プロトタイプ · プレビュー版:公式レジストリのすべてのサーバーを掲載し、30分ごとに同期しています。レビューとアカウント機能は今後のステップで始まります。
PopNx MCPAIを使う人のためのMCPサーバー · やさしい言葉で解説

Hackertarget

作者:pipeworx-ioバージョン 0.2.1i★ –iパソコンでもクラウドでも
レジストリ名io.github.pipeworx-io/hackertarget

インストール

概要

作者による説明(英語の原文)

HackerTarget MCP.

PopNx MCPの3つの柱

この3つを1つのスコアにまとめることはしません。意見、測定、人気はそれぞれ別のものだからです。

できること

このサーバーのやさしい解説はまだ書いていません。以下はレジストリから読み取った事実です。

  • 接続方法: パソコンでもクラウドでも
  • トランスポート: stdio, Streamable HTTP
  • カテゴリ: その他
  • 入力が必要なもの:PIPEWORX_API_KEY

インストール

使っているAIアプリを選んで、設定をコピーしてください。

インストールの前に

「秘密」と表示された値は、あなたのアカウントの鍵です。絶対に人に教えたり、チャットに貼り付けたりしないでください。

必要なもの

  • クラウドで動くインストール不要。インターネット経由でつながります
  • npmNode.jsのインストール(npxコマンドに必要)

どのアプリを使っていますか?

上でアプリを選んでください。選んだアプリを覚えておくので、次からはボタンに「…にインストール」と表示されます。

ウェブ、デスクトップ、モバイルのClaudeで使えます:

  1. Settings → Connectors を開く
  2. Add custom connector を押す
  3. 下のアドレスを貼り付けて Add を押す
  4. サインインを求められたら、作者のサービスにサインインする
SettingsConnectors1+ Add2https://…3
https://gateway.pipeworx.io/hackertarget/mcp

または、パソコンで動かす

Claude Desktop → Settings → Developer → Edit Config を開き、claude_desktop_config.json にこれを貼り付けます

{
  "mcpServers": {
    "hackertarget": {
      "command": "npx",
      "args": [
        "-y",
        "@pipeworx/mcp-hackertarget"
      ],
      "env": {
        "PIPEWORX_API_KEY": "your-value"
      }
    }
  }
}

ターミナルでこれを実行します

claude mcp add --transport http hackertarget https://gateway.pipeworx.io/hackertarget/mcp

または、パソコンで動かす

claude mcp add hackertarget --env PIPEWORX_API_KEY=your-value -- npx -y @pipeworx/mcp-hackertarget

動かす前に、空欄の値を入力してください。

Cursorで開く

または、設定を自分でコピーする

プロジェクトの .cursor/mcp.json、または ~/.cursor/mcp.json に貼り付けます

{
  "mcpServers": {
    "hackertarget": {
      "url": "https://gateway.pipeworx.io/hackertarget/mcp"
    }
  }
}

または、パソコンで動かす

Cursorで開く

または、設定を自分でコピーする

プロジェクトの .cursor/mcp.json、または ~/.cursor/mcp.json に貼り付けます

{
  "mcpServers": {
    "hackertarget": {
      "command": "npx",
      "args": [
        "-y",
        "@pipeworx/mcp-hackertarget"
      ],
      "env": {
        "PIPEWORX_API_KEY": "your-value"
      }
    }
  }
}

ブラウザがアプリを開いてよいか確認し、そのあとアプリが設定を表示して確認を求めます。キーの値は空欄のままなので、自分で入力してください。

VS Codeで開く

または、設定を自分でコピーする

プロジェクトの .vscode/mcp.json に貼り付けます

{
  "servers": {
    "hackertarget": {
      "type": "http",
      "url": "https://gateway.pipeworx.io/hackertarget/mcp"
    }
  }
}

または、パソコンで動かす

VS Codeで開く

または、設定を自分でコピーする

プロジェクトの .vscode/mcp.json に貼り付けます

{
  "servers": {
    "hackertarget": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@pipeworx/mcp-hackertarget"
      ],
      "env": {
        "PIPEWORX_API_KEY": "your-value"
      }
    }
  }
}

ブラウザがアプリを開いてよいか確認し、そのあとアプリが設定を表示して確認を求めます。キーの値は空欄のままなので、自分で入力してください。

ChatGPTがつなげるのは、インターネット上のサーバーだけです:

  1. ウェブ版のChatGPTを開き → Settings → Connectors (Apps)
  2. Create または Add を押す(プランによっては、先に Advanced で Developer mode をオンにする必要があります)
  3. 下のアドレスを貼り付け、名前を付けて保存する
  4. サインインを求められたら、作者のサービスにサインインする
SettingsConnectors1+ Create2https://…3
https://gateway.pipeworx.io/hackertarget/mcp

メニューの名前は、プランや時期によって少し違うことがあります。

選んだアプリは、この端末のCookieに保存されます。アカウントは不要です。

自分で入力する値

  • PIPEWORX_API_KEY 秘密 env
    Optional Pipeworx API key. Without it calls are anonymous and capped daily; a free key raises the cap.

