CyCAT.org API

Name: CyCAT.org API API
Brand: CyCAT.org API
Availability: InStock

✓ Official Vendor SpecSecurityThreat Detectionnone14 EndpointsREST

For Agents

Look up cybersecurity tools, publishers, and projects in the CyCAT catalogue and walk relationships between entities for threat intel and tooling research.

Quickstart

Get started with CyCAT.org API in minutes using your preferred integration method.

# Add to your MCP client config (Claude Desktop, Cursor, Windsurf)
{
  "jentic": {
    "url": "https://api.jentic.com/mcp",
    "auth": "oauth"
  }
}

# Then ask your agent:
"look up a cybersecurity tool in the CyCAT catalogue"

# → Jentic returns the GET /events tool with parameter schema, agent executes.

Capabilities

What an agent can do with CyCAT.org API API.

Resolve a CyCAT UUID to its canonical record with GET /lookup/{uuid}

Walk parent and child relationships between cybersecurity entities for provenance mapping

Search the CyCAT catalogue by free-text query for projects, publishers, and tools

List projects or publishers in paginated ranges for bulk indexing

GET STARTED

Start building with CyCAT.org API API

Explore with Jentic

View OpenAPI Document

Use for: I need to look up a cybersecurity tool by its CyCAT UUID, Search CyCAT for all projects matching a vendor name, Find the parent record of a given CyCAT entity, Retrieve every child entity attached to a project UUID

Not supported: Does not handle vulnerability scanning, malware analysis, or live threat feeds — use for cybersecurity tool, publisher, and project catalogue lookups only.

CyCAT.org is the open Cybersecurity Resource Catalogue, a public index that links projects, tools, publishers, and the relationships between them. The API exposes 14 read-only endpoints for resolving CyCAT UUIDs, walking parent and child relationships, searching the catalogue, and proposing new entries. It is built for SOC analysts, threat intelligence engineers, and AI agents that need to map third-party tooling and publisher provenance.

Use Cases

Patterns agents use CyCAT.org API API for, with concrete tasks.

★ Threat Intel Tool Provenance

When a threat intel analyst encounters a new defensive tool referenced in a report, they resolve the tool's CyCAT UUID and walk its relationships to identify the publisher, parent project, and any child forks. CyCAT's GET /lookup/{uuid} and /parent/{uuid} endpoints return that lineage in two calls, so the analyst can attribute the tool without manually crawling vendor websites.

Call GET /lookup/{uuid} for the supplied CyCAT UUID, then call GET /parent/{uuid} and summarise publisher and parent project.

Catalogue Mirror for Internal Wiki

Security engineering teams that maintain an internal tooling wiki paginate through CyCAT's project and publisher lists to populate a local mirror. /list/project/{start}/{end} and /list/publisher/{start}/{end} return ordered slices, so a scheduled agent can incrementally sync new entries without re-fetching the full catalogue.

Loop GET /list/project/0/100, /list/project/100/200 ... and write each project's UUID and metadata to a local index until the response is empty.

Cross-Reference With External Frameworks

A SOC tooling team that already references MITRE ATT&CK or vendor namespace IDs uses /namespace/getid/{namespace} and /namespace/finduuid to translate those external identifiers into CyCAT UUIDs. This lets them join CyCAT's relationship graph onto their existing detection engineering inventory without manual mapping.

Given namespace 'mitre-attack' and namespace ID 'T1566', call GET /namespace/finduuid/mitre-attack/T1566 and return the CyCAT UUID.

Agent-Assisted Catalogue Contribution

An AI agent reviewing a newly released open-source security tool drafts a CyCAT proposal by calling GET /generate/uuid for a candidate identifier and POST /propose with the tool metadata. A human curator reviews the proposal before it is merged, with the agent removing the friction of writing the JSON payload by hand.

Call GET /generate/uuid, then POST /propose with the new UUID, tool name, publisher, and source URL extracted from a GitHub README.

Key Endpoints

14 endpoints — cycat.

METHOD

PATH

DESCRIPTION

GET

/lookup/{uuid}

Resolve a CyCAT UUID to its record

GET

/search/{searchquery}

Free-text catalogue search

GET

/parent/{uuid}

Get the parent of a CyCAT entity

GET

/child/{uuid}

Get the children of a CyCAT entity

GET

/relationships/expanded/{uuid}

Expanded relationship graph

GET

/namespace/finduuid/{namespace}/{namespaceid}

Resolve namespace to UUID

POST

/propose

Propose a new catalogue entry

GET

/lookup/{uuid}

Resolve a CyCAT UUID to its record

GET

/search/{searchquery}

Free-text catalogue search

GET

/parent/{uuid}

Get the parent of a CyCAT entity

GET

/child/{uuid}

Get the children of a CyCAT entity

GET

/relationships/expanded/{uuid}

Expanded relationship graph

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

CyCAT.org is unauthenticated, so no credentials are stored. Jentic simply routes the request and returns the parsed response, keeping the agent's call shape consistent with authenticated APIs.

Intent-based discovery

Agents search Jentic for 'look up a cybersecurity tool' or 'walk security catalogue relationships' and Jentic returns the matching CyCAT operations with input schemas, so the agent can call GET /lookup/{uuid} or /search/{query} directly.

Time to first call

Direct CyCAT integration: 1-2 hours to read the docs and parse the relationship graph. Through Jentic: under 15 minutes — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Shodan API

Internet-exposure scan data that pairs with CyCAT tool metadata for full attack-surface context.

Use Shodan to find exposed hosts and services, then use CyCAT to resolve the tools and publishers behind those services.

Alternative

MISP API

Threat-intelligence sharing platform with a richer indicator-of-compromise graph but lacking CyCAT's tool/publisher focus.

Choose MISP when the workflow centres on indicators of compromise; choose CyCAT when the goal is to attribute a tool, project, or publisher.

Complementary

AbuseIPDB API

IP reputation data that pairs with CyCAT's tool and publisher catalogue for incident triage.

Use AbuseIPDB to score a suspicious IP, then use CyCAT to identify the security tool or project that flagged it.

FAQs

Specific to using CyCAT.org API API through Jentic.

What authentication does the CyCAT.org API use?

The CyCAT.org API is unauthenticated for read operations. The OpenAPI spec declares no security schemes, so GET endpoints can be called directly against api.cycat.org. Through Jentic the agent simply executes the operation; no credentials are stored or injected.

Can I look up a cybersecurity tool by its CyCAT UUID?

Yes. GET /lookup/{uuid} returns the canonical record for a CyCAT UUID, and GET /parent/{uuid} and /child/{uuid} let you walk the entity graph to identify the parent project and any forks or sub-projects.

What are the rate limits for the CyCAT.org API?

The OpenAPI spec does not document explicit rate limits. CyCAT is operated as a community service, so treat sustained traffic above a few requests per second as inappropriate and stagger bulk catalogue mirrors across longer time windows.

How do I search the CyCAT catalogue through Jentic?

Install pip install jentic and run an agent with the search query 'search the CyCAT cybersecurity catalogue'. Jentic returns the GET /search/{searchquery} operation with its input schema so the agent can call it with a free-text query like 'crowdstrike' and parse the matching catalogue entries.

Can I add a new tool to CyCAT through the API?

Yes. POST /propose accepts a candidate entry that is reviewed by a human curator before being merged into the catalogue. Use GET /generate/uuid first to get a fresh UUID for the proposal, then submit the metadata.

Is the CyCAT.org API free?

Yes. CyCAT.org is an open community catalogue and the public API is free to use. There is no paid tier or API key required for read access.