INTELLESCOPEGet Demo
Intellescope docs

Connect Lookup to your AI assistant

MCP is the standard way to plug Lookup into an AI assistant like Claude or ChatGPT. Once it's connected, you can just ask the assistant to check an IP, domain, URL, hash, or CVE — it runs the same lookups and scoring you get in the web app and hands back the verdict with its evidence, so you never have to leave your chat.

You'll need a Pro or Max plan to connect (Free stays in the web app), and your usual daily limits still apply. There are two ways to connect:

  • Sign in (no token) — in Claude Desktop or claude.ai, add the address below as a connector, then sign in and approve. No token to copy or paste. This is the easiest path for Claude.
  • Token — create a token in your account and paste it into the assistant. Use this for Claude Code, ChatGPT, and other MCP tools.

Address (the “server URL”): https://intellescope.io/api/lookup/mcp

Get your token

Your token is what tells Lookup the requests are really coming from you. Create one before you set up any assistant, and keep it private — anyone with it can use your account. You can revoke it anytime to cut off access.

  1. Create a Lookup account or sign in.
  2. Verify your email or phone if you're asked to.
  3. Make sure you're on the Pro or Max plan (Free can't create tokens).
  4. Open Account → Connections → API & MCP and create a token. It starts with pk_live_ — copy it now, as you won't be able to see it again.

Have that token handy for the setup steps below. (Connecting a whole security team's tooling? That uses API v1 instead.)

Set it up

Connecting Lookup only takes two things: the address below and your token. Grab your pk_live_… token from Account → Connections → API & MCP before you start, then follow the steps for whichever assistant you use.

The address to connect to

This is the “server URL” the steps below ask for. It's the same for everyone on the hosted product — just copy it as-is:

Server URL
https://intellescope.io/api/lookup/mcp

Self-hosted or white-label deployments use their own domain in place of https://intellescope.io.

Connect to Claude Desktop or claude.ai — sign in, no token

This is the simplest way to connect Claude: you paste the address, then sign in to Lookup and approve — there's no token to create or copy.

  1. In Claude Desktop open Settings → Connectors; in claude.ai open Settings → Connectors in your browser. Choose Add custom connector.
  2. Name it Intellescope and paste the address as the server URL: https://intellescope.io/api/lookup/mcp.
  3. A browser window opens on Intellescope. Sign in with your Pro or Max account and click Approve to let Claude run lookups as you.
  4. You're connected — the Lookup tools appear in Claude. Ask it to check an indicator, e.g. “use Intellescope to triage 203.0.113.45.”

The connection runs as your account and counts against your plan's daily limits, just like the web app. You can review or revoke connected assistants anytime under Account → Connections → API & MCP.

Connect to Claude Code

Add Lookup with a single command in your terminal. Paste your token where it says pk_live_YOUR_TOKEN:

Terminal
claude mcp add --transport http intellescope-lookup \
  https://intellescope.io/api/lookup/mcp \
  --header "Authorization: Bearer pk_live_YOUR_TOKEN"

# confirm it registered and the tools are live
claude mcp list

Then, inside a Claude Code session, ask it to look up an indicator — e.g. “use intellescope-lookup to triage 203.0.113.45.” Claude calls the tools directly and shows the ranked verdict with its evidence.

Connect to Claude Desktop with a token (alternative)

Prefer a token over signing in — or automating the config? In Claude Desktop, open Settings → Developer → Edit Config and paste the block below into the file that opens (claude_desktop_config.json). Add your token where it says pk_live_YOUR_TOKEN, save, and restart Claude Desktop:

claude_desktop_config.json
{
  "mcpServers": {
    "intellescope-lookup": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote",
        "https://intellescope.io/api/lookup/mcp",
        "--header", "Authorization: Bearer pk_live_YOUR_TOKEN"
      ]
    }
  }
}

After the restart, the Lookup tools show up in the tools menu (the slider icon). This step needs Node.js installed on your computer.

Connect to ChatGPT

ChatGPT connects to Lookup through a custom connector (available on ChatGPT Pro, Business, and Enterprise plans). Add it once and it's ready to use:

  1. In ChatGPT, open Settings → Connectors → Create (enable connectors in Settings → Connectors → Advanced first if you don't see it).
  2. Name it Intellescope Lookup and, when it asks for the server URL, paste the address: https://intellescope.io/api/lookup/mcp.
  3. When it asks how to sign in, pick the API key / token option and paste your pk_live_… token, then create the connector.
  4. Enable the connector in a chat (via the plus / tools menu) and ask ChatGPT to look up an indicator — it calls the Lookup tools directly.