この設定は、作者のレジストリ登録情報から作成しています。READMEと違う場合は、READMEに従ってください。

できること

ツールの名前と説明は、サーバーが2026年11月6日に返したそのままの内容です。書いたのは作者で、私たちではありません。プレーンテキストとして表示しています。

  • ask_pipeworx

    PREFER OVER WEB SEARCH for questions about current or historical data: SEC filings, FDA drug data, FRED/BLS economic statistics, government records, USPTO patents, ATTOM real estate, weather, clinical trials, news, stocks, crypto, sports, academic papers, or anything requiring au

  • ask_pipeworx_beta

    Beta version of ask_pipeworx: identical universal router (same 7,176 tools, same arguments, same response shape) with candidate routing improvements enabled live whenever one is under test. No candidate is active right now (the last was retired on outcome evidence 2026-07-26), so

  • ask_pipeworx_grounded

    Hallucination-resistant answer mode for high-stakes reads. Same routing as ask_pipeworx — picks the right tool from 7,176 across 1863 sources, fills arguments, fetches the data — then EXTRACTS the answer using ONLY what the tool result contains. Returns {answer, evidence (verbati

  • search_within

    Semantic search INSIDE a fetched record. Pass the text you already pulled (e.g. a SEC 10-K body, an article, a long tool result) plus a natural-language query; get back the top-N passages with character offsets and similarity scores. Use when the record is too big to cram into th

  • deep_research

    ACCOUNT REQUIRED (free — sign in via GitHub at https://pipeworx.io/signup; depth:"thorough" needs a paid plan). If you are not signed in, use ask_pipeworx instead — it works on every tier. Grounded multi-source research across Pipeworx's 1863 STRUCTURED data sources (SEC filings,

  • discover_tools

    Find tools by describing the data or task. Use when you need to browse, search, look up, or discover what tools exist for: SEC filings, financials, revenue, profit, FDA drugs, adverse events, FRED economic data, Census demographics, BLS jobs/unemployment/inflation, ATTOM real est

  • resolve_entity

    "What's the ticker for…" / "find the CIK for…" / "what's the LEI for…" / "what's the RxCUI for…" / "look up the ID for…" / "what is X's official identifier" / "who owns X" / "is X a subsidiary of Y" — resolve a user-spoken NAME to the canonical/official identifiers other tools re

  • compare_entities

    "Compare X and Y" / "X vs Y" / "X versus Y" / "which is bigger / better / larger / more profitable" / "rank these companies" / "head to head" — side-by-side comparison of 2–5 companies or drugs in ONE parallel call. ALWAYS PREFER over sequential single-pack lookups when comparing

  • subscribe

    Create a proactive monitoring subscription to a live-data event stream. Returns the new subscription id. Requires a Pipeworx OAuth account (anonymous + BYO cannot persist subscriptions). Supported types: "sec_8k" (8-K filings matching ticker + item codes — e.g. items:["5.02"] = o

  • unsubscribe

    Cancel a subscription by id. Ownership is enforced — you can only cancel your own subscriptions. The row is deactivated (not deleted) so its historical events stay available via recent_alerts.

  • list_subscriptions

    List the caller's active subscriptions. Returns id, type, params, created_at, last_fired_at, fire_count for each. Use this to review what you're monitoring before adding more or to find an id to cancel.

  • recent_alerts

    Pull fired events from your subscription feed. Returns the most recent alerts the evaluator has written to your persisted feed — each carries source, citation_uri (pipeworx:// when available), and the raw event payload. Filter by type (e.g. "sec_8k") and/or since (ISO timestamp).

