Vulnerability coordination is in the process of changing shape. People still find the bugs and decide what’s worth reporting — but the plumbing that carries a finding to the right inbox is getting more programmatic, through APIs, integrations, and MCP. The first question of every report hasn’t moved, though: whose asset is this, and who do I even tell? Get that wrong by hand and you usually catch it; bake the wrong answer into a tool or a pipeline and it stays wrong, quietly, for everyone who relies on it. lookup.disclose.io is the contact layer for that problem: give it almost any asset — a domain, IP, ASN, package, repo, container, app, a piece of hardware down to an FCC ID, or just a company name — and it returns the right security channel (security.txt, bug bounty, VDP, PSIRT, or a national CERT). It never invents a contact. What’s new since launch: A hosted MCP server , now in the official registry as io.github.disclose/lookup-disclose-io . One line in Claude Code: claude mcp add --transport http lookup https://lookup.disclose.io/mcp A JSON API — POST /api/lookup , OpenAPI 3.1, plus an llms.txt so a coding agent wires in from one file. Free and anonymous; email hello@disclose.io for a key if you need volume. A hard push on attribution accuracy — killing the cases where naive attribution lands confidently wrong (an npm package routed to the wrong company via a maintainer’s email domain; a PyPI package attributed to GitHub the host instead of its real maintainer; a hardware ID resolved to a fabricated contact that never existed). Each is now a regression test. The full write-up has the details. This is the ask. lookup is useful today and wrong sometimes, and we’d rather hear about the wrong from you. Three questions in particular: Are we getting you to the right places? When you looked something up, was the contact it returned correct — and when it wasn’t, what was the right answer? Wrong and missing answers help most. What input types are we missing? Sixteen covers a lot, not everything. What did you want to paste in and couldn’t? Where would you wire it in? Caido, Burp, a ProjectDiscovery/Nuclei pipeline, a SOAR playbook, your own assistant — tell us, or just build it. Want to build it into Caido, Burp, a ProjectDiscovery/Nuclei pipeline, or your own agent? The API, the MCP server, and the dio-lookup CLI (plus caido-lookup and burp-lookup ) are all there to build on. Full post: Feedback Requested: Coordination is going API-first. Contact Discovery and Attribution still aren't solved. Reply below with the asset that stumped you — that’s the most useful thing in this thread. Know someone who spends their afternoons hunting for the right inbox? Send them the link. 3 posts - 2 participants Read full topic