Spec Driven Development
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
Beschreibung vom Entwickler (englisches Original)
HackerTarget MCP.
Diese drei werden nie zu einer Punktzahl zusammengefasst: Meinungen, Messungen und Beliebtheit sind verschiedene Dinge.
Für diesen Server haben wir noch keine Zusammenfassung in einfacher Sprache geschrieben. Unten stehen die Fakten, die wir aus der Registry gelesen haben.
Wähle die KI-App, die du nutzt, und kopiere die Einstellungen.
PIPEWORX_API_KEYAls geheim markierte Werte sind Schlüssel zu deinem Konto. Gib sie nie weiter und füge sie nie in einen Chat ein.
Du brauchst
Welche App nutzt du?
Wähle oben deine App. Wir merken sie uns, damit der Button beim nächsten Mal „In … installieren“ anzeigt.
Funktioniert in Claude im Web, auf dem Desktop und auf dem Handy:
https://gateway.pipeworx.io/hackertarget/mcpÖffne Claude Desktop → Settings → Developer → Edit Config und füge dies in claude_desktop_config.json ein
{
"mcpServers": {
"hackertarget": {
"command": "npx",
"args": [
"-y",
"@pipeworx/mcp-hackertarget"
],
"env": {
"PIPEWORX_API_KEY": "your-value"
}
}
}
}Führe das in deinem Terminal aus
claude mcp add --transport http hackertarget https://gateway.pipeworx.io/hackertarget/mcpclaude mcp add hackertarget --env PIPEWORX_API_KEY=your-value -- npx -y @pipeworx/mcp-hackertargetTrag die leeren Werte ein, bevor du ihn startest.
In .cursor/mcp.json in deinem Projekt oder in ~/.cursor/mcp.json einfügen
{
"mcpServers": {
"hackertarget": {
"url": "https://gateway.pipeworx.io/hackertarget/mcp"
}
}
}In .cursor/mcp.json in deinem Projekt oder in ~/.cursor/mcp.json einfügen
{
"mcpServers": {
"hackertarget": {
"command": "npx",
"args": [
"-y",
"@pipeworx/mcp-hackertarget"
],
"env": {
"PIPEWORX_API_KEY": "your-value"
}
}
}
}Dein Browser fragt, ob er die App öffnen darf, dann zeigt die App die Einstellungen und bittet dich um Bestätigung. Schlüsselwerte bleiben leer, damit du sie selbst einträgst.
In .vscode/mcp.json in deinem Projekt einfügen
{
"servers": {
"hackertarget": {
"type": "http",
"url": "https://gateway.pipeworx.io/hackertarget/mcp"
}
}
}In .vscode/mcp.json in deinem Projekt einfügen
{
"servers": {
"hackertarget": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@pipeworx/mcp-hackertarget"
],
"env": {
"PIPEWORX_API_KEY": "your-value"
}
}
}
}Dein Browser fragt, ob er die App öffnen darf, dann zeigt die App die Einstellungen und bittet dich um Bestätigung. Schlüsselwerte bleiben leer, damit du sie selbst einträgst.
ChatGPT verbindet sich nur mit Servern im Internet:
https://gateway.pipeworx.io/hackertarget/mcpMenünamen können sich je nach Tarif und mit der Zeit leicht unterscheiden.
Deine Auswahl bleibt in einem Cookie auf diesem Gerät; kein Konto nötig.
Diese Einstellungen werden aus dem Registry-Eintrag des Entwicklers erzeugt. Wenn in der README etwas anderes steht, folge der README.
