MCP Tools Reference

The FullHunt MCP server currently defines 63 tools. Every hosted MCP request requires an API key. Enterprise, Nexus, and OEM tools also enforce the corresponding account entitlement or credit rules.

Parameters shown without a default are required. Optional parameters show their server default where one exists.

Retrieval and account

Tool	Parameters	Purpose	Access
`search`	`query`	Classify a domain, host, CVE, organization, or text query and return fetchable result stubs	Authenticated
`fetch`	`id`	Resolve a result identifier returned by `search`	Authenticated
`auth_status`	None	Validate the API key and return user and credit context	Authenticated

Domains, hosts, and scanning

Tool	Parameters	Purpose	Access
`fullhunt_domain_details`	`domain`	Retrieve indexed domain details and related host data	Authenticated
`fullhunt_domain_subdomains`	`domain`	List indexed subdomains	Authenticated
`fullhunt_host`	`host`	Retrieve indexed details for a hostname or IP	Authenticated
`fullhunt_scan`	`target`	Queue an active scan for a domain, IP, or CIDR	Enterprise, authorized targets only

fullhunt_host is a passive lookup. It does not perform a live scan. The fullhunt_scan response confirms that a request was queued but does not expose a matching status tool.

Organizations and vulnerability intelligence

Tool	Parameters	Purpose	Access
`search_organizations`	`query`	Search the organizations database by company name or domain	Authenticated
`search_vulnerabilities`	`query`	Search vulnerability records by CVE or text	Authenticated
`search_exploits`	`query`	Search exploit records by CVE, title, or description	Authenticated
`search_advisories`	`query?`, `ecosystem?`, `package?`	Search OSV and GitHub Security Advisory records	Authenticated
`vulnerability_intelligence_feed`	`days=1`, `page=1`, `per_page=20`, `type=all`, `keywords?`, `source?`, `ecosystem?`, `package?`	Retrieve recent vulnerabilities, exploits, and advisories	Paid feed entitlement, 1 credit

The feed accepts days from 1 to 7, per_page from 1 to 100, and type values vulnerabilities, exploits, advisories, or all.

Data intelligence

Tool	Parameters	Purpose	Access
`intel_host`	`host`	Retrieve a host from the intelligence dataset	Data Intelligence
`intel_tag`	`tag`	Find hosts with a service tag	Data Intelligence
`intel_web_tech`	`tech`	Find hosts with a detected web technology	Data Intelligence
`intel_product`	`product`	Find hosts with a detected product	Data Intelligence
`intel_domain`	`domain`	Find indexed hosts under a domain	Data Intelligence
`intel_ip_to_hosts`	`ip`	Find hostnames associated with an IP	Data Intelligence
`intel_asn_to_hosts`	`asn`	Find hosts in an Autonomous System Number	Data Intelligence
`intel_asn_to_virtual_hosts`	`asn`	Find virtual hosts associated with an Autonomous System Number	Data Intelligence
`intel_ip_range_to_hosts`	`ip_start`, `ip_end`	Find hosts within an inclusive IP range	Data Intelligence
`intel_dns_mx_to_hosts`	`dns_mx`	Find hosts sharing a mail exchanger record	Data Intelligence
`intel_dns_ns_to_hosts`	`dns_ns`	Find hosts sharing a nameserver record	Data Intelligence
`global_search`	`country?`, `product?`, `organization?`, `asn?`, `port?`, `tags?`, `technology?`, `cloud_provider?`, `cdn?`	Search indexed assets with combined filters	Authenticated with credits

Enterprise

Tool	Parameters	Purpose	Access
`enterprise_organizations`	None	List organizations available to the account	Enterprise
`enterprise_alerts`	`org?`, `page?`, `from_date?`, `to_date?`	Retrieve organization alerts and change events	Enterprise
`enterprise_vulnerabilities`	`org?`	Retrieve vulnerabilities observed on account assets	Enterprise
`enterprise_entities`	`org?`	List account entities	Enterprise
`enterprise_assets`	`entity`	Retrieve assets for an entity	Enterprise
`enterprise_suggested_domains`	`query?`, `page?`, `from_date?`, `to_date?`	Retrieve candidate domains related to account organizations	Enterprise
`enterprise_on_demand_scans`	`target`	Queue an active scan	Enterprise, authorized targets only
`enterprise_darkweb_compromised_credentials`	`query?`, `page?`	Retrieve compromised credential records	Enterprise Dark Web
`enterprise_darkweb_discovered_emails`	`query?`, `page?`	Retrieve discovered email records	Enterprise Dark Web
`enterprise_darkweb_potential_phishing`	`q?`, `page?`, `from_date?`, `to_date?`	Retrieve potential phishing domains	Enterprise Dark Web
`enterprise_darkweb_typosquatting`	`q?`, `page?`, `from_date?`, `to_date?`	Retrieve typosquatting candidates	Enterprise Dark Web
`enterprise_certificates`	`q?`, `page?`, `from_date?`, `to_date?`	Retrieve observed TLS certificates	Enterprise

Enterprise date filters use DD/MM/YYYY. The two impersonation tools use the parameter q, not query.

