security-trails

name

security-trails

description

SecurityTrails is a cybersecurity data platform that provides DNS, domain, IP, and historical internet asset intelligence through APIs, allowing security teams, researchers, and developers to investigate infrastructure, enrich threat analysis, and monitor changes across internet-facing assets. Read and write SecurityTrails data through One: projectassets, projects, ips, projectassetfilters, domains, projecttags and more, 40 actions with real parameter documentation. Use whenever the user asks to look something up in SecurityTrails, create or update a record there, or build code against the SecurityTrails API.

SecurityTrails through One

SecurityTrails is a cybersecurity data platform that provides DNS, domain, IP, and historical internet asset intelligence through APIs, allowing security teams, researchers, and developers to investigate infrastructure, enrich threat analysis, and monitor changes across internet-facing assets.

One exposes SecurityTrails through four MCP tools. The table below carries real action ids from One's knowledge base, so for a common operation you can skip search and go straight to reading the action's parameters.

How to run an action

1. Find the action in the table below, or call search_one_platform_actions with platform security-trails if it is not listed.
2. Call get_one_action_knowledge with the action id. Do this every time, including for actions in this table. The table gives you the id, not the parameters.
3. Call execute_one_action with parameters copied from that knowledge.

Never guess a parameter name, a body field, or an enum value. The knowledge has the real schema, and a guessed field is either a 400 or a silent write of the wrong thing.

Before you start

Call list_one_integrations once and confirm SecurityTrails is connected. If it is missing, the user has not connected it: say so and point them at https://app.withone.ai rather than reaching for raw HTTP.

Each connection carries an access field. If it reports {"policy": "methods", "methods": ["GET"]} the agent is read-only here, so plan a read-only answer instead of attempting a write that will be refused.

Before a write

Creates, updates, deletes and sends land on a real SecurityTrails account and cannot be recalled. State the action and the specific target in one line before the first write in a task, and let the user stop you. Reads need no confirmation.

Actions

ProjectAssets

Action	Method	Path	Action id
Find a Project's Assets	GET	/v2/projects/{{projectId}}/assets	conn_mod_def::GLGCJYhfbog::jE6h2-aoT3iuL7L7sby7Dw
Read a Project Asset by ID	GET	/v2/projects/{{projectId}}/assets/{{assetId}}	conn_mod_def::GLGCJhxvxkA::21oD_xIKR26b9LsdNWGG0g
Apply Tag To a Project Asset	PUT	/v2/projects/{{projectId}}/assets/{{assetId}}/tags/{{tagName}}	conn_mod_def::GLGCJMPdYuA::e9sOobepRG6Pb06lddU1-A
Remove Tag From a Project Asset	DELETE	/v2/projects/{{projectId}}/assets/{{assetId}}/tags/{{tagName}}	conn_mod_def::GLGCJf_RiqA::MtUDl-miQeyyhPQXljFHrg
Search a Project's Assets	POST	/v2/projects/{{projectId}}/assets/_search	conn_mod_def::GLGCJiIqLLA::9BE4jWbbR2SKXiRqQpC3nw

Projects

Action	Method	Path	Action id
Get Custom Tag Task Status for a Project	GET	/v2/projects/{{projectId}}/tags/_task_status/{{taskId}}	conn_mod_def::GLGCLFzL_Ug::3BpKpmUhQom3-Xl2CwZTfQ
List Projects	GET	/projects	conn_mod_def::GLGCKjhtKWA::aQp0H9B7SbaCmjwkNu3uyQ
Bulk Add Remove Assets for a Project	POST	/v2/projects/{{projectId}}/tags/_bulk_tag_assets	conn_mod_def::GLGCKvAI-fA::PT7YhoK7T9Crg_-q6geBtQ