  • entity_profile

    "Tell me about X" / "research Acme" / "brief me on Tesla" / "what does Apple do" / "company profile for Microsoft" / "give me the rundown on NVDA" / "everything you know about $TICKER" — full cross-source profile of a US public company in ONE parallel call. ALWAYS PREFER over cha

  • recent_changes

    "What's new with X" / "latest on Y" / "what happened to Z this week / month / quarter" / "updates on Acme" / "news on Tesla recently" / "what's happening with Apple" — change feed for a company in the last N days/weeks/months in ONE parallel call. Fans out to SEC EDGAR (filings s

  • validate_claim

    "Is it true that…" / "fact check" / "verify the claim that…" / "did X really…" / "was Y actually…" / "confirm or refute" / "true or false" — natural-language claim verification against authoritative sources. Use whenever the agent needs to check whether something a user said is f

  • company_facts

    TYPED, DETERMINISTIC financial facts for a US public company for an EXPLICITLY NAMED reporting period — "Apple revenue for fiscal 2023", "Walmart net income FY2026 Q3", "Microsoft cash at the end of fiscal 2024". PREFER OVER entity_profile / get_company_financials whenever the pe

  • company_register_search

    Search the NATIONAL BUSINESS REGISTERS by company name and get the register's own id back — a Companies House number, a Norwegian organisasjonsnummer, a Finnish business id, a SIREN, a Japanese corporate number, an Estonian registry code, a CNPJ, or an LEI. Use this when you want

  • scan_dependency

    Composite "should I add this npm package to my project" check in ONE call — fans out across deps.dev (license + advisories + version history) and bundlephobia (gzipped/minified bundle size, dependency count, ESM/tree-shake support). Use whenever an agent asks "is X safe / popular

  • bet_research

    Research a Polymarket bet by pulling the relevant Pipeworx data for it in one call. Pass a market slug ("will-kristi-noem-win-the-2028-republican-presidential-nomination"), a polymarket.com URL, or a question text. A dated slug ("...-by-june-30-2026") still resolves after it sett

  • polymarket_arbitrage

    Find arbitrage opportunities on Polymarket via monotonicity violations + partition-sum checks. Call with NO args for a `trending_scan` of the top ~200 markets by weekly volume; pass `event` for the strongest per-event partition_check, or `topic` for a themed cross-event scan. `ev

  • polymarket_edges

    Scan top Polymarket markets and return opportunities where Pipeworx data disagrees with market price. Built for "what should I bet on today" — agents discover opportunities without paging hundreds of markets. FIVE MODEL FAMILIES grouped into three response segments under by_segme

  • polymarket_kalshi_spread

    Cross-venue spread between Kalshi and Polymarket for the same resolving question. The two venues sometimes price the same outcome 2-25pp apart because their participant pools differ — when the bet shapes are equivalent that delta is a real signal, when they aren't the tool says s

  • polymarket_fill_risk

    Realizable-vs-theoretical edge check against live CLOB order-book depth — AND Polymarket's own taker fee, which is never zero and is folded in rather than left for you to add (fleet #3446: r/PredictionsMarkets flagged a "clean" fill that quietly omitted it as optimistic in the di

  • polymarket_edge_tracker

    Edge persistence and decay telemetry built from daily polymarket_edges snapshots. Answers "how long has this edge existed and is it shrinking?" — a fresh wide edge and a 3-week-old wide edge are different trades (the latter is wide for a reason nobody is willing to take). Args: d

  • kalshi_weather_edge

    Prices Kalshi daily high-temperature markets against the NWS forecast for the market's OWN settlement station, and measures whether that forecast actually beats the market. Two modes. LIVE (default): returns the full strike ladder for one city and settlement date with market_prob

  • resolution_audit

    Extract the settlement clause of a single Polymarket (.com or .us) or Kalshi market: who publishes the settling number (source), the clock time + timezone it is taken at (falling back to the market TITLE when the clause itself says "the time range specified in the title" — e.g. P

  • resolution_diff

    Field-by-field diff of TWO markets' settlement clauses (one from each of `a` and `b`; either can be Polymarket .com, Polymarket US, or Kalshi) — runs resolution_audit on both sides and compares source, settle time, precision, comparison_basis, and evidence standard. Returns `equi

  • release_calendar_markets

    JOIN of the official release calendar (econ data, the FOMC, FDA decisions, SEC rules) against LIVE Polymarket/Kalshi markets — which scheduled releases land in the next N hours, and which live markets resolve on them. This is a POSITIONING tool, not a speed product: results are c

  • prediction_calibration

    REALIZED win rate by shown price and minutes elapsed for short-horizon crypto up/down markets, net of taker fee — read from our own settled-outcomes archive, not from live prices. Answers the one question no venue will: "a side shown at 82 with five minutes left, how often did it

  • updown_venue_compare

    The same 15-minute crypto "up or down" window priced on polymarket.com, Polymarket US and Kalshi, side by side, with whether each pair is actually the same contract. Pass asset (btc | eth | sol | xrp | bnb) and window ("current" default, "next", "previous", or the window START as

