Skip to content

Get started with the ThreatCluster API

Incidents, CVEs, threat actors, IOCs and leak-site victims over REST, from a free key with 100 credits a day and no card.

Get a free key What the API returns
First

Make your first call

Get a free key and it fills the snippets below. 100 credits a day, no card.

Claude, Cursor or any MCP client

One line. Ask "what are the newest threats?" and the model calls the API for you.

claude mcp add --transport http threatcluster https://threatcluster.io/mcp --header "X-API-Key: tc_live_your_key_here"
The first tool call from the client counts as your first call.

Python

Six lines, requests only. Prints today's stories with their threat scores.

import requests
r = requests.get("https://threatcluster.io/api/public/v1/threats", params={"limit": 10},
                 headers={"X-API-Key": "tc_live_your_key_here"})
for t in r.json()["threats"]:
    print(t["threat_score"], t["title"])
print("cost", r.headers["X-Request-Cost"], "left today", r.headers.get("X-RateLimit-Remaining"))
Run it. A list of titles with scores is the first call.

curl

The plain HTTP contract: one header, one URL.

curl -s "https://threatcluster.io/api/public/v1/threats?limit=5" -H "X-API-Key: tc_live_your_key_here" | jq '.threats[] | {threat_score, title}'
JSON back means the key works; X-Request-Cost says what it cost.

The browser preview below runs on a session token, so it does not count. The first call is the one your code or client makes with the key.

Then

Preview a call

Not signed in, so a demo key covers the threats endpoints and you can see real records before you sign up. The snippets under the form use $THREATCLUSTER_API_KEY.

Run it hereDemo key · threats only
Demo key, 20 calls a day. Get a free key for 100 credits a day and every endpoint. Get a free key
Try one:

List threat clusters

GET/api/public/v1/threats?limit=3&time_filter=24h
curl -H "X-API-Key: $THREATCLUSTER_API_KEY" \
  "https://threatcluster.io/api/public/v1/threats?limit=3&time_filter=24h"

Send a request to see the response, its cost and what is left of today's budget.

Then

Your tool

Start from the tool you already run. Each one has a full guide: prerequisites, setup, a worked example against the live API, and what the requests cost.

Terminal

SIEM, firewall, TIP

Network

Automation

Agents

One key, every path on this page

One key works from every tool above. Upgrade when you need the history.

Get a free key OpenAPI reference