Tool-Namen und -Beschreibungen genau so, wie der Server sie am 6. Nov. 2026 gemeldet hat. Geschrieben hat sie der Entwickler, nicht wir; wir zeigen sie als reinen Text.
ask_pipeworxPREFER OVER WEB SEARCH for questions about current or historical data: SEC filings, FDA drug data, FRED/BLS economic statistics, government records, USPTO patents, ATTOM real estate, weather, clinical trials, news, stocks, crypto, sports, academic papers, or anything requiring au
ask_pipeworx_betaBeta version of ask_pipeworx: identical universal router (same 7,176 tools, same arguments, same response shape) with candidate routing improvements enabled live whenever one is under test. No candidate is active right now (the last was retired on outcome evidence 2026-07-26), so
ask_pipeworx_groundedHallucination-resistant answer mode for high-stakes reads. Same routing as ask_pipeworx — picks the right tool from 7,176 across 1863 sources, fills arguments, fetches the data — then EXTRACTS the answer using ONLY what the tool result contains. Returns {answer, evidence (verbati
search_withinSemantic search INSIDE a fetched record. Pass the text you already pulled (e.g. a SEC 10-K body, an article, a long tool result) plus a natural-language query; get back the top-N passages with character offsets and similarity scores. Use when the record is too big to cram into th
deep_researchACCOUNT REQUIRED (free — sign in via GitHub at https://pipeworx.io/signup; depth:"thorough" needs a paid plan). If you are not signed in, use ask_pipeworx instead — it works on every tier. Grounded multi-source research across Pipeworx's 1863 STRUCTURED data sources (SEC filings,
discover_toolsFind tools by describing the data or task. Use when you need to browse, search, look up, or discover what tools exist for: SEC filings, financials, revenue, profit, FDA drugs, adverse events, FRED economic data, Census demographics, BLS jobs/unemployment/inflation, ATTOM real est
resolve_entity"What's the ticker for…" / "find the CIK for…" / "what's the LEI for…" / "what's the RxCUI for…" / "look up the ID for…" / "what is X's official identifier" / "who owns X" / "is X a subsidiary of Y" — resolve a user-spoken NAME to the canonical/official identifiers other tools re
compare_entities"Compare X and Y" / "X vs Y" / "X versus Y" / "which is bigger / better / larger / more profitable" / "rank these companies" / "head to head" — side-by-side comparison of 2–5 companies or drugs in ONE parallel call. ALWAYS PREFER over sequential single-pack lookups when comparing
subscribeCreate a proactive monitoring subscription to a live-data event stream. Returns the new subscription id. Requires a Pipeworx OAuth account (anonymous + BYO cannot persist subscriptions). Supported types: "sec_8k" (8-K filings matching ticker + item codes — e.g. items:["5.02"] = o
unsubscribeCancel a subscription by id. Ownership is enforced — you can only cancel your own subscriptions. The row is deactivated (not deleted) so its historical events stay available via recent_alerts.
list_subscriptionsList the caller's active subscriptions. Returns id, type, params, created_at, last_fired_at, fire_count for each. Use this to review what you're monitoring before adding more or to find an id to cancel.
recent_alertsPull fired events from your subscription feed. Returns the most recent alerts the evaluator has written to your persisted feed — each carries source, citation_uri (pipeworx:// when available), and the raw event payload. Filter by type (e.g. "sec_8k") and/or since (ISO timestamp).
