Cert Spotter if crt.sh is down). Use it to find other hosts a domain runs; they may no longer exist. No key needed.

Check an Ubuntu or Debian package version against the distro's own security data (via OSV.dev), which counts fixes the distro backports without changing the upstream version. Use it when Shodan lists distro_packages (e.g. OpenSSH_8.9p1 Ubuntu-3ubuntu0.6 gives package 'openssh', package_version '8.9p1-3ubuntu0.6'), or when the user gives an installed package version. Pass the version check's affected_cve_ids as cve_ids. release (e.g. '22.04', '12') is found automatically when possible. No key needed.

Full NVD record for one CVE (e.g. 'CVE-2021-44228'): description, CVSS, CWE, affected product ranges, CISA KEV and EPSS. Not needed for CVEs a version check already returned (they carry severity, EPSS, KEV, exploit and fix): use it for a CVE you have no record of, or to read one's full description and references.

Check CVE IDs and/or product names against CISA's Known Exploited Vulnerabilities catalog. Product matches only show the product has been exploited before, not that a version is affected. Version checks and CVE lookups already give KEV status for their CVEs: use this once per product for its KEV history, or for CVE IDs from elsewhere.

Keyword search of NVD returning the most recent matching CVEs (e.g. 'grafana' or 'log4j'). Not version-aware; prefer version_specific_vulnerability_check when a version is known. Search real product or vendor names, at most twice per product (product, then vendor), never fragments of a name.

Facts computed directly from this investigation's tool results, with no model involved, so they are the same on every run: open ports, network, reputation, version check results, upgrade target, and the CISA KEV split into "confirmed for this target" (NVD version match, or the CVE being analysed) and "related" (product family or vendor). Base the report's claims on these. Values contain third-party text.

Run before giving the final report. Compares your draft with this investigation's tool results and key facts, with no model involved, and lists what they don't support: CVE or advisory IDs no lookup returned, version numbers and EPSS-style percentages that appear nowhere in the data, claims such as "end-of-life", "no patch available" or "internet-facing" that no source makes, unconfirmed CVEs filed as confirmed (and the reverse), misquoted fix versions, upgrade versions named when no version was given, and exploit claims the data doesn't back. Fix or remove each one.

Shows which data-source API keys are configured (never their values) and where to get missing ones. Most lookups work without keys: NVD (just slower), CISA KEV, EPSS, OSV.dev, DNS, the registries, Spamhaus, GreyNoise, SANS ISC, certificate logs, and Shodan's free InternetDB in place of Shodan.