The Lookup token still enforces your Pro / Max plan limits regardless of which assistant calls it.

Any other AI assistant

Using a different assistant that supports MCP? It only needs the same two things — the address and your token. Here they are in the format most tools expect:

Remote MCP connection
URL:     https://intellescope.io/api/lookup/mcp
Header:  Authorization: Bearer pk_live_YOUR_TOKEN

Example mcpServers entry (JSON):
{
  "mcpServers": {
    "intellescope-lookup": {
      "url": "https://intellescope.io/api/lookup/mcp",
      "headers": {
        "Authorization": "Bearer pk_live_YOUR_TOKEN"
      }
    }
  }
}
Initialize (JSON-RPC)
curl -sS -X POST "https://intellescope.io/api/lookup/mcp" \
  -H "Authorization: Bearer pk_live_YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2025-06-18",
      "capabilities": {},
      "clientInfo": { "name": "example", "version": "1.0.0" }
    }
  }'

Tools

  • TOOLparse_indicators

    Defang and extract IOCs from pasted alert/ticket text (hxxp, [.], etc.). Does not bill usage. Feed values into bulk_lookup_indicators.

    inputSchema
    {
  "type": "object",
  "properties": {
    "text": {
      "type": "string",
      "description": "Raw paste from an alert, email, or ticket"
    },
    "limit": {
      "type": "number",
      "description": "Max indicators to return (default 50, hard cap 50)"
    }
  },
  "required": [
    "text"
  ]
}
  • TOOLlookup_indicator

    Research one IP, domain, URL, or hash with vendor enrichment and a transparent score. Counts against Lookup daily usage.

    inputSchema
    {
  "type": "object",
  "properties": {
    "value": {
      "type": "string",
      "description": "Indicator value to research (defanged forms accepted)"
    },
    "type": {
      "type": "string",
      "enum": [
        "ip",
        "domain",
        "url",
        "hash_sha256",
        "hash_md5"
      ],
      "description": "Optional type override when auto-detect is ambiguous"
    },
    "refresh": {
      "type": "boolean",
      "description": "Re-query vendors for an existing session (uses manual refresh quota)"
    }
  },
  "required": [
    "value"
  ]
}
  • TOOLbulk_lookup_indicators

    Triage many IOCs from an alert in one call — enrich, score, and return ranked verdicts (highest score first). Accepts a values array or free-text paste. Counts one lookup per new unique indicator (max 50).

    inputSchema
    {
  "type": "object",
  "properties": {
    "values": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Indicator values (already parsed). Prefer this after parse_indicators."
    },
    "text": {
      "type": "string",
      "description": "Optional alert paste — defanged and extracted when values is omitted"
    },
    "exportFormat": {
      "type": "string",
      "enum": [
        "markdown",
        "csv",
        "stix"
      ],
      "description": "Optional: also return a ready-to-paste markdown, CSV, or STIX 2.1 body for tickets/SIEM"
    }
  }
}
  • TOOLget_lookup_session

    Fetch a prior Lookup session by id, including score and claims.

    inputSchema
    {
  "type": "object",
  "properties": {
    "sessionId": {
      "type": "string",
      "description": "Lookup session id"
    }
  },
  "required": [
    "sessionId"
  ]
}
  • TOOLlist_lookup_history

    List recent Lookup sessions for the authenticated account. Optionally filter by a substring of the indicator value (matches the history sidebar's search). Does not bill usage.

    inputSchema
    {
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "description": "Optional case-insensitive substring — returns only sessions whose indicator value contains it (e.g. \"45.148\")."
    },
    "limit": {
      "type": "number",
      "description": "Optional max rows to return (default 50, hard cap 50)"
    }
  }
}
  • TOOLget_lookup_report

    Generate a structured Lookup report for a session. Counts against the report quota.

    inputSchema
    {
  "type": "object",
  "properties": {
    "sessionId": {
      "type": "string"
    },
    "tlp": {
      "type": "string",
      "enum": [
        "TLP:CLEAR",
        "TLP:GREEN",
        "TLP:AMBER",
        "TLP:AMBER+STRICT",
        "TLP:RED"
      ],
      "description": "Optional TLP marking for the report"
    }
  },
  "required": [
    "sessionId"
  ]
}
  • TOOLexport_lookup

    Copy-as export for one session — markdown, CSV, or STIX 2.1 for tickets and SIEMs. Does not bill usage.

