The FullHunt Model Context Protocol (MCP) server exposes FullHunt API operations as tools that an MCP-compatible client can call. The server currently defines 63 tools across passive intelligence, vulnerability research, Enterprise, Nexus, OEM, and authorized scanning workflows.
The MCP server supplies tools and data. Your MCP client decides which tools to call, how to combine their results, and whether to request approval before an action.

​
Hosted endpoints

Both endpoints use Streamable HTTP. Requests authenticate with the X-API-KEY header. Tool availability is determined by the account and modules associated with that key.

​
What the tools cover

See the Tools Reference for every tool and parameter.

​
Passive lookup and active scanning

Most tools read previously collected or indexed data. Three tools initiate active scanning:
  • fullhunt_scan
  • enterprise_on_demand_scans
  • oem_on_demand_scan
Use scan tools only for assets you own or are explicitly authorized to test. A prompt does not replace authorization or scope controls.
The OEM workflow also provides oem_scan_status. Standard and Enterprise scan tools return a queued request but do not expose a corresponding MCP status tool.

​
Example workflows

​
Verify access

Use auth_status and summarize my account plan, remaining credits, and available modules. Do not call any other tools.

​
Enrich a suspicious IP

Check whether 192.0.2.10 is a Tor exit node. Then retrieve Nexus IP context and reverse-host data. Separate observed API fields from your analysis and do not label the IP malicious without supporting evidence.

​
Prioritize a vulnerability

Retrieve vulnerability intelligence for CVE-2024-3094, including EPSS, CISA Known Exploited Vulnerabilities status, and known exploit records. If Enterprise asset access is available, identify affected external assets and show the evidence used for each match.

​
Review brand impersonation candidates

Retrieve potential phishing and typosquatting records for my authorized brand domain. Group newly observed domains by first-seen date and include WHOIS or certificate context when available.

​
Operational boundaries

  • Tool responses can be incomplete, delayed, or subject to plan limits.
  • A host lookup returns indexed data; it is not a live scan.
  • Nexus IP data is enrichment, not a binary reputation verdict.
  • Scheduled monitoring, alert delivery, ticket creation, and report storage require orchestration in the MCP client or another system.
  • Clients should request confirmation before active scanning or any downstream write action.

​
Next steps

  1. Connect a supported MCP client.
  2. Verify access with auth_status.
  3. Review tool parameters and entitlements.
  4. Use the agent-assisted research guide for a complete search-and-fetch workflow.