threatintel_lookup_domain
Retrieve threat intelligence for a domain from AlienVault OTX and URLhaus to evaluate security risk.
Instructions
Look up a domain across threat intelligence sources (OTX, URLhaus)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain name to look up |
Implementation Reference
- src/index.ts:126-139 (registration)Tool definition (schema + registration) for 'threatintel_lookup_domain'. Defines the tool name, description, and input schema requiring a 'domain' string parameter.
{ name: "threatintel_lookup_domain", description: "Look up a domain across threat intelligence sources (OTX, URLhaus)", inputSchema: { type: "object" as const, properties: { domain: { type: "string", description: "Domain name to look up", }, }, required: ["domain"], }, }, - src/index.ts:459-494 (handler)Handler implementation for 'threatintel_lookup_domain'. Extracts 'domain' from args, queries OTX (if configured) for domain indicators and URLhaus for the domain, then returns combined JSON results.
case "threatintel_lookup_domain": { const { domain } = args as { domain: string }; const results: Record<string, unknown> = { domain }; // OTX if (services.otx) { try { const otxResult = await apiRequest<unknown>( `${config.otx.baseUrl}/indicators/domain/${domain}/general`, { headers: { "X-OTX-API-KEY": config.otx.apiKey! } } ); results.otx = otxResult; } catch (e) { results.otx = { error: e instanceof Error ? e.message : String(e) }; } } // URLhaus try { const urlhausResult = await apiRequest<unknown>( config.abusech.urlhaus + "/host/", { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: `host=${encodeURIComponent(domain)}`, } ); results.urlhaus = urlhausResult; } catch (e) { results.urlhaus = { error: e instanceof Error ? e.message : String(e) }; } return { content: [{ type: "text", text: JSON.stringify(results, null, 2) }], }; } - src/index.ts:78-97 (helper)Generic apiRequest helper used by the handler to make HTTP GET/POST requests to external threat intel APIs.
async function apiRequest<T>( url: string, options: RequestInit = {} ): Promise<T> { const response = await fetch(url, { ...options, headers: { "Content-Type": "application/json", "Accept": "application/json", ...(options.headers || {}), }, }); if (!response.ok) { const text = await response.text(); throw new Error(`API error ${response.status}: ${text}`); } return response.json() as Promise<T>; }