// SCAN REPORT

ContrastAPI

53 tools. 5 can modify or destroy data without limits.

5 write tools that can modify data. Rate limits recommended.

Last updated: 19 May 2026

5 can modify or destroy data

48 read-only

53 tools total

// TOOL MAP

Read (48) Write / Execute (5) Destructive / Financial (0)

// WHAT CAN GO WRONG

Write operations (d3fend_defense_for_attack, kev_detail, seo_audit) modify state. Without rate limits, an agent can make hundreds of changes in seconds — faster than any human can review or revert.

Execute tools (brand_assets, redirect_chain) trigger processes with side effects. Builds, notifications, workflows — all fired without throttling.

// RECOMMENDED RULES

Rate limit write operations

d3fend_defense_for_attack:
  rules:
    - rate_limit: 30/hour

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

asn_lookup:
  rules:
    - rate_limit: 60/minute

Controls API costs and prevents retry loops from exhausting upstream rate limits.

// ALL 53 CONTRASTAPI TOOLS

EXECUTE 2 tools

Execute brand_assets Execute redirect_chain

WRITE 3 tools

Write d3fend_defense_for_attack Write kev_detail Write seo_audit

READ 48 tools

Read asn_lookup Read atlas_case_study_lookup Read atlas_case_study_search Read atlas_technique_lookup Read atlas_technique_search Read audit_domain Read bulk_atlas_technique_lookup Read bulk_cve_lookup Read bulk_ioc_lookup Read bulk_sigma_rule_lookup Read calculate_risk_score Read check_dependencies Read check_headers Read check_injection Read check_secrets Read cve_leading Read cve_lookup Read cve_search Read cwe_lookup Read d3fend_attack_coverage Read d3fend_defense_lookup Read d3fend_defense_search Read dns_lookup Read domain_report Read email_disposable Read email_mx Read email_security_posture Read email_verify Read exploit_lookup Read get_cvss_details Read hash_lookup Read ioc_lookup Read ip_lookup Read password_check Read phishing_check Read phone_lookup Read robots_txt Read scan_headers Read sigma_rule_lookup Read ssl_check Read subdomain_enum Read tech_fingerprint Read tech_stack_cve_audit Read threat_intel Read threat_report Read username_lookup Read wayback_lookup Read whois_lookup

// FAQ

How do I prevent bulk modifications through ContrastAPI? +

The ContrastAPI server has 3 write tools including d3fend_defense_for_attack, kev_detail, seo_audit. Set rate limits in your policy file -- for example, rate_limit: 10/hour prevents an agent from making more than 10 modifications per hour. Intercept enforces this at the transport layer.

How many tools does the ContrastAPI MCP server expose? +

53 tools across 3 categories: Execute, Read, Write. 48 are read-only. 5 can modify, create, or delete data.

How do I add Intercept to my ContrastAPI setup? +

One line change. Instead of running the ContrastAPI server directly, prefix it with Intercept: intercept -c contrastcyber-contrastapi.yaml -- npx -y @contrastcyber/contrastapi. Download a pre-built policy from policylayer.com/policies/contrastcyber-contrastapi and adjust the limits to match your use case.

// RELATED SERVERS

Other MCP servers with similar tools.

Starter policies available for each. Same risk classification, same one-command setup.

ContrastAPI

Other MCP servers with similar tools.

Let agents act without letting them run wild.