lookup.disclose.io turns any asset — a domain, IP, URL, email, ASN, package, repo, container, or browser extension — into the right security contact: VDP, bug bounty, PSIRT, security.txt , or CERT. Three ways to use it: Web — https://lookup.disclose.io API — a JSON API with an OpenAPI 3.1 spec and an /llms.txt for agents. Free API-key tiers are available (intake: hello@disclose.io ). MCP server — hosted, so you can call it directly from AI agents and clients (registry id io.github.disclose/lookup-disclose-io ). It also works with the tools you already run: dio-lookup — a pipe-friendly CLI on npm, with a --nuclei mode a Nuclei enrichment template, so nuclei -jsonl | dio-lookup annotates findings with security contacts add-ons for OWASP ZAP , Caido , and Burp Suite (rolling out across their plugin stores) a Chrome extension for one-click lookups (in store review) We’re actively improving attribution quality. If you hit a case where it returns the wrong contact, please tell us — there’s an open feedback thread here: Feedback wanted: lookup.disclose.io — new MCP server + API, and where it still gets attribution wrong Filed under lookup in Announcements & Updates. 1 post - 1 participant Read full topic