# SecurityTrails MCP for AI Agents AI Agent Connect

> SecurityTrails MCP connects your AI agent to the world's largest domain and IP database. It lets you perform subdomain enumeration, historical DNS lookups, WHOIS data retrieval, and advanced threat hunting. Use it to map attack surfaces and find hidden infrastructure for OSINT or bug bounty work.

## Overview
- **Category:** security-compliance
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_Xvi5VIh3r6rbbcXeA9BV8BAPrUemqIt0s61pgGAJ/ai-agent-connect
- **Tags:** osint, dns-history, subdomain-enumeration, whois, bug-bounty, threat-intelligence

## Description

You can map out an entire organization's digital footprint without jumping between dozens of tabs. This Connector connects your agent to a massive database of domain and IP records, making it easy to find every subdomain a company owns. If you're looking for old infrastructure that was never properly decommissioned, you can pull historical DNS records to see where those assets used to point. You can also spot shared hosting environments by looking up every domain tied to a specific IP address. It handles the heavy lifting of ownership tracking, showing you who owned a domain in the past and who owns it now. It's a huge time saver for anyone doing deep-dive research or trying to find a needle in a haystack of corporate assets. You can find this Connector in the Vinkius catalog and start querying the internet's infrastructure directly through your AI client.

## Tools

### get_api_usage
Check your current SecurityTrails API quota usage. This helps you monitor your remaining credits.

### get_dns_history
Retrieve historical DNS records for a domain. This helps you find old IPs that might still host vulnerable software.

### get_domain_tags
Get classification tags for a specific domain. Use this to see how the domain is categorized in the database.

### get_subdomains
Discover all subdomains for a given domain. It returns both active and inactive assets for attack surface mapping.

### get_whois
Get current WHOIS information for a domain. This shows you the current owner and registration details.

### search_dsl
Perform advanced searches using the SecurityTrails DSL. You can query the internet for specific tech stacks or emails.

### get_domains_by_ip
Find all domains pointed to a specific IP address. This is great for finding hidden vhosts on shared hosting.

### get_domain_details
Get complete domain intelligence and current DNS records. This provides a full overview of a target's infrastructure.

### get_associated_domains
Find other domains associated with your primary target. Use this to expand the scope of your investigation.

### get_whois_history
Retrieve historical WHOIS records for a domain. This helps uncover previous owners before privacy protection was enabled.

## Prompt Examples

**Prompt:** 
```
Find all subdomains for tesla.com.
```

**Response:** 
```
I've queried the database and found the following subdomains for **tesla.com**:

| Subdomain | Status |
| --- | --- |
| autodiscover.tesla.com | Active |
| sso.tesla.com | Active |
| ir.tesla.com | Active |
| shop.tesla.com | Active |
| energy.tesla.com | Active |

I also found several inactive records for legacy marketing sites.
```

**Prompt:** 
```
Check the historical 'A' records for example.com. Were there any changes in 2021?
```

**Response:** 
```
Looking at the DNS history for **example.com**: 

* **Current Record:** Points to `93.184.216.34`.
* **2021 Record:** In late 2021, the domain pointed to `93.184.216.119`.
* **Change Date:** The infrastructure migration appears to have occurred in late 2022.
```

**Prompt:** 
```
What domains are hosted on the IP 8.8.8.8?
```

**Response:** 
```
I performed a reverse IP lookup for **8.8.8.8**. 

Because this is a public resolver, there are millions of historical records. However, the primary domains currently resolving to this IP include:
* dns.google
* google-public-dns-a.google.com
* google-public-dns-b.google.com
```

## Capabilities

### Map external attack surfaces
Get a full list of all active and inactive subdomains for a target organization.

### Retrieve old DNS records
Look back in time at DNS records to find legacy systems or hidden infrastructure.

### Identify domains on specific IPs
Find every domain pointed to a specific IP address to identify shared hosting.

### Run complex internet queries
Use a custom language to search the entire internet for specific tech stacks.

### Track domain ownership history
Pull historical WHOIS records to uncover past owners and registration changes.

## Use Cases

### Mapping a target's attack surface
A researcher wants to see everything a company owns. They ask their agent to use get_subdomains and get_associated_domains to build a full map of the target's digital footprint.

### Tracking infrastructure migration
A threat analyst needs to know where a malicious domain used to point. They use get_dns_history to see the old IP addresses and find decommissioned servers.

### Identifying shared hosting risks
A security auditor finds a target IP. They use get_domains_by_ip to see if other companies are hosted on that same server, which might increase the risk of cross-site attacks.

### Uncovering historical ownership
A brand protection team wants to know who owned a domain before a current actor took it over. They use get_whois_history to find the original registration details.

## Benefits

- Find hidden assets faster by using get_subdomains to pull every active and inactive subdomain at once.
- Spot old vulnerabilities by using get_dns_history to see where a domain pointed months or years ago.
- Identify shared hosting risks with get_domains_by_ip to see every other site on a specific server.
- Uncover hidden actors by using get_whois_history to see who owned a domain before they went private.
- Expand your scope instantly using get_associated_domains to find linked corporate assets.
- Execute complex internet-wide queries using search_dsl to find specific tech stacks or emails.

## How It Works

The bottom line is you get instant access to massive domain and IP intelligence directly within your chat interface.

1. Sign up at SecurityTrails and grab your API key.
2. Connect this Connector to your AI client through the Vinkius platform.
3. Ask your agent to find subdomains, check DNS history, or run WHOIS lookups.

## Frequently Asked Questions

**Can the SecurityTrails MCP find hidden subdomains?**
Yes, it pulls both active and inactive subdomains for a target, which helps you find forgotten assets that might still be running.

**How does SecurityTrails MCP help with bug bounties?**
It helps you find out-of-scope assets and forgotten subdomains by querying a massive database of domain and IP records.

**Can I see who owned a domain in 2019 with SecurityTrails MCP?**
Yes, you can pull historical WHOIS records to see previous owners and registration details even if they are currently private.

**Can SecurityTrails MCP find all sites on an IP?**
Yes, it can perform reverse IP lookups to show you every domain hosted on a specific IP address, which is great for identifying shared hosting.

**Does SecurityTrails MCP support complex queries?**
Yes, it supports a custom search language that lets you query the internet for specific tech stacks, emails, or other complex criteria.

**Is there a free way to use SecurityTrails MCP?**
SecurityTrails offers a free tier, so you can get started with basic domain and IP intelligence without an upfront cost.

**Is the SecurityTrails API free to use?**
SecurityTrails offers a Free Tier API plan which allows 50 API requests per month. This is excellent for specific, targeted OSINT investigations. For automated or large-scale recon, you would need a commercial subscription.

**What is historical DNS good for?**
Companies often migrate infrastructure and hide behind WAFs like Cloudflare. Historical DNS reveals the original origin IP addresses used before the WAF was implemented, which might still be active and vulnerable to direct attacks. It's a critical tool in penetration testing.

**How can I find related domains for a target company?**
Use the `get_associated_domains` tool. It uses proprietary correlation to find other domains owned by the same entity. You can also use `get_domains_by_ip` to find what else is hosted on their IP space.