Give your AI agents DNS history

At a glance

Sign-in

There's no API key to copy and paste. The first time your client connects, it opens your browser so you can sign in with your Spamhaus account and approve access. The client then holds a short-lived sign-in token and renews it on its own. The server checks that token on every request.

This is the same Spamhaus single sign-on, with multi-factor authentication, that you use for the Deteqtive interface.

What your agent can do

The server gives your agent three tools, drawing on the same Passive DNS API as the Deteqtive interface and API.

Questions your agent can answer

• Map a footprint: "Which hosts exist under example.com?"
• Protect a brand: "Find domains containing our brand name that we don't own."
• Catch lookalikes: "Find domains spelled almost the same as example.com."
• Pivot in reverse: "Which other domains have pointed to 192.0.2.20, or anywhere in that range?"

Each answer is the starting point for the next question, so an agent can work from one suspicious domain to the infrastructure behind it.

Connect

You connect a client once. After the first browser sign-in, it stays signed in.

Claude Code

Add the server:

claude mcp add --transport http deteqtive https://mcp.deteqtive.com/pdns/

The name (deteqtive here) is your choice. Then run /mcp in Claude Code to sign in: your browser opens to Spamhaus single sign-on. Check the connection at any time with claude mcp list.

Claude Desktop

1. Go to Settings, then Connectors, then Add custom connector.
2. Name it Deteqtive and set the address to https://mcp.deteqtive.com/pdns/.
3. Save, then select Connect. Your browser opens to Spamhaus single sign-on; sign in and approve.

The three Deteqtive tools then appear in your chats.

Other MCP clients

Any client that supports remote MCP servers with OAuth sign-in can connect. Add the server address in your client's MCP settings. The client opens the Spamhaus sign-in the first time it connects. Most clients use a JSON entry like this:

{
  "mcpServers": {
    "deteqtive": {
      "type": "http",
      "url": "https://mcp.deteqtive.com/pdns/"
    }
  }
}

If your client only supports local MCP servers, use a bridge such as mcp-remote, which handles the browser sign-in and connects to the hosted server for you. For example:

{
  "mcpServers": {
    "deteqtive": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.deteqtive.com/pdns/"]
    }
  }
}

Good to know

• Searches count as normal usage. Searches your agent makes through MCP count toward your account's usage in the same way as searches in the interface or the API. There's no separate charge for using the MCP server.
• Ask your agent to check status. If searches start to fail, dns_status shows your current usage and limits, which usually explains why.
• Be specific. Agents get better results when you name the domain, IP address or range, and say whether you want forward or reverse results.

Troubleshooting

Learn more

• Platform Guide
• API Reference
• How Deteqtive works

Start a free trial, or talk to us about access to Deteqtive.