Nexus

Tool	Parameters	Purpose	Access
`nexus_ip_lookup`	`ip`	Retrieve IP or host enrichment	Nexus, 1 credit on success
`nexus_tor_check_ip`	`ip`	Check whether an IP appears in the Tor exit-node dataset	Nexus, 1 credit on success
`nexus_certs_dns_search`	`dns_name`	Search cloud certificate DNS names	Nexus, 1 credit on success
`nexus_passive_dns_lookup`	`domain`	Retrieve passive DNS host associations	Nexus, 1 credit on success
`nexus_domain_collection_lookup`	`domain`	Retrieve organization context for a domain	Nexus, 1 credit on success
`nexus_domain_collection_company_lookup`	`company`	Search domain collections by company name	Nexus, 1 credit on success
`nexus_whois_lookup`	`domain`	Retrieve WHOIS or Registration Data Access Protocol data	Nexus, 1 credit on success
`nexus_whois_search`	`registrar?`, `nameserver?`, `tld?`, `status?`, `expires_before?`, `limit=10`	Search collected WHOIS records	Nexus, 1 credit on success

nexus_whois_search requires at least one filter. Its limit is constrained to 1 through 10.

OEM

Tool	Parameters	Purpose	Access
`oem_attack_surface_search`	`target`	Search OEM attack-surface data	OEM, credited
`oem_attack_surface_host`	`query`	Retrieve one host or IP through the OEM API	OEM, credited
`oem_darkweb_search`	`query`, `query_type=email`	Search OEM dark-web data	OEM Dark Web, credited
`oem_organizations_search`	`query`	Search the organizations database	OEM, credited
`oem_typosquatting_search`	`query`	Search typosquatting candidates	OEM, credited
`oem_potential_phishing_search`	`query`	Search potential phishing candidates	OEM, credited
`oem_on_demand_scan`	`target`	Queue an OEM active scan	OEM, authorized targets only
`oem_scan_status`	`scan_id`	Retrieve the status of a queued OEM scan	OEM
`oem_vulnerability_search`	`query`	Search vulnerability intelligence records	OEM, credited
`oem_exploits_search`	`query`	Search exploit records	OEM, credited
`oem_whois_lookup`	`domain`	Retrieve WHOIS or Registration Data Access Protocol data	OEM, credited
`oem_whois_search`	`registrar?`, `nameserver?`, `tld?`, `status?`, `expires_before?`, `limit=10`	Search collected WHOIS records	OEM, credited
`oem_vulnerabilities_search`	`query`, `query_type=domain`	Search platform-observed vulnerabilities	OEM, credited
`oem_alerts_search`	`query`, `query_type=domain`	Search platform alerts and change events	OEM, credited
`oem_historical_hosts_search`	`query`, `query_type=domain`	Retrieve historical host records	OEM, credited
`oem_vulnerability_intelligence_feed`	`days=1`, `page=1`, `per_page=20`, `result_type=all`, `keywords?`, `severity?`, `kev=false`, `exploit_available=false`	Retrieve recent vulnerability and exploit intelligence	OEM, credited
`oem_account_credits`	None	Return remaining credits and OEM module flags without deducting a credit	OEM
`oem_account_audit_logs`	`page=1`, `start_date?`, `end_date?`	Return paginated OEM audit logs without deducting a credit	OEM

oem_scan_status is the status operation for OEM scans. Poll no faster than the documented 10 requests per minute and stop when the scan reaches a terminal state.

Public archive

Tool	Parameters	Purpose	Access
`public_0day_today_search`	`query`	Search the public 0day.today archive	Authenticated MCP connection; public route rate limit applies

Error behavior

Tool errors preserve the status returned by the underlying API where possible:

Status	Meaning
`400`	Invalid argument or unsupported filter combination
`401`	Missing or invalid API key
`403`	Account lacks the required module or credits
`404`	Requested record or scan identifier was not found
`429`	Route or account rate limit exceeded

For setup and caching issues, see MCP Integration and MCP Best Practices.

Get Started

Integration Foundations

Core Attack Surface

Search & Intelligence

Enterprise APIs

Nexus APIs

OEM APIs

Public APIs

Generated API Reference

Agentic AI (MCP)

Retrieval and account

Domains, hosts, and scanning

Organizations and vulnerability intelligence

Data intelligence

Enterprise

Nexus

OEM

Public archive

Error behavior

​Retrieval and account

​Domains, hosts, and scanning

​Organizations and vulnerability intelligence

​Data intelligence

​Enterprise

​Nexus

​OEM

​Public archive

​Error behavior

Retrieval and account

Domains, hosts, and scanning

Organizations and vulnerability intelligence

Data intelligence

Enterprise

Nexus

OEM

Public archive

Error behavior