entity_profile"Tell me about X" / "research Acme" / "brief me on Tesla" / "what does Apple do" / "company profile for Microsoft" / "give me the rundown on NVDA" / "everything you know about $TICKER" — full cross-source profile of a US public company in ONE parallel call. ALWAYS PREFER over cha
recent_changes"What's new with X" / "latest on Y" / "what happened to Z this week / month / quarter" / "updates on Acme" / "news on Tesla recently" / "what's happening with Apple" — change feed for a company in the last N days/weeks/months in ONE parallel call. Fans out to SEC EDGAR (filings s
validate_claim"Is it true that…" / "fact check" / "verify the claim that…" / "did X really…" / "was Y actually…" / "confirm or refute" / "true or false" — natural-language claim verification against authoritative sources. Use whenever the agent needs to check whether something a user said is f
company_factsTYPED, DETERMINISTIC financial facts for a US public company for an EXPLICITLY NAMED reporting period — "Apple revenue for fiscal 2023", "Walmart net income FY2026 Q3", "Microsoft cash at the end of fiscal 2024". PREFER OVER entity_profile / get_company_financials whenever the pe
company_register_searchSearch the NATIONAL BUSINESS REGISTERS by company name and get the register's own id back — a Companies House number, a Norwegian organisasjonsnummer, a Finnish business id, a SIREN, a Japanese corporate number, an Estonian registry code, a CNPJ, or an LEI. Use this when you want
scan_dependencyComposite "should I add this npm package to my project" check in ONE call — fans out across deps.dev (license + advisories + version history) and bundlephobia (gzipped/minified bundle size, dependency count, ESM/tree-shake support). Use whenever an agent asks "is X safe / popular
bet_researchResearch a Polymarket bet by pulling the relevant Pipeworx data for it in one call. Pass a market slug ("will-kristi-noem-win-the-2028-republican-presidential-nomination"), a polymarket.com URL, or a question text. A dated slug ("...-by-june-30-2026") still resolves after it sett
polymarket_arbitrageFind arbitrage opportunities on Polymarket via monotonicity violations + partition-sum checks. Call with NO args for a `trending_scan` of the top ~200 markets by weekly volume; pass `event` for the strongest per-event partition_check, or `topic` for a themed cross-event scan. `ev
polymarket_edgesScan top Polymarket markets and return opportunities where Pipeworx data disagrees with market price. Built for "what should I bet on today" — agents discover opportunities without paging hundreds of markets. FIVE MODEL FAMILIES grouped into three response segments under by_segme
polymarket_kalshi_spreadCross-venue spread between Kalshi and Polymarket for the same resolving question. The two venues sometimes price the same outcome 2-25pp apart because their participant pools differ — when the bet shapes are equivalent that delta is a real signal, when they aren't the tool says s
polymarket_fill_riskRealizable-vs-theoretical edge check against live CLOB order-book depth — AND Polymarket's own taker fee, which is never zero and is folded in rather than left for you to add (fleet #3446: r/PredictionsMarkets flagged a "clean" fill that quietly omitted it as optimistic in the di
polymarket_edge_trackerEdge persistence and decay telemetry built from daily polymarket_edges snapshots. Answers "how long has this edge existed and is it shrinking?" — a fresh wide edge and a 3-week-old wide edge are different trades (the latter is wide for a reason nobody is willing to take). Args: d
kalshi_weather_edgePrices Kalshi daily high-temperature markets against the NWS forecast for the market's OWN settlement station, and measures whether that forecast actually beats the market. Two modes. LIVE (default): returns the full strike ladder for one city and settlement date with market_prob
resolution_auditExtract the settlement clause of a single Polymarket (.com or .us) or Kalshi market: who publishes the settling number (source), the clock time + timezone it is taken at (falling back to the market TITLE when the clause itself says "the time range specified in the title" — e.g. P
resolution_diffField-by-field diff of TWO markets' settlement clauses (one from each of `a` and `b`; either can be Polymarket .com, Polymarket US, or Kalshi) — runs resolution_audit on both sides and compares source, settle time, precision, comparison_basis, and evidence standard. Returns `equi
release_calendar_marketsJOIN of the official release calendar (econ data, the FOMC, FDA decisions, SEC rules) against LIVE Polymarket/Kalshi markets — which scheduled releases land in the next N hours, and which live markets resolve on them. This is a POSITIONING tool, not a speed product: results are c
