Threat intelligence API / integrations

Cursor

Cursor's agent runs terminal commands in your project, so it can pull live threat intelligence while it edits code: detection rules from fresh IOCs, CVE triage in a dependency review, or a leak-site check on a vendor. The ThreatCluster CLI gives it that data as clean JSON on stdout.

Prerequisites

1. A ThreatCluster account (Free works) and an API key from Settings → API. The key is sent in the X-API-Key header.
2. Base URL: https://threatcluster.io/api/public/v1
3. For the CLI route: Python 3.10+ and pipx.

A free key gets 100 credits per day, 30 requests per minute, a 7-day lookback window, and the read scopes threats:read, iocs:read, entities:read, vulns:read and darkweb:read.

Setup

1. Install the CLI:

   pipx install threatcluster-cli

2. Authenticate once:

   tc auth login

3. Ask Cursor's agent a question that needs live data, for example: "add hash rules for the latest LockBit campaign". The agent can chain commands in the terminal:

   tc threats list --query "lockbit" --limit 1 \
     | jq -r '.threats[].cluster_id' \
     | tc threats iocs -

4. Optional: cap what a session can do with the CLI's environment variables. TC_SCOPES narrows scopes (for example TC_SCOPES=threats:read,iocs:read) and TC_MAX_REQUESTS caps how many requests the session can make before it hits 429.

No CLI needed if you prefer plain HTTP: export your key as an environment variable and the agent can call the API with curl, as in the worked example below.

Worked example

Pull the indicators from one incident. Find the cluster's short_id with /search or tc search, then:

curl -H "X-API-Key: $TC_API_KEY" \
  "https://threatcluster.io/api/public/v1/threats/93fb80f8/iocs"

Response, trimmed to 2 of the 4 indicators (the CLI equivalent is tc threats iocs 93fb80f8):

{
  "iocs": [
    {
      "type": "ipv4",
      "value": "31.58.209.241",
      "confidence": "high",
      "reason": "IP address hosting stolen data and offensive tools"
    },
    {
      "type": "domain",
      "value": "fine-work-team.com",
      "confidence": "high",
      "reason": "Listed as a delivery URL for a malicious script"
    }
  ],
  "count": 4,
  "cluster_id": "93fb80f8"
}

Each indicator carries a confidence level and the reason it was extracted, so generated detection rules can cite their source. /threats/93fb80f8/stix returns the same incident as a STIX 2.1 bundle.

Budgets for agents

Free keys spend a daily budget of 100 credits. Most requests cost 1 credit, /search costs 5, IOC and STIX pulls cost 3, and a dark-web victim enrichment costs 10. Every response carries X-Request-Cost, and budgeted tiers also get X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, so an agent can read the headers and pace itself. An exhausted budget returns 429 daily_budget_exceeded with a Retry-After header; the correct agent behavior is to stop and retry after that many seconds. A request that finds nothing refunds its credits and returns X-Request-Cost: 0, so speculative lookups are cheap.

For unattended setups, mint a scoped tc_agent_ key instead of handing an agent your personal key. It exchanges at POST /api/auth/agent/token for a bearer token that expires after 15 minutes, and supports per-session request caps and scope downgrade. Details at /cli.

Full endpoint reference: /api/public/v1/docs. CLI and agent keys: /cli. Plans and credits: /pricing.