Skip to main content

Profundis MCP server

The Profundis MCP server lets you query Profundis straight from an AI assistant. Instead of switching to the web UI or writing API calls by hand, you ask Claude, ChatGPT, or any Model Context Protocol client, and it runs the search and returns the results in your chat.

It exposes the same data as the web UI and the API: hosts, DNS records, WHOIS, TLS certificates, unified search across those datasets, Pivot, subdomain enumeration, ASN details, and perceptual favicon-similarity search.

What you can do with it​

  • Ask "what subdomains does example.com have?" and get the enumeration without leaving your assistant.
  • Pivot from a host to its favicon, then find every site reusing a lookalike icon (the Brand Clone Radar flow).
  • Build recon into an agentic workflow: your assistant chains search_hosts, search_dns, and domain_details to map a target.

How it works​

The server is a thin proxy in front of the Profundis API. Your client connects over the MCP Streamable HTTP transport to:

https://mcp.profundis.io

Every request carries your Profundis credential. The server forwards it to the API, which authenticates the call, applies your plan's limits, and bills credits exactly as a direct API call would. The MCP server holds no credential of its own.

Two ways to authenticate:

  • OAuth (recommended): one-click "connect and sign in" from Claude, ChatGPT, and Claude Code. No key to copy or store.
  • API key: paste your Profundis API key as a bearer token. Handy for scripts and headless clients.

See Authentication for the details, and Connect a client for the per-client steps.

Can results manipulate my assistant?​

They can try: results contain text that anyone can write, such as page titles, HTTP headers, certificate fields, WHOIS records, and for organizations, notes and comments. The server therefore frames every result that carries Profundis data as untrusted third-party data, between two markers that share a random nonce. It shows hidden characters, caps long values and flags strings that read like instructions to an AI, without altering them. Your assistant is told to treat that content as data, never as instructions. See Results are untrusted data for the format.

What it costs​

Usage bills your Profundis credits at the same rate as the equivalent API search: most searches cost 1 credit per results page, a WHOIS search costs 3 per page, a favicon search costs 3 and a Pivot 5. Pages beyond the third and grouped host results cost more (see Credits). Searches return 10 rows per page unless you ask for up to 50; the price is per page, not per row. You need a paid plan (Solo or Professional) or unused credits from a credit pack, the same as for the API. The full per-tool cost is listed in the Tools reference.

Organization automation​

Use a scoped organization service key and the dedicated organization tools. A personal OAuth connection does not grant organization access. The connection is read-only by default: organization_write is listed only for a service key with a write scope. Follow the organization MCP guide for budgets, scope and safe retries.

Last updated on