Ips

Action	Method	Path	Action id
Explore Nearby IPs	GET	/v1/ips/nearby/{{ipaddress}}	conn_mod_def::GLGCJprzaKA::t6A6tCA0Qwes2p-4Dc8cAg
Get IP Whois	GET	/v1/ips/{{ipaddress}}/whois	conn_mod_def::GLGCJ29DsDg::6JCpU4jTQ06DZE3VBlMOCQ
Search IPs Using DSL	POST	/ips/list	conn_mod_def::GLGCKX-H3Sg::yJNAyEgpQ9OEJdsCNE6FSA

ProjectAssetFilters

Action	Method	Path	Action id
Get a Project's Asset Filters	GET	/v2/projects/{{projectId}}/filters	conn_mod_def::GLGCJOGu8kg::YvZ9SKD2SZ-616M7erHKFw
Get Filters for a Project's Assets	POST	/v2/projects/{{projectId}}/filters	conn_mod_def::GLGCJKpA8ag::XN9MvMSrS5uxkb1uYvp28w

Domains

Action	Method	Path	Action id
Search Domains by Filter	POST	/domains/list	conn_mod_def::GLGCKYIEGCg::DY0s7tEESSOTuoz4GbWcRw
Search Domains Using DSL	POST	/v1/domains/list-backup	conn_mod_def::GLGCKbanrig::gXZbfA2lQ8awFp_eUAijPA

ProjectTags

Action	Method	Path	Action id
Get a Project's Tags	GET	/v2/projects/{{projectId}}/tags	conn_mod_def::GLGCKvJRkjA::nn22CRIJQPaSb-ZOnTT6qA
Add a Project Tag	POST	/v2/projects/{{projectId}}/tags/{{tagName}}	conn_mod_def::GLGCKvAPICg::lG9yIYsOTv210M8Hepsipw

ProjectAssetTags

Action	Method	Path	Action id
Bulk Add Remove Asset Tags for a Project Asset	POST	/v2/projects/{{projectId}}/assets/{{assetId}}/tags	conn_mod_def::GLGCJKpsQ4A::gE15XDM1RrOTdupvfhhFBw

ProjectAssetExposures

Action	Method	Path	Action id
List a Project Asset's Exposures	GET	/v2/projects/{{projectId}}/assets/{{assetId}}/exposures	conn_mod_def::GLGCJgXXaWA::jwUvQtR9RjuJMaf_t3EGJw

ExposureAssets

Action	Method	Path	Action id
Get Exposure Assets for a Project	GET	/v2/projects/{{projectId}}/exposures/{{signatureId}}	conn_mod_def::GLGCJguSXHA::FQpAM_ZUTPCMJOWREFmaaA

WhoisHistory

Action	Method	Path	Action id
WHOIS History by Domain	GET	/v1/history/{{hostname}}/whois	conn_mod_def::GLGCKkG2c1A::k_FUp_6xTDy1Y6Z5WVOMVg

ProjectStaticAssetsRules

Action	Method	Path	Action id
Add Static Assets to a Project's Rules	POST	/v2/projects/{{projectId}}/rules/_bulk_static_assets	conn_mod_def::GLGCKkgZ30g::UWi6G5VnRXKinGZAI0Q8IQ

FeedSubdomains

Action	Method	Path	Action id
List Feed Subdomains by Type	GET	/v1/feeds/subdomains/{{type}}	conn_mod_def::GLGCKkyM7PA::Cc4zhkbxTaWOG87pgi7aJA

DnsHistory

Action	Method	Path	Action id
Get DNS History for a Hostname by Record Type	GET	/v1/history/{{hostname}}/dns/{{type}}	conn_mod_def::GLGCJqDA9Wg::h4zEmHt2R0qJHft-n0mW6w

DomainFeedFiles

Action	Method	Path	Action id
Get Domain Feed Files by Type	GET	/v1/feeds/domains/{{type}}	conn_mod_def::GLGCJrNBHnA::F8EQVKuGRS6sqS9mnMdWxQ

