Lookup.disclose.io — MCP server, API, and new tool integrations

Announcements & Updates
1

lookup.disclose.io turns any asset — a domain, IP, URL, email, ASN, package, repo, container, or browser extension — into the right security contact: VDP, bug bounty, PSIRT, security.txt, or CERT.

Three ways to use it:

  • Web — https://lookup.disclose.io
  • API — a JSON API with an OpenAPI 3.1 spec and an /llms.txt for agents. Free API-key tiers are available (intake: hello@disclose.io).
  • MCP server — hosted, so you can call it directly from AI agents and clients (registry id io.github.disclose/lookup-disclose-io).

It also works with the tools you already run:

  • dio-lookup — a pipe-friendly CLI on npm, with a --nuclei mode
  • a Nuclei enrichment template, so nuclei -jsonl | dio-lookup annotates findings with security contacts
  • add-ons for OWASP ZAP, Caido, and Burp Suite (rolling out across their plugin stores)
  • a Chrome extension for one-click lookups (in store review)

We’re actively improving attribution quality. If you hit a case where it returns the wrong contact, please tell us — there’s an open feedback thread here: Feedback wanted: lookup.disclose.io — new MCP server + API, and where it still gets attribution wrong

Filed under lookup in Announcements & Updates.