How do I use validin-mcp?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@validin-mcp Check the historical DNS records for example.com" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

validin-mcp

by xelemental

Overview Schema Source Related Servers Discussions Admin

Python

Remote

validin-mcp

MCP server for the Validin threat intelligence platform — exposes Validin's DNS, WHOIS, OSINT, certificate, crawl, and threat data as tools for AI agents via the Model Context Protocol.

Features

55+ tools across every Validin API endpoint:

Category	Tools	What you get
Domains	16	DNS history (A/AAAA/NS/MX/TXT/CNAME), subdomains, OSINT, reputation, certificates (CT), crawl history, WHOIS (historical + live), pivots, lookalikes
IP Addresses	8	Reverse DNS, OSINT, reputation, crawl history, pivots, live WHOIS
CIDR Ranges	5	DNS, OSINT, pivots, crawl, WHOIS across entire ranges
Strings	6	Pivot on server banners, JARM hashes, page titles, cert CNs, registrant emails/orgs
Hashes	6	Retrieve HTML/favicon/cert content by hash, crawl history, pivot on fingerprints
Threats	6	Named threat groups, malware families, IOCs, recent reports and indicators
Projects	9	List/manage projects, indicators, tags, notes, alerts, YARA rules and matches
Bulk & Scans	4	Bulk OSINT enrichment, on-demand live HTTP/S scans
Advanced	2	VQL advanced search, domain submissions
Utilities	3	Ping, usage stats

Related MCP server: erlik-graph

Quickstart

Install

pip install validin-mcp

Or install from source:

git clone https://github.com/xelemental/validin-mcp.git
cd validin-mcp
pip install -e .

Set your API key

Get your key from Validin → Profile → API Keys.

export VALIDIN_API_KEY="your-api-key-here"

Run

# stdio transport (default — for Claude Desktop, Claude Code, etc.)
validin-mcp

# Or run as a module
python -m validin_mcp

# Streamable HTTP transport (for remote/shared deployment)
VALIDIN_MCP_TRANSPORT=streamable-http validin-mcp

Configuration

Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "validin": {
      "command": "validin-mcp",
      "env": {
        "VALIDIN_API_KEY": "your-api-key-here"
      }
    }
  }
}

Claude Code

claude mcp add validin -- validin-mcp

Then set the env var VALIDIN_API_KEY in your shell.

Using with uvx (no install)

{
  "mcpServers": {
    "validin": {
      "command": "uvx",
      "args": ["validin-mcp"],
      "env": {
        "VALIDIN_API_KEY": "your-api-key-here"
      }
    }
  }
}

Tool Reference

Domain Investigation

Tool	Description
`domain_combined`	All outgoing connections — recommended starting point
`domain_dns_history`	Full historical DNS records (A, AAAA, NS)
`domain_dns_history_a`	Historical A records only
`domain_subdomains`	Subdomain enumeration
`domain_dns_extra`	SOA, MX, TXT, CNAME, CAA, SRV, HTTPS records
`domain_osint`	OSINT observations and threat references
`domain_reputation`	Quick reputation verdict
`domain_pivots`	Host-response pivots (headers, hashes, certs)
`domain_pivots_by_category`	Pivots filtered by category
`domain_certificates`	Certificate Transparency log data
`domain_crawl_history`	HTTP crawl snapshots over time
`domain_registration_history`	Normalized WHOIS/RDAP history
`domain_registration_live`	Live WHOIS/RDAP lookup
`domain_lookalike`	Typosquatting/impersonation detection
`lookalike_regex`	Regex-based lookalike hunting

IP & CIDR Investigation

Tool	Description
`ip_combined`	All connections — recommended starting point
`ip_dns_history`	Historical A/AAAA records for this IP
`ip_dns_extra`	Extra DNS (HTTPS, SRV) for IP
`ip_osint` / `cidr_osint`	OSINT observations
`ip_reputation`	Quick reputation verdict
`ip_pivots` / `cidr_pivots`	Host-response pivots
`ip_crawl_history` / `cidr_crawl_history`	HTTP crawl data
`ip_registration_live` / `cidr_registration_live`	Live WHOIS
`cidr_dns_history`	DNS for entire CIDR range

String Pivoting

Tool	Description
`string_dns_history`	Domains with this string in DNS responses
`string_dns_extra`	Extra DNS records containing this string
`string_registration_history`	WHOIS records containing this string
`string_registration_by_category`	WHOIS by field (registrant email, org, etc.)
`string_pivots`	Host-response pivots (JARM, server, title, cert CN)
`string_pivots_by_category`	Filtered by pivot category