AssociatedDomains

Action	Method	Path	Action id
Find Associated Domains for a Domain	GET	/v1/domain/{{hostname}}/associated	conn_mod_def::GLGCJrf8ulA::DfwZmh48QVKHEh1z3bhJxg

ProjectExposures

Action	Method	Path	Action id
List a Project's Exposures	GET	/v2/projects/{{projectId}}/exposures	conn_mod_def::GLGCJtudQcg::hYXODSXgQlmHk28Zgvq8xQ

DomainWhois

Action	Method	Path	Action id
Get Domain WHOIS	GET	/v1/domain/{{hostname}}/whois	conn_mod_def::GLGCJ2ThImA::Pa1hn9SQQoK3vfN64x07tQ

UserAgents

Action	Method	Path	Action id
Get User Agents for an IP Address	GET	/v1/ips/{{ipaddress}}/useragents	conn_mod_def::GLGCJ2ThUUA::NoCQw88UTgiO8tjfuj2voQ

DomainSsl

Action	Method	Path	Action id
Get Domain SSL	GET	/v1/domain/{{hostname}}/ssl	conn_mod_def::GLGCJ7Nvtvg::zUFu3NeURSex6HrxHli1zg

Domain

Action	Method	Path	Action id
Get Domain	GET	/v1/domain/{{hostname}}	conn_mod_def::GLGCKGHej5g::Y6cAUw1STCOJYwSSlVahCQ

DomainTags

Action	Method	Path	Action id
List a Domain's Tags	GET	/v1/domain/{{hostname}}/tags	conn_mod_def::GLGCKOK89pA::kQyiQlgDS0e772qnvQ0kaw

IpSearchStatistics

Action	Method	Path	Action id
IP Search Statistics	POST	/ips/stats	conn_mod_def::GLGCKOLg9Wg::Dz309tj5Q4q3ncpcjNYzSg

ProjectReports

Action	Method	Path	Action id
Get a Project Report Type	GET	/v2/action_center/reports/{{projectId}}/{{reportType}}	conn_mod_def::GLGCKOTgctA::df7ZtGPmQx2AEYXx4xU4AA

Subdomains

Action	Method	Path	Action id
List Subdomains for a Domain	GET	/v1/domain/{{hostname}}/subdomains	conn_mod_def::GLGCKO1cakA::wlniD9fuRnmR6a--5xnZXw

Ping

Action	Method	Path	Action id
Ping	GET	/ping	conn_mod_def::GLGCKPfG-uA::wZo7sfS8SLizdkGVEkl4pg

ScrollResults

Action	Method	Path	Action id
Scroll Results by Scroll ID	GET	/v1/scroll/{{scrollId}}	conn_mod_def::GLGCKXAqGjA::hvo84V28SSaGe86KcxInFA

DomainStatistics

Action	Method	Path	Action id
Search Domain Statistics	POST	/domains/stats	conn_mod_def::GLGCKXw82Kg::i42LmBfURCmLoZyXY56HPQ

AccountUsage

Action	Method	Path	Action id
Get Account Usage	GET	/v1/account/usage	conn_mod_def::GLGCKljDwbA::a6lAKRIoSkesGGb1VOehVA

ProjectStaticAssets

Action	Method	Path	Action id
Get a Project's Static Assets	GET	/v2/projects/{{projectId}}/rules/static_assets	conn_mod_def::GLGCKvijlSA::eXrOPfj0TdivmQf-X_-IWw

When a call fails

The error comes from SecurityTrails, not from One. A 400 or 422 means your parameters do not match the schema, so re-read the knowledge and fix the field. A 401 or 403 means the connection needs re-authorizing, which no retry will fix. A 404 means the id is not on this account. A 429 means slow down. Never retry a write more than once: the first attempt may have landed.

Full catalog: https://www.withone.ai/knowledge/security-trails

Integration knowledge by One (withone.ai), licensed under One-Knowledge-1.0. Attribution must be preserved in derivative works.