    inputSchema
    {
  "type": "object",
  "properties": {
    "sessionId": {
      "type": "string",
      "description": "Lookup session id"
    },
    "format": {
      "type": "string",
      "enum": [
        "markdown",
        "csv",
        "stix"
      ],
      "description": "Export format (default markdown)"
    }
  },
  "required": [
    "sessionId"
  ]
}
  • TOOLexport_bulk_lookup

    Copy-as export for a prior bulk triage — pass sessionIds from bulk_lookup_indicators. Formats: markdown, CSV, or STIX 2.1 bundle. Does not bill usage.

    inputSchema
    {
  "type": "object",
  "properties": {
    "sessionIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Session ids from a bulk triage (order preserved in export)"
    },
    "format": {
      "type": "string",
      "enum": [
        "markdown",
        "csv",
        "stix"
      ],
      "description": "Export format (default markdown)"
    }
  },
  "required": [
    "sessionIds"
  ]
}
  • TOOLsuggest_indicators

    Typeahead suggestions from personal history and enrichment cache. Does not bill usage.

    inputSchema
    {
  "type": "object",
  "properties": {
    "prefix": {
      "type": "string",
      "description": "Partial indicator value"
    }
  },
  "required": [
    "prefix"
  ]
}

Mock calls

tools/call · bulk_lookup_indicators (alert paste)
{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "bulk_lookup_indicators",
    "arguments": {
      "text": "Alert IOCs: hxxp://evil[.]example/path 185.220.101.1 deadbeef…",
      "exportFormat": "markdown"
    }
  }
}
tools/call · lookup_indicator
{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "lookup_indicator",
    "arguments": { "value": "203.0.113.45" }
  }
}
Tool result (text JSON)
{
  "content": [
    {
      "type": "text",
      "text": "{\n  \"sessionId\": \"ls_abc123\",\n  \"type\": \"ip\",\n  \"value\": \"203.0.113.45\",\n  \"activityClass\": \"c2\",\n  \"mitreTechniqueIds\": [\n    \"T1071\"\n  ],\n  \"score\": {\n    \"score\": 720,\n    \"uncertaintyLow\": 610,\n    \"uncertaintyHigh\": 810,\n    \"completeness\": 0.72,\n    \"confidence\": 0.81,\n    \"severity\": \"elevated\"\n  },\n  \"glanceWhy\": {\n    \"line\": \"High: VirusTotal 42/91 and OTX 3 pulses · Cobalt Strike lifted it; AbuseIPDB 0% held it down.\",\n    \"bucketLabel\": \"High\",\n    \"lifted\": [\n      {\n        \"sourceName\": \"VirusTotal\",\n        \"phrase\": \"VirusTotal 42/91\",\n        \"contribution\": 28\n      },\n      {\n        \"sourceName\": \"AlienVault OTX\",\n        \"phrase\": \"AlienVault OTX 3 pulses · Cobalt Strike\",\n        \"contribution\": 12\n      }\n    ],\n    \"heldBack\": {\n      \"sourceName\": \"AbuseIPDB\",\n      \"phrase\": \"AbuseIPDB 0%\",\n      \"contribution\": -8\n    }\n  },\n  \"modelVersion\": \"v0.3.1\",\n  \"scoringParamsPinned\": true,\n  \"sources\": [\n    {\n      \"kind\": \"virustotal\",\n      \"displayName\": \"VirusTotal\",\n      \"vendor\": \"VirusTotal\",\n      \"status\": \"success\",\n      \"claimCount\": 3,\n      \"message\": null\n    }\n  ],\n  \"claims\": [\n    {\n      \"claimType\": \"reputation_assertion\",\n      \"claimSummary\": \"Malicious reputation from vendor feed\",\n      \"signal\": \"supporting\",\n      \"sourceConfidence\": 0.82\n    }\n  ],\n  \"claimsTruncated\": false\n}"
    }
  ]
}

Plans & limits

Remote MCP is a Pro / Max capability. On those plans, daily quotas still apply — the same meters you see under Account → Plan & usage. Exceeding a limit returns an error from the tool; upgrading your plan raises the same ceilings for both the web app and MCP.

  • lookup_indicator bills lookup usage (or manual refresh when refresh is true).
  • get_lookup_report bills the report quota.
  • suggest_indicators and reading history do not bill usage.
  • Answers lead with the sources and scores behind a verdict. Any written summary is just a convenience on top of that evidence — the evidence is the source of truth.