Hash Operations

Tool	Description
`hash_html_content`	Fetch HTML page by SHA1
`hash_favicon_content`	Fetch favicon by MD5
`hash_certificate_content`	Fetch certificate by SHA1
`hash_crawl_history`	Crawl results for a hash
`hash_pivots`	Pivot on fingerprints
`hash_pivots_by_category`	Filter by hash category

Threat Intelligence

Tool	Description
`threat_names`	List all tracked threats/groups/malware
`threat_summary`	Summary for a specific threat group
`threat_reports`	Published reports for a threat group
`threat_indicators`	IOCs for a threat group
`threat_reports_recent`	Latest published threat reports
`threat_indicators_recent`	Latest reported indicators

Projects & Collaboration

Tool	Description
`project_list`	List all projects
`project_details`	Project metadata
`project_indicators`	Indicators in a project
`project_add_indicators`	Add indicators to a project
`project_delete_indicators`	Remove indicators
`project_add_tags`	Tag indicators
`project_add_note`	Annotate indicators
`project_alerts_latest`	Recent project alerts
`project_yara_rules` / `project_yara_matches`	YARA management

Bulk & Active Scanning

Tool	Description
`bulk_osint`	Bulk OSINT verdicts for a list of indicators
`live_scan_start`	Start an on-demand HTTP/S scan
`live_scan_results`	Poll scan status/results
`live_scan_crawl_results`	Detailed crawl results from scan

Advanced & Utility

Tool	Description
`advanced_query`	Validin Query Language (VQL) search
`submit_domains`	Submit domains for Validin scanning
`ping`	API connectivity test
`profile_usage`	Current API quota
`profile_usage_daily`	Daily usage breakdown

Environment Variables

Variable	Required	Description
`VALIDIN_API_KEY`	Yes	Your Validin API key
`VALIDIN_MCP_TRANSPORT`	No	Transport mode: `stdio` (default) or `streamable-http`

Requirements

Python ≥ 3.10
A Validin account with API access (Community tier has limited API access)

License

MIT

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityMaintained

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

Crimson CrawlerOAuth
com.crimsoncrawler
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
Security Search Research & Data
1
hyperion
com.thetempleofdoom.hyperion
Hyperion — MCP tool marketplace for AI agents: web, OSINT, security, research via one key.
Browser Automation Penetration Testing Research & Data
1
mcp A
com.dechonet
20 domain recon tools for AI agents: DNS, SSL, headers, email, subdomains, lookalikes, changes.
Penetration Testing Networking & Infrastructure
2011
Domain & Company Intel MCP A
com.datakoot
Domain intel for AI agents: RDAP registration, DNS, email deliverability, tech stack.
Networking & Infrastructure Security
611

Related MCP Servers

osint-mcp-server
Security Search Penetration Testing
badchars
A
license
A
quality
C
maintenance
Provides AI agents with 37 OSINT tools and 12 data sources to perform unified reconnaissance, domain analysis, and attack surface mapping. It enables agents to query, correlate, and reason across platforms like Shodan, VirusTotal, and Censys in parallel.
Updated 6 months ago (2026-03-17 02:39 UTC)
37
204 npm
53
MIT
erlik-graph
Security Research & Data
malkreide
A
license
Not graded
quality
B
maintenance
Enables LLMs to perform OSINT link-analysis by exposing transforms (DNS, WHOIS, Shodan, etc.) as MCP tools for autonomous investigation and graph enrichment.
Updated 2 months ago (2026-07-15 20:35 UTC)
MIT
Defender Hunt MCP
Security Monitoring
Soucheff
A
license
Not graded
quality
B
maintenance
Enables security investigation and threat hunting through Microsoft Defender and Entra ID, with 31 tools for KQL queries, alerts, threat intelligence, identity investigation, and advanced threat hunting.
Updated 2 months ago (2026-07-22 01:55 UTC)
MIT
Nullcone MCP Server
Security AI & Machine Learning
maco144
F
license
Not graded
quality
D
maintenance
Provides real-time threat intelligence for AI agents, enabling checks on IPs, domains, URLs, hashes, CVEs, prompt-injection payloads, and malicious AI-skill/MCP-tool definitions against a free database of 890K+ IOCs.
Updated 3 months ago (2026-07-08 13:36 UTC)
-

validin-mcp

Features

Quickstart

Install

Set your API key

Run

Configuration

Claude Desktop

Claude Code

Using with uvx (no install)

Tool Reference

Domain Investigation

IP & CIDR Investigation

String Pivoting

Hash Operations

Threat Intelligence

Projects & Collaboration

Bulk & Active Scanning

Advanced & Utility

Environment Variables

Requirements

License

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

osint-mcp-server

erlik-graph

Defender Hunt MCP

Nullcone MCP Server