Threat intelligence API / integrations

Claude

Give Claude live threat intelligence: clusters of breaking incidents, IOCs with confidence and reasons, CVE records with KEV and exploit status, and ransomware leak-site victims. Claude Code calls the tc CLI or the REST API directly; a free key covers all 5 read scopes.

Prerequisites

1. A ThreatCluster account (Free works) and an API key from Settings → API. The key is sent in the X-API-Key header.
2. Base URL: https://threatcluster.io/api/public/v1
3. For the CLI route: Python 3.10+ and pipx.

A free key gets 100 credits per day, 30 requests per minute, a 7-day lookback window, and the read scopes threats:read, iocs:read, entities:read, vulns:read and darkweb:read.

Setup: Claude Code

Claude Code runs shell commands, so the simplest integration is the ThreatCluster CLI. Once installed, Claude uses it like any other tool.

1. Install the CLI:

   pipx install threatcluster-cli

2. Authenticate once:

   tc auth login

3. Ask Claude Code a question that needs live data, for example: "an alert just came in mentioning CVE-2024-3400, check ThreatCluster and pull the IOCs from the top cluster". Claude runs tc vulns get, tc search and tc threats iocs itself and reads the JSON.
4. Optional: cap what a session can do with the CLI's environment variables. TC_SCOPES narrows scopes (for example TC_SCOPES=threats:read,iocs:read) and TC_MAX_REQUESTS caps how many requests the session can make before it hits 429.

No CLI needed if you prefer plain HTTP: export your key as an environment variable and Claude Code can call the API with curl, as in the worked example below.

Worked example

One search call answers "what do we know about this CVE" across clusters, entities and the dark web. /search takes q, plus optional limit, days and include_articles.

curl -H "X-API-Key: $TC_API_KEY" \
  "https://threatcluster.io/api/public/v1/search?q=CVE-2026-46037"

Response, trimmed (the full cluster record also carries ai_summary, slug, keywords and severity_score):

{
  "query": "CVE-2026-46037",
  "clusters": [
    {
      "short_id": "cebb7ea4",
      "cluster_id": "da662236-d210-4fa9-8968-7b30cebb7ea4",
      "ai_title": "Multiple SUSE Kernel RT Security Updates Address Critical Vulnerabilities",
      "urgency_level": "medium",
      "threat_score": 67.25,
      "article_count": 40
    }
  ],
  "entities": [
    {
      "entity_type": "cve",
      "entity_value": "CVE-2026-46037",
      "cluster_count": 4,
      "article_count": 15
    }
  ],
  "darkweb": [],
  "limit": 10,
  "total": 2
}

Chain the short_id into the detail endpoints: /threats/cebb7ea4, /threats/cebb7ea4/iocs, /threats/cebb7ea4/stix.

Budgets for agents

Free keys spend a daily budget of 100 credits. Most requests cost 1 credit, /search costs 5, IOC and STIX pulls cost 3, and a dark-web victim enrichment costs 10. Every response carries X-Request-Cost, and budgeted tiers also get X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, so an agent can read the headers and pace itself. An exhausted budget returns 429 daily_budget_exceeded with a Retry-After header; the correct agent behavior is to stop and retry after that many seconds. A request that finds nothing refunds its credits and returns X-Request-Cost: 0, so speculative lookups are cheap.

For unattended setups, mint a scoped tc_agent_ key instead of handing an agent your personal key. It exchanges at POST /api/auth/agent/token for a bearer token that expires after 15 minutes, and supports per-session request caps and scope downgrade. Details at /cli.

Full endpoint reference: /api/public/v1/docs. CLI and agent keys: /cli. Plans and credits: /pricing.