# lookup.disclose.io

> Resolve an internet asset to the party responsible for it and the best available vulnerability-disclosure route. Inputs include domains, URLs, email addresses, IPs, CIDRs, ASNs, software packages, repositories, containers, cloud resources, mobile apps, hardware, browser extensions, desktop apps, and organization names. The public service is free, anonymous, and CORS-open. A disclose.io project.

Start with the exact affected asset. If it does not resolve, try another identifier for the same target; use an organization name as a fallback. Results are evidence-backed routing leads, not proof of ownership or scope. Confirm the affected asset and the current program policy before reporting.

## Core behavior

- One resolution engine powers the web UI, JSON API, MCP server, and official integrations.
- The engine auto-classifies an input, runs type-specific sources in parallel, and follows source-backed relationships for at most three hops. Example: package → repository → organization domain → `security.txt`.
- Contacts are ordered by the party reached and the route's applicability: `first_party`, `authorized_agent`, `responsible_operator`, `related_party`, `inferred`, then `coordinator`. Channel quality and evidence break ties within those classes.
- A current RFC 9116 `security.txt` or dnssecuritytxt record published by the exact queried domain is authoritative and pinned first. A declaration found only after chaining to a host, parent, or other organization is not authoritative for the queried asset.
- IP, IPv6, and CIDR answers use the most-specific bootstrap-RDAP assignment before broader WHOIS, origin-AS, transit, or hosting evidence. An assignment holder or network operator is a responsible route, not proof that it owns the service at the address; operator-only IP results therefore remain `partial`.
- Published routes outrank constructed guesses. A convention `security@` address comes before a convention `abuse@` address when otherwise equivalent; both remain unverified.

Canonical `assetType` values: `domain`, `ipv4`, `ipv6`, `url`, `email`, `cidr`, `asn`, `package`, `repository`, `container`, `cloud-resource`, `mobile-app`, `hardware`, `extension`, `desktop-app`, `organization`.

## HTTP API

### Lookup

- Endpoint: [POST /api/lookup](https://lookup.disclose.io/api/lookup)
- Body: `{"input":"<asset>"}`. Optional `kind` forces one canonical asset type for ambiguous inputs.
- Quickstart: `curl -s https://lookup.disclose.io/api/lookup -H 'Content-Type: application/json' -d '{"input":"cloudflare.com"}'`
- Response: `LookupResult` with `input`, `assetType`, `status`, `requestId`, `attribution`, flat `contacts`, party-clustered `contactGroups`, `routeSummary`, `chains`, `dataSources`, and open-ended `details`.
- `status: complete` means a strong route is tied to an owner-qualified or authorized relationship. `partial` means useful operator, related-party, inferred, or coordinator routing exists without that proof. `failed` means no useful route was found or the input was rejected as structurally unsafe.
- `details.ownerContactFound: false` and `details.kind: "coordinator_only"` identify a result whose only route is a coordinator backstop. Do not present that as a direct owner contact.
- Every contact can include `entity`, `relation`, `routeClass`, `source`, `confidence`, `verified`, and `authoritative`. Prefer `contactGroups` and `routeSummary` for user-facing routing; retain `contacts` for compatibility.
- HTTP 200 carries `complete`, `partial`, and `failed` lookup results. Non-2xx responses use the OpenAPI `ErrorEnvelope`. Honor 429 and 503 `Retry-After` responses.
- Use one persistent opaque `X-Lookup-Session` per client. Optional `X-Request-Id` enables progress polling. Responses include `X-Request-Id`, `RateLimit-*`, `X-Lookup-Cache`, and a weak `ETag`; send `If-None-Match` to receive 304 when unchanged.

### Progress, feedback, and evidence

- `GET /api/lookup/progress?requestId=<id>` returns short-lived, coarse progress for an active lookup. Send the same `X-Lookup-Session` used to start it. Progress never contains the lookup input or result.
- `POST /api/feedback` records a thumbs-up or thumbs-down against a previous `requestId`; the server joins it to the stored lookup. See OpenAPI for the exact body and enums.
- Product feedback and feature requests that need an email reply use [the product feedback form](https://lookup.disclose.io/feedback). It is separate from lookup-bound `/api/feedback`; do not send vulnerability reports, secrets, lookup inputs, or reply addresses to either endpoint on a user's behalf.
- [POST /api/evidence](https://lookup.disclose.io/api/evidence) is an experimental, isolated technical-evidence graph for a public domain or HTTP(S) URL. Successful graphs fix `mode: "shadow"` and `routingImpact: "none"`; observations and optional Censys context cannot change `/api/lookup`, ownership, contact order, or disclosure routing.
- Anonymous lookup transport allows 600 requests per identified IP per 60 seconds. New lookup work is separately limited to 30 per stable session or 120 per IP without a session. Cache hits and identical in-flight joins do not consume compute quota. Fetch OpenAPI for all per-route and keyed limits.

## MCP (Model Context Protocol)

- Remote streamable HTTP: `https://lookup.disclose.io/mcp`. Send `Accept: application/json, text/event-stream`.
- Local stdio: `bun mcp.ts` from a repository clone.
- Tools: `lookup_security_contact` returns a Markdown summary plus structured `LookupResult`; `classify_asset` classifies without network access.
- Claude Code: `claude mcp add --transport http lookup https://lookup.disclose.io/mcp`
- Cursor or another URL-based client: `{"mcpServers":{"lookup":{"url":"https://lookup.disclose.io/mcp"}}}`

## Official integrations

All integrations are thin clients over the same production API:

- [dio-lookup Unix CLI and npm package](https://github.com/disclose/dio-lookup): newline-delimited stdin to JSONL; use `npm i -g dio-lookup` or `bunx dio-lookup`.
- [Caido plugin](https://github.com/disclose/caido-lookup): context-menu and sidebar host lookups.
- [Burp Suite extension](https://github.com/disclose/burp-lookup): Montoya right-click host lookups.
- [OWASP ZAP add-on](https://github.com/disclose/zap-lookup): selected site/message host lookups.
- [Chrome extension](https://github.com/disclose/chrome-extension-v2): disclosure posture for the current tab.
- [Nmap NSE script](https://github.com/disclose/nmap-lookup): scan-target ownership and disclosure-route enrichment.
- [Nuclei templates](https://github.com/disclose/nuclei-templates): scan-output enrichment and disclosure routing.

Clients should send a stable, versioned `X-Lookup-Client` value such as `my-tool/1.0.0`, reuse `X-Lookup-Session`, preserve the returned route semantics, and avoid converting an operator or coordinator route into an ownership claim.

## Documentation

- [Full agent guide](https://lookup.disclose.io/llms-full.txt): request and response examples, all input formats, MCP handshake, contact semantics, caching, and limits.
- [OpenAPI 3.1 contract](https://lookup.disclose.io/openapi.yaml): exact schemas, headers, examples, errors, and rate-limit tables. This is authoritative for wire compatibility.
- [Interactive Swagger UI](https://lookup.disclose.io/api-docs)
- [How resolution works](https://lookup.disclose.io/how-it-works)
- [Usage guide](https://lookup.disclose.io/guide)
- [Changelog](https://lookup.disclose.io/changelog)
- [Product feedback and feature requests](https://lookup.disclose.io/feedback)
- [disclose.io](https://disclose.io)