Data & Analytics · Securitytrails + Claude
SecurityTrails MCP with Claude: Faster Domain and Threat Investigation
The short answer
Claude connects to SecurityTrails through the Model Context Protocol, an open standard that acts like a universal adapter. Once connected with an API key, Claude can look up domain details, retrieve historical DNS records and analyse IP reputation when asked in natural language. Each action runs under permissions the organisation controls.
What is Securitytrails?
SecurityTrails is a domain and IP intelligence platform. It provides real-time and historical DNS records, WHOIS information and cyber threat data, giving teams visibility into their internet assets and those of potential threats. Security analysts, threat intelligence teams and IT operations staff typically use it to investigate suspicious infrastructure, monitor their own domains and support incident response work.
How Claude connects to Securitytrails through MCP
The Model Context Protocol (MCP) is an open standard that lets Claude securely use other software. In plain terms, it is a universal adapter between Claude and a tool like SecurityTrails. Your organisation decides what Claude can see and do, and the connection can be switched off at any time.
Once connected, Claude can read information from SecurityTrails in response to plain questions. For example, a security analyst can ask for the current DNS records of a domain, the historical changes to those records, or the reputation context of an IP address. Claude then summarises the answer in clear English, with the underlying data available for checking.
Permissions and approvals keep people in charge. Access uses a SecurityTrails API key with least-privilege settings, so Claude only reaches the data it needs. Investigation steps are read-focused, and any action that changes a blocklist, ticket or security control is routed to a named person for approval before it happens.
What you can automate
Suspicious domain triage
When an alert mentions an unfamiliar domain, an analyst asks Claude for its registration details, current DNS records and hosting history. Claude gathers the findings into a short brief, so the analyst can decide quickly whether the domain needs blocking or deeper review.
Historical DNS investigation
Incident responders often need to know how a domain looked weeks or months ago. Claude can retrieve historical DNS records from SecurityTrails and highlight changes, such as new name servers or unexpected IP addresses, that may point to a compromise.
IP reputation enrichment
A SOC team receives a list of IP addresses from firewall logs. Claude can check each address against SecurityTrails data and return a ranked summary, helping analysts focus on the few addresses that warrant attention.
Attack surface monitoring for IT teams
An IT operations lead can ask Claude which domains and hosts the organisation exposes publicly and whether any DNS records have changed unexpectedly. This supports regular reviews of the company's internet footprint without manual lookups.
Threat intelligence reporting
Threat intelligence analysts can ask Claude to gather infrastructure details for a campaign and draft a structured report. The analyst verifies the findings before the report is shared with leadership or customers.
An end-to-end workflow: Phishing alert enrichment and ticket update
TriggerA phishing report arrives in the service desk ticketing system with a linked domain.
Claude receives the domain from the ticket and retrieves its registration and current DNS records from SecurityTrails.
Claude pulls historical DNS data to check for recent infrastructure changes and any linked IP addresses.
Claude checks the associated IP addresses for reputation context and summarises the findings.
The summary is posted to the ticket in Microsoft 365 Teams, with a recommended action.
A security analyst reviews the brief and approves or rejects the recommended block.
Approved blocks are logged in the audit trail and the ticket is closed with a record of the decision.
OutcomeAnalysts receive a consistent, pre-researched brief for each phishing report, which typically reduces manual lookup time and gives a clear audit record of each decision.
How we set it up
Free automation audit
We review your security and IT workflows to find the investigations and alerts where SecurityTrails data would save the most time. You receive a prioritised list at no cost.
Secure API key connection
We connect Claude to SecurityTrails using an API key stored in a secure secrets manager. Access is set to least privilege, so only the required data is available to Claude.
Workflow design with approvals
We design the end-to-end workflow across SecurityTrails and your other systems, such as Microsoft 365, your ticketing tool or your SIEM. Consequential actions are assigned to named approvers.
Testing against real cases
We test the workflow against past investigations and known domains to confirm accuracy, then tune the prompts and summaries with your analysts.
Launch, monitoring and training
We launch with audit logs and monitoring in place, and train your team on asking questions, reviewing results and handling exceptions.
Who benefits
- SOC analyst
- Receives pre-researched briefs for alerts, so more time goes to judgement rather than manual lookups.
- Threat intelligence lead
- Can gather infrastructure details for campaigns faster and draft structured reports for review.
- IT operations manager
- Gains regular visibility of the organisation's public domains and DNS changes without ad-hoc requests.
- CISO or security director
- Gets a clearer audit trail of investigations and a more consistent response process across the team.
Security and control
- Access uses a SecurityTrails API key with least-privilege settings, reviewed regularly.
- Claude is limited to read-focused investigation steps by default.
- Any action that changes a block list, ticket status or security control requires named human approval.
- Every query and response is recorded in audit logs for review.
- Results are checked by a qualified analyst before they inform a decision.
For teams in the US, UK, India and the Middle East
Organisations in the United States and the United Kingdom can host the Claude component in their chosen region to support their data protection requirements. In India, workflows can be designed to meet the Digital Personal Data Protection Act, 2023. Organisations in the UAE and Saudi Arabia can align the setup with local data protection laws. The hosting region is chosen during design to meet each organisation's specific requirements.
Learn more about Claude and MCP
Anthropic's AI model and assistant.
Secure links between Claude and business tools.
How engineers build and change software with Claude.
Hosted agents that run multi-step work.
The open standard Claude uses to connect to tools.
Frequently asked questions
What does the SecurityTrails MCP server do?
The SecurityTrails MCP server acts as a secure bridge between Claude and SecurityTrails data. It allows Claude to request domain details, historical DNS records and IP reputation information through the SecurityTrails API, using the permissions you set. It does not give Claude access to anything beyond what you configure.
Is connecting SecurityTrails to Claude secure?
Security depends on how the connection is set up. We use an API key stored in a secure secrets manager, least-privilege access, read-focused steps by default and full audit logging. Sensitive actions require human approval. We design each setup to fit your organisation's security policies.
What can Claude do with SecurityTrails once connected?
Claude can look up domain details, retrieve current and historical DNS records, analyse IP reputation and gather threat intelligence context when asked in plain English. It then summarises the findings. Typical use includes triaging suspicious domains and enriching alerts. Claude does not take remediation actions without approval.
How long does setup take?
Timelines vary with the number of workflows and the systems involved. A focused single workflow often takes a few weeks from the free audit to launch, including testing and training. A broader programme covering several teams and tools typically takes longer. We confirm the timeline during the audit.
Which plan or permissions do I need?
Generally, you need a SecurityTrails account with an API key that has access to the data your workflows require. The exact access depends on your SecurityTrails subscription and your internal security policies. We check these requirements during the free audit so the setup matches what you have.