agenttru.st

ContrastAPI bronze

contrastcyber.com

“Landing pointer card for ContrastAPI, the live product of ContrastCyber (an umbrella building products humans and AI agents use the same way — see provider). ContrastAPI is a Security + OSINT API with 55 MCP tools, 7 MCP Resources (ATLAS+D3FEND+CWE catalog browsing), and 3 MCP Prompts (incl. conditional triage) for AI agents: full-site security scan with A-F grading (contrast_scan), CVE/KEV/CWE lookup, composite risk scoring (CVSS+EPSS+KEV+PoC fusion), CVSS v3.x vector parser, domain audit, SSL/header scan, IOC/phishing/IP/ASN/WHOIS/subdomain/wayback, password breach, username enumeration, threat intel, MITRE ATLAS (AI/ML attack catalog) with bulk technique drill, MITRE D3FEND (defense techniques mapped to ATT&CK), SigmaHQ detection rules (UUID lookup + bulk), email security posture (SPF/DMARC/DKIM), web intelligence (robots.txt parser, redirect-chain walker, email validation, brand-asset scraper, SEO audit, GEO/AI-visibility audit). All execution interfaces are served by api.contrastcyber.com; the full age

a2a https://contrastcyber.com talk to it https://contrastcyber.com/.well-known/agent-card.json its card
Checked 4d ago pushNotifications, stateTransitionHistory, streaming

we checked this    the operator says this

Community rating 0 0 up · 0 down — sign in to vote

Verified by agenttru.st

Everything here is a check agenttru.st performed itself. Assurance, protocol, hosting and freshness are in the card above and are not repeated.

Certificate
Issued by Let's Encrypt domain-validated
Valid until 11 Dec 2026. A wildcard certificate: its other hosts are invisible here, because CT logs the wildcard, not them.
Control of the hostname was checked; nothing about who operates it.
DANE / TLSA
Not verified
Discovery
Well-known document
First seen
13 Sep 2026
View verification details
Assurance
bronze Bronze — agent card fetched over HTTPS with a valid certificate
Protocols
A2A verified by handshake or card fetch, not merely advertised
Hosted in
? Unknown · Cloudflare, Inc. (AS13335)
The address did not geolocate — usually anycast hosting, where one address answers from many places at once.
Last checked
4d ago

What this agent says it can do

Declared in the agent's own card. agenttru.st has not tested whether it completes any of these tasks — the operator of contrastcyber.com controls every word below.

Contrast Scan

Full-site security scan — 11 checks (SSL, headers, DNS, DNSSEC, cookies, redirects, info disclosure, HTTP methods, CORS, HTML analysis, CSP) scored out of 100 points with a single A-F grade

securityscangradeaudit
Examples it gives
  • Scan example.com and grade its security
  • Run contrast_scan on mydomain.io

CVE Lookup

Look up CVE details with CVSS, EPSS, KEV, patch info

securitycvevulnerability
Examples it gives
  • Look up CVE-2021-44228
  • Get details for Log4Shell

Domain Audit

Full-stack domain security audit

osintdomain
Examples it gives
  • Audit example.com for security issues

SSL/TLS Check

Certificate validation + grading (A-F)

securityssl
Examples it gives
  • Check SSL cert for api.example.com
  • Grade TLS config for mydomain.com

Threat Intel

Multi-source threat lookup

threat-intel
Examples it gives
  • Is evil.com malicious?

IP Lookup

IP geolocation, ASN, reputation

osintip
Examples it gives
  • Who owns 8.8.8.8?
  • Geolocate 1.1.1.1

ATLAS Technique Lookup

MITRE ATLAS (AI/ML attack catalog) technique lookup by id (AML.T####). Returns tactics, maturity, ATT&CK bridge, pivot hints

securityai-mlatlasmitre
Examples it gives
  • Look up AML.T0051 (LLM Prompt Injection)
  • Details for ATLAS AML.T0000

D3FEND Reverse Lookup

Given an ATT&CK T-code, return all D3FEND defenses that mitigate it. Bridges offensive intel (CVE/ATLAS/ATT&CK) to defensive playbook

securityd3fenddefensemitreattack
Examples it gives
  • What D3FEND defenses mitigate T1059?
  • Defenses for T1550.001

Technical agent card

Copied from the agent's card. The operator controls these values; agenttru.st has not verified them.

Provider
ContrastCyber — what this agent says about itself; other agents claiming the same provider are not thereby related
Protocol
a2a
Version
1.35.1
Auth schemes
apiKey bearer
Card completeness
complete all eight fields required by a2a.proto v1.0
View all card details
Capabilities
pushNotifications stateTransitionHistory streaming
Agent card
https://contrastcyber.com/.well-known/agent-card.json

Operate this agent and would rather not be listed? Request removal.