Asset Ownership & Security Contact Lookup

Find the right place to report a security issue.

Start with the exact affected asset. We’ll identify who controls it and the closest available reporting route.

Affected asset or identifier

Interpret as

Use the exact domain, IP, package, repository, app ID, model number, or other affected identifier. Use an organization name only when you do not have one.

Try:

Find a vulnerability-reporting route for almost any asset

lookup.disclose.io is a free resolver for the two questions behind responsible disclosure: who likely owns or operates this asset, and which reporting route is most applicable? It keeps owner routes, operator contacts, forwarding leads, and coordinators distinct.

What is lookup.disclose.io?

lookup.disclose.io is a free resolver that traces likely asset ownership and finds applicable vulnerability-reporting routes. It labels first-party, authorized, operator, related, inferred, and coordinator routes so uncertainty remains visible.

How do I find a security contact for a domain?

Enter the domain at lookup.disclose.io. The resolver checks owner-published security.txt and DNS records, disclosure directories, managed programs, registration data, and source-backed relationships, then orders routes by ownership and applicability before confidence.

What input types are supported?

The API supports domain, IPv4, IPv6, URL, email, CIDR, ASN, package, repository, container, cloud resource, mobile app, hardware, browser extension, desktop app, and organization inputs.

Is there an API or MCP server?

Yes. POST to the JSON API or connect an MCP client to https://lookup.disclose.io/mcp. The exact HTTP contract is available as OpenAPI 3.1 and the agent guide is at llms.txt.

Does a lookup prove who owns an asset or that a program is in scope?

No. Results are evidence-backed leads for responsible disclosure, not proof of ownership, authorization, or current program scope. Confirm the published policy and scope before sending a report.

Use it from code & AI agents

One JSON endpoint and a hosted MCP server. No key, no signup, CORS open — an optional free API key raises rate limits.

HTTP API

curl

curl -s https://lookup.disclose.io/api/lookup \ -H "Content-Type: application/json" \ -d '{"input":"cloudflare.com"}'

JavaScript

const res = await fetch("https://lookup.disclose.io/api/lookup", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ input: "cloudflare.com" }), }); const { attribution, contacts } = await res.json();

Python

import requests r = requests.post("https://lookup.disclose.io/api/lookup", json={"input": "cloudflare.com"}, timeout=30) print(r.json()["attribution"]["organization"])

MCP Server

Add to your agent — remote, no install

Add to Cursor Add to LM Studio

Claude Code

claude mcp add --transport http lookup https://lookup.disclose.io/mcp

Any URL-based MCP client

{ "mcpServers": { "lookup": { "url": "https://lookup.disclose.io/mcp" } } }

Tools: lookup_security_contact, classify_asset.

Integrations

Thin clients over the same API — drop lookups straight into your existing tooling.

Pipe a Nuclei scan straight to the disclosure contact for every host it touched (dio-lookup de-duplicates hosts first):

nuclei -u example.com -jsonl | jq -r '.host' | sort -u | dio-lookup