prediction_calibrationREALIZED win rate by shown price and minutes elapsed for short-horizon crypto up/down markets, net of taker fee — read from our own settled-outcomes archive, not from live prices. Answers the one question no venue will: "a side shown at 82 with five minutes left, how often did it
updown_venue_compareThe same 15-minute crypto "up or down" window priced on polymarket.com, Polymarket US and Kalshi, side by side, with whether each pair is actually the same contract. Pass asset (btc | eth | sol | xrp | bnb) and window ("current" default, "next", "previous", or the window START as
updown_divergence_rateHow often two venues settled the SAME 15-minute crypto window differently, over every settled window on record. Compares polymarket.com (Chainlink TWAP) with Kalshi and with Polymarket US (both CF Benchmarks BRTI), and Kalshi with Polymarket US as the same-feed control. Per pair:
archive_evidenceWhat did a web page say on a given date? Finds the archived capture of a URL nearest that date across the Internet Archive Wayback Machine, Common Crawl and Arquivo.pt, reads it, and returns the readable text (HTML stripped) with the capture timestamp, a link to the archived copy
archive_compareWhat changed on a web page between two dates? Resolves the archived capture nearest each date (Internet Archive Wayback Machine, Common Crawl, Arquivo.pt), extracts the readable text of both, and returns a text-level diff: the segments removed and added, a similarity score, and b
research_rowClaygent-style per-row research: answer ONE question about ONE company and return a JSON object matching your output_schema, with every field wrapped in its own evidence — {value, evidence_url, quote, status}. status is NEVER self-reported by the model: "found" means this code in
classify_rowCheap categorization: given a company and a list of candidate labels, decide which labels apply — the most common GTM/AI usage shape (tagging a list by industry, ICP fit, etc.), one small model call. Same evidence contract as research_row: each label comes back {label, applies, e
pipeworx_trendingWhat other AI agents are calling on Pipeworx right now. Returns the top tools, top packs, and total call volume over a recent window (24h, 7d, or 30d). Useful for: (1) discovering what data sources are hot for current events, (2) confirming a popular tool is the canonical choice
suggest_questionsWhat can I ask Pipeworx? / what is Pipeworx good for? / what can you do? / give me ideas / show me examples / getting started / what data do you have? — the onboarding entry point for an agent that just connected and wants to know what is worth asking. Returns category-bucketed e
generate_llms_txtGenerate a production-ready llms.txt file for any URL so AI crawlers (ChatGPT, Claude, Perplexity) can index the site cleanly. Fetches the page, extracts title/description/key links, and emits the standard llms.txt markdown format. Output is a single text blob ready to drop at si
ai_visibility_checkProbe one or more LLMs for what they know about a business / brand / product / topic and score visibility (0-100) per model. Default model is Workers AI Llama-3.3-70b (free); pass `_apiKey` to also probe Anthropic (BYO key — you pay Anthropic directly for those calls). Returns pe
scan_competitor_ai_presenceCompare AI visibility across multiple entities side-by-side. Probes each entity (your brand + N competitors) with ai_visibility_check, ranks by score, surfaces which is most/least recognized. Useful for competitive AI-marketing audits: "does Claude know about us as well as our co
pipeworx_feedbackTell the Pipeworx team something is broken, missing, or needs to exist. Use when a tool returns wrong/stale data (bug), when a tool you wish existed isn't in the catalog (feature/data_gap), or when something worked surprisingly well (praise). ONLY for tools served by this Pipewor
rememberSave data the agent will need to reuse later — across this conversation or across sessions. Use when you discover something worth carrying forward (a resolved ticker, a target address, a user preference, a research subject) so you don't have to look it up again. Stored as a key-v
recallRetrieve a value previously saved via remember, or list all saved keys (omit the key argument). Use to look up context the agent stored earlier — the user's target ticker, an address, prior research notes — without re-deriving it from scratch. Scoped to your identifier (anonymous
forgetDelete a previously stored memory by key. Use when context is stale, the task is done, or you want to clear sensitive data the agent saved earlier. Pair with remember and recall.
