CyberGordon API

Name: CyberGordon API API
Brand: CyberGordon API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityThreat Detectionnone5 EndpointsREST

For Agents

Submit an IP, domain, URL, hash, or email to CyberGordon and receive an aggregated reputation report drawn from multiple threat intelligence engines.

Quickstart

Get started with CyberGordon API in minutes using your preferred integration method.

# Add to your MCP client config (Claude Desktop, Cursor, Windsurf)
{
  "jentic": {
    "url": "https://api.jentic.com/mcp",
    "auth": "oauth"
  }
}

# Then ask your agent:
"check the reputation of a URL"

# → Jentic returns the GET /events tool with parameter schema, agent executes.

Capabilities

What an agent can do with CyberGordon API API.

Submit a single observable for analysis via GET /request/{observable}

Submit one or more observables via POST /request/form for bulk analysis

Look up request metadata to track which engines are still running via GET /get-request/{requestId}/info

Retrieve aggregated analysis results via GET /get-request/{requestId}/results

GET STARTED

Start building with CyberGordon API API

Explore with Jentic

View OpenAPI Document

Use for: Submit an IP address for cyber-reputation analysis, Check the reputation of a suspicious domain, Analyse a file hash across multiple threat intelligence engines, Look up the reputation of an email address from a phishing report

Not supported: Does not handle endpoint protection, vulnerability scanning, or active blocking - use for aggregated reputation lookups on individual observables only.

Jentic publishes the only available OpenAPI document for CyberGordon API, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for CyberGordon API, keeping it validated and agent-ready. CyberGordon is a cyber-reputation aggregator that submits an observable - an IP address, domain, URL, file hash, or email - to multiple security intelligence engines and returns a consolidated risk view. The five endpoints cover analysis submission, request status lookup, results retrieval, and the list of underlying engines. Result data, including suspicious and malicious indicators with links to the original sources, is retained for seven days.

Use Cases

Patterns agents use CyberGordon API API for, with concrete tasks.

★ Triage suspicious indicators in security workflows

Send a suspect IP, domain, URL, hash, or email to CyberGordon and receive a consolidated reputation view drawn from engines like IPinfo, AbuseIPDB, VirusTotal, urlscan.io, GreyNoise, and Pulsedive. Analysts use the aggregated suspicious/malicious flags to triage indicators quickly without juggling several individual portals.

Submit IP 1.2.3.4 via /request/{observable}, poll /get-request/{requestId}/info until complete, then return the aggregated malicious-flag count from /results.

Phishing email investigation

When a user reports a phishing email, an automated workflow extracts the sender email, sending IP, and any URLs in the body, and submits each as an observable. The aggregated report makes it clear whether multiple engines already flag the indicators, which lets the analyst close low-quality reports quickly.

POST /request/form with the email's sender domain and the URL extracted from the body, then return malicious counts from the results endpoint.

Bulk indicator enrichment for a SIEM

Enrich a feed of indicators flowing into a SIEM with CyberGordon's consolidated reputation. A scheduled job batches new indicators, calls POST /request/form, and writes the aggregated risk score back to the SIEM event so detection rules can prioritise alerts that multiple engines flag.

Submit 50 observables in one POST /request/form call and return the aggregated suspicious/malicious totals per indicator.

AI agent threat lookup via Jentic

Give an autonomous agent a tool to check whether a URL or IP is known-bad before acting on user input. The agent searches Jentic for 'check the reputation of a URL', loads the schema, polls the request, and returns the aggregated score. CyberGordon requires no authentication, but Jentic still standardises the discovery and execution path.

Through Jentic, submit a URL extracted from chat input and surface a one-line summary of the aggregated CyberGordon results to the user.

Key Endpoints

5 endpoints — jentic publishes the only available openapi specification for cybergordon api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/request/{observable}

Submit a single observable for analysis

POST

/request/form

Submit one or more observables in a single call

GET

/get-request/{requestId}/info

Get request metadata and progress

GET

/get-request/{requestId}/results

Retrieve aggregated analysis results

GET

/assets/json/engine_list.fddb0.json

List the underlying threat intelligence engines

GET

/request/{observable}

Submit a single observable for analysis

POST

/request/form

Submit one or more observables in a single call

GET

/get-request/{requestId}/info

Get request metadata and progress

GET

/get-request/{requestId}/results

Retrieve aggregated analysis results

GET

/assets/json/engine_list.fddb0.json

List the underlying threat intelligence engines

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

The CyberGordon API requires no credentials, but Jentic still routes calls through its execution layer for consistent observability and rate-limit handling, so workflows behave the same as for authenticated APIs.

Intent-based discovery

Agents search by intent (e.g. 'check the reputation of a URL') and Jentic returns the CyberGordon submit and results operations with their parameter schemas, so the agent can run the full submit-poll-fetch flow without reading docs.

Time to first call

Direct CyberGordon integration: a few hours for the submit, poll, and parse loop. Through Jentic: under 30 minutes - search, load, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Alternative

AbuseIPDB

Single-source IP-abuse reputation database

Pick AbuseIPDB when you only need IP-abuse signal and want a direct source; CyberGordon is the right pick when you want one consolidated answer across many engines.

Complementary

Shodan

Internet-exposed asset and banner intelligence

Use Shodan to inspect what's actually running on an IP; pair with CyberGordon for the reputation view alongside the asset view.

Complementary

Pulsedive

Threat intelligence platform with indicator enrichment and feeds

Use Pulsedive directly for richer per-indicator context and feeds; CyberGordon gives a faster aggregated triage view.

FAQs

Specific to using CyberGordon API API through Jentic.

Why is there no official OpenAPI spec for CyberGordon?

CyberGordon does not publish an OpenAPI specification on its docs site. Jentic generates and maintains this spec so that AI agents and developers can call CyberGordon via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the CyberGordon API use?

The spec defines no security scheme, so the API can be called anonymously, which is useful for read-only reputation lookups. Through Jentic, calls are still routed via the standard search/load/execute flow for consistent observability.

What kinds of observables can CyberGordon analyse?

IP addresses, domains, URLs, file hashes, and email addresses. Submit one observable via GET /request/{observable} or several at once via POST /request/form, then poll the request id for results.

Which threat intelligence engines does CyberGordon aggregate?

CyberGordon pulls from engines including IPinfo, AbuseIPDB, VirusTotal, urlscan.io, Google Safe Browsing, GreyNoise, and Pulsedive. The current live list is exposed via GET /assets/json/engine_list.fddb0.json.

How long are CyberGordon results retained?

Aggregated request results are retained for seven days. Persist any results you need long-term to your own storage, since /get-request/{requestId}/results will stop returning them after the retention window.

How do I check a URL's reputation through Jentic?

Run pip install jentic, search for 'check the reputation of a URL', load the request and results schemas, and execute. Jentic submits the observable, polls /get-request/{requestId}/info, and returns the aggregated results in one flow.