  • updown_divergence_rate

    How often two venues settled the SAME 15-minute crypto window differently, over every settled window on record. Compares polymarket.com (Chainlink TWAP) with Kalshi and with Polymarket US (both CF Benchmarks BRTI), and Kalshi with Polymarket US as the same-feed control. Per pair:

  • archive_evidence

    What did a web page say on a given date? Finds the archived capture of a URL nearest that date across the Internet Archive Wayback Machine, Common Crawl and Arquivo.pt, reads it, and returns the readable text (HTML stripped) with the capture timestamp, a link to the archived copy

  • archive_compare

    What changed on a web page between two dates? Resolves the archived capture nearest each date (Internet Archive Wayback Machine, Common Crawl, Arquivo.pt), extracts the readable text of both, and returns a text-level diff: the segments removed and added, a similarity score, and b

  • research_row

    Claygent-style per-row research: answer ONE question about ONE company and return a JSON object matching your output_schema, with every field wrapped in its own evidence — {value, evidence_url, quote, status}. status is NEVER self-reported by the model: "found" means this code in

  • classify_row

    Cheap categorization: given a company and a list of candidate labels, decide which labels apply — the most common GTM/AI usage shape (tagging a list by industry, ICP fit, etc.), one small model call. Same evidence contract as research_row: each label comes back {label, applies, e

  • pipeworx_trending

    What other AI agents are calling on Pipeworx right now. Returns the top tools, top packs, and total call volume over a recent window (24h, 7d, or 30d). Useful for: (1) discovering what data sources are hot for current events, (2) confirming a popular tool is the canonical choice

  • suggest_questions

    What can I ask Pipeworx? / what is Pipeworx good for? / what can you do? / give me ideas / show me examples / getting started / what data do you have? — the onboarding entry point for an agent that just connected and wants to know what is worth asking. Returns category-bucketed e

  • generate_llms_txt

    Generate a production-ready llms.txt file for any URL so AI crawlers (ChatGPT, Claude, Perplexity) can index the site cleanly. Fetches the page, extracts title/description/key links, and emits the standard llms.txt markdown format. Output is a single text blob ready to drop at si

  • ai_visibility_check

    Probe one or more LLMs for what they know about a business / brand / product / topic and score visibility (0-100) per model. Default model is Workers AI Llama-3.3-70b (free); pass `_apiKey` to also probe Anthropic (BYO key — you pay Anthropic directly for those calls). Returns pe

  • scan_competitor_ai_presence

    Compare AI visibility across multiple entities side-by-side. Probes each entity (your brand + N competitors) with ai_visibility_check, ranks by score, surfaces which is most/least recognized. Useful for competitive AI-marketing audits: "does Claude know about us as well as our co

  • pipeworx_feedback

    Tell the Pipeworx team something is broken, missing, or needs to exist. Use when a tool returns wrong/stale data (bug), when a tool you wish existed isn't in the catalog (feature/data_gap), or when something worked surprisingly well (praise). ONLY for tools served by this Pipewor

  • remember

    Save data the agent will need to reuse later — across this conversation or across sessions. Use when you discover something worth carrying forward (a resolved ticker, a target address, a user preference, a research subject) so you don't have to look it up again. Stored as a key-v

  • recall

    Retrieve a value previously saved via remember, or list all saved keys (omit the key argument). Use to look up context the agent stored earlier — the user's target ticker, an address, prior research notes — without re-deriving it from scratch. Scoped to your identifier (anonymous

  • forget

    Delete a previously stored memory by key. Use when context is stale, the task is done, or you want to clear sensitive data the agent saved earlier. Pair with remember and recall.

  • dns_lookup

    "Resolve [domain]" / "what IP does [site] point at" / "A records for [X]" — forward DNS lookup via HackerTarget, returning the A/AAAA/MX/NS/SOA records the resolver holds for a hostname. Use to check where a domain currently points, or to confirm a DNS change has propagated.