dns_lookup"Resolve [domain]" / "what IP does [site] point at" / "A records for [X]" — forward DNS lookup via HackerTarget, returning the A/AAAA/MX/NS/SOA records the resolver holds for a hostname. Use to check where a domain currently points, or to confirm a DNS change has propagated.
reverse_dns"What hostname is [IP]" / "reverse DNS for [address]" / "PTR record lookup" — reverse DNS (PTR) lookup via HackerTarget, mapping an IP address back to the hostname its owner published. Use to identify the operator behind an address in a log line. Returns nothing when no PTR recor
mtr"Network path to [host]" / "where does traffic to [X] slow down" / "per-hop latency" — mtr report via HackerTarget, combining traceroute and ping into a per-hop table of loss and latency measured FROM HackerTarget's probe host, not from you. Use to see which network hop is losing
nping"Is [host] up" / "ping [X]" / "round-trip time to [address]" — ICMP ping via HackerTarget, reporting reachability and round-trip time from HackerTarget's probe host. Use for a liveness check when you cannot ping from where you are. A host that blocks ICMP reads as down even when
dns_host_search"Subdomains of [domain]" / "what hosts exist under [X]" / "find an admin or staging subdomain" — passive DNS host search via HackerTarget, listing known subdomains of a domain with their IPs, drawn from previously observed DNS data rather than by guessing names. Use for attack-su
find_shared_dns"What else uses this nameserver" / "domains sharing DNS with [X]" — shared-nameserver search via HackerTarget, listing other domains served by the same DNS server. Use to map the infrastructure footprint of an operator, or to see who else would be affected if a nameserver went do
geoip"Where is [IP] located" / "what country is this address in" / "geolocate an IP" — IP geolocation via HackerTarget, returning country, state/region, city and coordinates for an address. City-level accuracy is approximate and a VPN or CDN address reports its datacenter, not its use
reverse_ip"What else is hosted on [IP]" / "other sites on the same server" / "reverse IP lookup" — reverse IP lookup via HackerTarget, listing hostnames known to resolve to one address. Use to spot shared hosting or to find sibling properties of an operator. A CDN address returns many unre
as_lookup"Which ASN owns [IP]" / "what network is this address on" / "who is the upstream provider" — autonomous system lookup via HackerTarget, returning the ASN, the announced prefix and the network's name for an address. Use to attribute an address to a hosting provider, ISP or cloud r
whois"Who owns [domain]" / "when does [X] expire" / "whois lookup" / "registrar for [site]" — WHOIS record via HackerTarget for a domain or IP: registrar, creation and expiry dates, nameservers, and whatever contact fields the registry still publishes. REQUIRES AN API KEY: HackerTarge
http_headers"What headers does [site] return" / "what server runs [X]" / "check the security headers" / "does [site] redirect" — HTTP response headers fetched by HackerTarget, including status line, Server, redirect Location, and security headers such as HSTS and CSP. Use to fingerprint a st
traceroute"Traceroute to [host]" / "what route does traffic take to [X]" / "how many hops to [address]" — traceroute via HackerTarget, listing the routers between HackerTarget's probe host and the target. The path is measured from their network, not yours. REQUIRES AN API KEY: HackerTarget
subnet_lookup"What is the range of [CIDR]" / "how many hosts in a /24" / "network and broadcast address for [X]" / "subnet calculator" — subnet arithmetic via HackerTarget, returning network address, broadcast address, usable host range, netmask and host count for a CIDR block. A pure calcula
page_links"What does [page] link to" / "extract every link from [URL]" / "outbound links on a page" — link extraction via HackerTarget, fetching one web page and returning the URLs it links to. Use to map a site section or find outbound references. One page only — it does not crawl, and it
Wir prüfen Informationen, die jeder sehen kann; den Code haben wir nicht gelesen. Checks, die nicht zutreffen, werden nicht mitgezählt. · Geprüft am 7. Nov. 2026
Der Registry-Name wurde mit dem GitHub-Konto pipeworx-io bestätigt, dem das Repo gehört
Dieses Repo haben wir noch nicht von GitHub gelesen
Dieses Repo haben wir noch nicht von GitHub gelesen
Antwort in 850 ms (HTTP 200)
Keine Anmeldung nötig
Wir haben 58 Tool-Beschreibungen gelesen und keine versteckten Anweisungen an die KI gefunden
Verglichen mit allen aktiven Servern dieser Kategorie in der Registry. Sterne zählen nur, wenn dem Herausgeber das Repo gehört.
