Usage Guide
lookup.disclose.io is a security attribution lookup tool that helps security researchers find who owns digital assets and discover the best channels for reporting vulnerabilities. It supports 16 different input types and can automatically chain strategies together for deep attribution.
🚀 Quick Start
Web Interface
- Enter the exact affected asset (domain, URL, IP, package coordinate, repository, app ID, or model number) in the search box on the home page
- Click "Lookup" or press Enter
- Review attribution and security contacts — primary channels first, fallbacks only if needed
CLI Interface
JSON API
MCP Server (for AI agents)
Streamable HTTP at https://lookup.disclose.io/mcp, or stdio via bun mcp.ts. See the API & MCP section on the home page for client config.
📋 Supported Input Types
Automatic Detection
These are detected automatically - just enter them:
| Type | Example | What it finds |
|---|---|---|
| Domain | cloudflare.com | security.txt, bug bounty programs, CERT contacts |
| URL | https://example.com/path | Same as domain, extracted automatically |
| IPv4 | 8.8.8.8 | Likely user/service operator first; network holder and routing operator as fallbacks |
| IPv6 | 2001:db8::1 | Same as IPv4 |
| [email protected] | Domain-based lookup | |
| ASN | AS15169 | Network registration and operator contacts |
| CIDR | 192.168.0.0/24 | Registered holder and current routing evidence |
With Prefixes
Use these prefixes for specialized lookups:
| Type | Format | Example | What it finds |
|---|---|---|---|
| Package | npm:package | npm:express | Package maintainer, repository, security policy |
| Package | pypi:package | pypi:requests | PyPI package details and maintainer |
| Package | crates:package | crates:serde | Rust crate information |
| Repository | gh:org/repo | gh:nodejs/node | GitHub SECURITY.md, maintainer contacts |
| Mobile App | app:name | app:WhatsApp | App store contacts, developer info |
| Hardware | hw:model | hw:Cisco ASA 5505 | PSIRT contacts, vendor info |
| Extension | store URL, ext:chrome:<id>, ext:firefox:<slug>, or ext:name | ext:uBlock Origin | Store URL or ID is most precise; names are a fallback |
| Desktop App | desktop:name | desktop:Slack | Application vendor contacts |
Cloud Resources
🔗 Strategy Chaining
One of lookup.disclose.io's most powerful features is cross-strategy chaining - when one lookup leads to another automatically.
Example Chain: Package → Repository → Organization
Real Chaining Example
Input: npm:lodash
- Package Strategy: Queries npm registry → finds GitHub repo
- Repository Strategy: Checks GitHub for SECURITY.md → finds organization
- Website Strategy: Looks up organization domain → finds security.txt
- Result: Complete attribution chain with multiple contact methods
📊 Understanding Results
Attribution Section
- Organization: Who owns/controls the asset
- Jurisdiction: Legal jurisdiction (country/state)
- Confidence: How certain we are (High/Medium/Low)
Reporting Paths
Paths are grouped by who receives the report. Start with the queried owner or its authorized agent, then use the responsible operator, a related-party lead, or coordination fallback. Published routes come before constructed guesses.
First-party / authorized:
- security.txt contacts (RFC 9116 standard)
- DNS Security TXT (emerging standard)
- Bug Bounty / VDP Programs (owner-authorized, possibly delivered by HackerOne, Bugcrowd, etc.)
- Repository SECURITY.md (GitHub/GitLab/Bitbucket disclosure)
- PSIRT (vendor product security team)
- Web form (vendor's published submission form)
- Direct email (security@vendor, published vuln contact)
Operator / related / coordination:
- Abuse contacts (primary operator route for IP/ASN; weaker forwarding route for ordinary domains)
- Convention emails (constructed and unverified; try
security@domainbeforeabuse@domain) - CNA and CERT coordinators (national, regional, then global CERT/CC, which may redirect)
Resolution Chain
Shows which strategies were used and how they connected:
🎯 Common Use Cases
1. Web Application Assessment
2. Package Vulnerability Research
3. Infrastructure Assessment
4. Mobile App Security Research
💡 Pro Tips
- Start with the exact affected asset. If that does not resolve, try another identifier for the same target; use an organization name as a fallback.
- Chain manually: If auto-chaining doesn't find what you need, manually lookup related assets
- Check multiple inputs: Different input types may reveal different contacts
- Verify contacts: Always verify contact information is current before reporting
- Use --json for automation: CLI JSON output is perfect for scripts and tools
🔌 API & MCP
Same handler powers the web UI, the JSON API, and the MCP server, so behavior is identical across surfaces.
HTTP API
One endpoint: POST /api/lookup. Body: {"input": "<asset>"}.
The response includes attribution, owner-aware contacts / contactGroups, routeSummary, chains, dataSources, and the backward-compatible status. Use routeClass to distinguish first-party, authorized-agent, operator, related, inferred, and coordinator paths; deliveryAgent names a managed platform carrying a report for the owner.
MCP Server
An MCP server is built in. AI agents (Claude Code, Claude Desktop, Cursor, etc.) can call it as a tool. Two transports — pick whichever fits your client.
Stdio (local agents — Claude Code, Cursor):
Streamable HTTP (remote agents, hosted MCP, web tooling) at https://lookup.disclose.io/mcp — stateless, CORS open:
Tools exposed: lookup_security_contact (full lookup with structured + text output) and classify_asset (no-network type classifier). See the full agent guide for the handshake and tool schemas.
🚨 Important Notes
- Always verify contacts - Information may be outdated
- Respect disclosure policies - Follow vulnerability disclosure practices
- Try Primary first, escalate to Fallback only if needed - National CERTs and convention emails are last-resort channels, not first-pick
- Convention emails are constructed leads, not discovered addresses: try
security@beforeabuse@, and verify either one before disclosure - Rate limits apply - Be respectful of external services