Threat intelligence
for the agentic era.
ThreatCluster is now headless. Every capability the platform has (the threat graph, IOCs, dark-web feeds, ransomware tracking, CVE enrichment) is reachable as a REST API, a tc command, or a tool an AI agent can call. The platform stays the same. The surface is your call.
One platform.
Three ways to reach it.
The threat graph, the entity engine, the scoring, the dark-web feeds. All the work the platform has been doing for years, now exposed wherever your team builds. CTI teams build the tools. We do the data.
Build whatever you need.
29 public endpoints under /api/public/v1/*. Search, cluster detail, IOC export, entity graph, ransomware victims, CVE enrichment. Same data the website renders, in your stack, your shape, your tools.
Script and compose.
17 commands across nine groups. Clean JSON to stdout, NDJSON via --watch, stdin chaining with -. Drop-in for cron, CI, and shell pipelines. pipx install threatcluster-cli.
Inside the conversation.
Claude Code, Cursor, Aider, and any agent that runs a shell can call tc directly. For typed tool calls (Claude API, OpenAI function calls, LangChain), wrap a command in a Python adapter. Scoped credentials, request budgets, 15-min bearer TTL.
All three surfaces share the same authentication, scopes, and audit trail. The ThreatCluster web app isn't going anywhere. It's still the place to triage, tag, and brief. Headless just means you can also reach the platform from everywhere else.
How agents actually use it.
Pick a tool to see the conversation: what the agent says, what command it runs, what it gets back.
Why a programmable surface matters.
The website is great for triage and briefing. It's not designed to be part of someone else's workflow. tc, and the API beneath it, give you the same threat data the UI renders, in a shape you can wire into your SIEM, your detection rules, your weekly report, or your agent loop.
JSON on stdout, errors on stderr
Every command emits clean structured output. jq-friendly, agent-friendly, grep-friendly. No ASCII tables, no spinners, no surprises.
Live feeds with --watch
--watch turns any list endpoint into a deduplicating live stream. New items only, NDJSON, ready to send straight to Slack, a SIEM, or a workflow.
Stdin chaining
Pipe IDs into the next command with -. Compose a hundred-line workflow in three commands and a jq selector.
Hardened for agents
Scoped credentials, per-session request budgets, scope-downgrade for sub-processes, keyring storage, plaintext-HTTP refusal. Built for the case where a model invokes it.
Same data the UI uses
One stable URL prefix (/api/public/v1/*). The clusters, entities, IOCs, ransomware feed, and CVE data the website shows, exposed identically.
SIEM-ready exports
tc iocs feed emits one IOC per line. tc threats stix emits valid STIX 2.1 bundles. Drop them straight into a blocklist, MISP, or a case file.
Built for the people who use it.
Same platform, four very different jobs. Pick a role to see how the data fits.
Every capability, accessible.
Nine command groups, mirroring the platform's read surface end-to-end. Click any command to see the call and what comes back. Same shape on the underlying REST API.
Full reference at /docs/cli. Every command takes --help.
Build with the platform.
Mint a key, pick a surface, and start wiring threat intelligence into the tools your team already uses.