Er hat 3 von 3 zutreffenden Basischecks bestanden. Den Code haben wir nicht gelesen. Bevor du einen Schlüssel oder Token hinzufügst, sieh nach, welche Zugriffe der Server verlangt, und nutze einen Schlüssel, der nur die Berechtigungen hat, die du brauchst.
Das musst du eintragen: PIPEWORX_API_KEY
Beides geht: Installiere ihn auf deinem Computer oder verbinde dich mit der Cloud-Version.
Das GitHub-Repo wurde zuletzt – geändert, und die neueste Version (0.2.1) kam vor 5 Tagen in die Registry.
Apps, die MCP unterstützen, etwa Claude Desktop, Claude Code, Cursor und VS Code. Er verbindet sich per URL, also funktionieren auch Apps, die Remote-MCP-Server akzeptieren, zum Beispiel ChatGPT im Entwicklermodus.
In derselben Kategorie: Spec Driven Development, Remote Desktop Commander, Python MCP
Server derselben Kategorie von anderen Entwicklern, sortiert nach Sternen.
So liest du eine Karte:★ GitHub-SterneiDrei Säulen: Bewertungen · Checks · NutzungiAktualisiert = neueste Version in der Registry veröffentlichti
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Local-only Python MCP server for the Files.com API.
Unverändert aus dem Repo des Entwicklers übernommen. PopNx MCP hat den Inhalt weder geprüft noch empfiehlt es ihn. HTML, Bilder und Skripte wurden entfernt. Links führen von dieser Website weg.
HackerTarget MCP — DNS and network-recon utilities. Eleven of the fourteen tools need no credential; three (whois, mtr, traceroute) require the caller's own HackerTarget key.
Part of Pipeworx — an MCP gateway connecting AI agents to 1865+ live data sources. This is an independent, unofficial integration — not affiliated with, endorsed by, or published by the upstream provider.
Responses are line-oriented plain text from upstream; this pack parses them into structured JSON when reasonable (lines[] plus the verbatim raw).
Keyless — call with just target:
dns_lookup(target) — A/AAAA/MX/NS/SOA records for a hostnamereverse_dns(target) — reverse DNS (PTR) for an IPnping(target) — ICMP ping from HackerTarget's probe hostdns_host_search(target) — passive DNS subdomain searchfind_shared_dns(target) — domains sharing the same nameservergeoip(target) — IP geolocation (country / region / city / coords)reverse_ip(target) — hostnames resolving to the same IPas_lookup(target) — ASN, announced prefix and network namehttp_headers(target) — HTTP response headers for a host or URLsubnet_lookup(target) — subnet arithmetic for a CIDR blockpage_links(target) — links extracted from one page (full URL)Require a caller-supplied key — call with target and _apiKey:
whois(target, _apiKey) — WHOIS record for a domain or IPmtr(target, _apiKey) — per-hop loss/latency reporttraceroute(target, _apiKey) — routers between HackerTarget and the targetPipeworx fronts no platform key for HackerTarget. The eleven keyless tools work with no credential at all; whois, mtr and traceroute are gated behind a HackerTarget membership and are bring-your-own-key (Bruce's ruling, fleet #2132, 2026-09-16).
Get a key from the HackerTarget member dashboard (https://hackertarget.com/ip-tools/) and pass it as _apiKey. It is forwarded as the apikey= query parameter HackerTarget documents.
A keyless call to one of the three gated tools is refused before any request leaves the gateway, with error: auth_required and a message saying the tool *requires an API key* and where to get one. It is not an outage and does not count as a tool failure. A key that is supplied and then rejected by HackerTarget gets a different auth_required message — "the key you supplied was refused" — so a caller who already holds a key is not sent to fetch it again.
Passing _apiKey to the eleven keyless tools is allowed and useful: it bills the call against the caller's own member quota instead of the shared free tier.
HackerTarget's free tier is 50 calls/day per source IP at up to 2 requests/s (their FAQ, re-read 2026-09-16 — older copies of this file said 100). That source IP is the gateway's shared egress, so an exhausted quota surfaces as an API count exceeded body rather than an HTTP 429. Pipeworx's own rate limit is the outer envelope. Callers who bring _apiKey draw on their own quota.
https://api.hackertarget.com — every tool in this packAdd to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):
{
"mcpServers": { "hackertarget": { "url": "https://gateway.pipeworx.io/hackertarget/mcp" } } }
tools/list at https://gateway.pipeworx.io/hackertarget/mcp returns the tools in the table above plus the shared Pipeworx meta-tools — ask_pipeworx, discover_tools, search_within, remember/recall and the rest of the gateway-wide set. So the tool count you see is larger than this table: a single-pack endpoint currently lists roughly 30 shared tools alongside the pack's own. The connection's initialize response states its exact scope, and is the authoritative answer for a given day.
This is deliberate, not multiplexing by accident. The meta-tools are what let a scoped connection answer a question this pack does not cover — via ask_pipeworx, which routes across the whole catalog — without you adding a second MCP server. There is currently no way to mount a pack endpoint without them; if the extra schemas cost you more context than the routing is worth, connect to the full gateway once rather than to several pack endpoints.
Or connect to the full Pipeworx gateway to get every pack's tools listed directly, instead of just this one's:
{
"mcpServers": { "pipeworx": { "url": "https://gateway.pipeworx.io/mcp" } } }
Both URLs reach the same gateway and the same 1865+ data sources. The only difference is which pack's tools are listed directly; ask_pipeworx reaches all of them from either one.
curl -X POST https://gateway.pipeworx.io/v1/tools/hackertarget_dns_lookup \
-H 'Content-Type: application/json' \ -d '{"target":"pipeworx.io"}'
No account needed for the first calls. Inspect any tool: GET https://gateway.pipeworx.io/v1/tools/hackertarget_dns_lookup. Find one: POST https://gateway.pipeworx.io/v1/tools/search_packs with {"query":"..."}.
@pipeworx/mcp-hackertarget is a local stdio bridge to the Pipeworx gateway: your MCP client starts it with npx, and it forwards every call to the same https://gateway.pipeworx.io/hackertarget/mcp endpoint shown above. It needs network access; there is no offline mode.
{
"mcpServers": { "hackertarget": { "command": "npx", "args": ["-y", "@pipeworx/mcp-hackertarget"] } } }
Without a key it calls anonymously, capped at 50 calls a day. A free account raises that to 200 a day: get a key at https://pipeworx.io/signup and add "env": { "PIPEWORX_API_KEY": " " } to the server entry. The key is sent as a Bearer token, the same way a hosted connection sends it, so calls are metered and billed exactly as they are there.
It lists only this pack's tools by default. Set PIPEWORX_META_TOOLS=1 to also list ask_pipeworx and the other gateway-wide tools.
Behind an HTTPS proxy: Node's built-in fetch does not read HTTPS_PROXY by default. Newer Node releases honour it when NODE_USE_ENV_PROXY=1 is set; check your Node version's documentation.
Instead of calling tools directly, you can ask questions in plain English — this works on the pack endpoint above as well as on the full gateway:
ask_pipeworx({ question: "your question about Hackertarget data" })
The gateway picks the right tool and fills the arguments automatically.
MIT