  • reverse_dns

    "What hostname is [IP]" / "reverse DNS for [address]" / "PTR record lookup" — reverse DNS (PTR) lookup via HackerTarget, mapping an IP address back to the hostname its owner published. Use to identify the operator behind an address in a log line. Returns nothing when no PTR recor

  • mtr

    "Network path to [host]" / "where does traffic to [X] slow down" / "per-hop latency" — mtr report via HackerTarget, combining traceroute and ping into a per-hop table of loss and latency measured FROM HackerTarget's probe host, not from you. Use to see which network hop is losing

  • nping

    "Is [host] up" / "ping [X]" / "round-trip time to [address]" — ICMP ping via HackerTarget, reporting reachability and round-trip time from HackerTarget's probe host. Use for a liveness check when you cannot ping from where you are. A host that blocks ICMP reads as down even when

  • dns_host_search

    "Subdomains of [domain]" / "what hosts exist under [X]" / "find an admin or staging subdomain" — passive DNS host search via HackerTarget, listing known subdomains of a domain with their IPs, drawn from previously observed DNS data rather than by guessing names. Use for attack-su

  • find_shared_dns

    "What else uses this nameserver" / "domains sharing DNS with [X]" — shared-nameserver search via HackerTarget, listing other domains served by the same DNS server. Use to map the infrastructure footprint of an operator, or to see who else would be affected if a nameserver went do

  • geoip

    "Where is [IP] located" / "what country is this address in" / "geolocate an IP" — IP geolocation via HackerTarget, returning country, state/region, city and coordinates for an address. City-level accuracy is approximate and a VPN or CDN address reports its datacenter, not its use

  • reverse_ip

    "What else is hosted on [IP]" / "other sites on the same server" / "reverse IP lookup" — reverse IP lookup via HackerTarget, listing hostnames known to resolve to one address. Use to spot shared hosting or to find sibling properties of an operator. A CDN address returns many unre

  • as_lookup

    "Which ASN owns [IP]" / "what network is this address on" / "who is the upstream provider" — autonomous system lookup via HackerTarget, returning the ASN, the announced prefix and the network's name for an address. Use to attribute an address to a hosting provider, ISP or cloud r

  • whois

    "Who owns [domain]" / "when does [X] expire" / "whois lookup" / "registrar for [site]" — WHOIS record via HackerTarget for a domain or IP: registrar, creation and expiry dates, nameservers, and whatever contact fields the registry still publishes. REQUIRES AN API KEY: HackerTarge

  • http_headers

    "What headers does [site] return" / "what server runs [X]" / "check the security headers" / "does [site] redirect" — HTTP response headers fetched by HackerTarget, including status line, Server, redirect Location, and security headers such as HSTS and CSP. Use to fingerprint a st

  • traceroute

    "Traceroute to [host]" / "what route does traffic take to [X]" / "how many hops to [address]" — traceroute via HackerTarget, listing the routers between HackerTarget's probe host and the target. The path is measured from their network, not yours. REQUIRES AN API KEY: HackerTarget

  • subnet_lookup

    "What is the range of [CIDR]" / "how many hosts in a /24" / "network and broadcast address for [X]" / "subnet calculator" — subnet arithmetic via HackerTarget, returning network address, broadcast address, usable host range, netmask and host count for a CIDR block. A pure calcula

  • page_links

    "What does [page] link to" / "extract every link from [URL]" / "outbound links on a page" — link extraction via HackerTarget, fetching one web page and returning the URLs it links to. Use to map a site section or find outbound references. One page only — it does not crawl, and it

基本チェックi

誰でも見られる情報をチェックしており、コードは読んでいません。当てはまらない項目は数に入れていません。 · 2026年11月6日にチェック

  • ✓ 合格

    作者とリポジトリが一致

    レジストリ名は、リポジトリを所有するGitHubアカウント pipeworx-io で確認済みです

  • … 未チェック

    今もメンテナンスされている

    このリポジトリはまだGitHubから読み取っていません

  • … 未チェック

    ライセンスがある

    このリポジトリはまだGitHubから読み取っていません

  • ✓ 合格

    エンドポイントが応答する

    850ミリ秒で応答(HTTP 200)

  • – 対象外

    OAuthでサインイン

    サインイン不要

  • ✓ 合格

    ツールの説明に隠れた指示がない

    58件のツールの説明を読み、AIへの隠れた指示は見つかりませんでした

その他のほかのサーバーとの比較i

  • このカテゴリのほかの32505件のうち0%よりスターが多い
  • このカテゴリのほかの32505件のうち87%より最近レジストリに公開
  • 基本チェックの結果が、このカテゴリのほかの32505件のうち100%と同じかそれ以上

レジストリでこのカテゴリにある有効なすべてのサーバーと比較しています。スターは、公開者がリポジトリの所有者である場合だけ数えます。

よくある質問

Hackertargetは安全ですか?

当てはまる基本チェック3項目のうち3項目に合格しました。コードは読んでいません。キーやトークンを追加する前に、サーバーがどんなアクセスを求めているかを確認し、必要な権限だけを持つキーを使ってください。

どんなキーやコードが必要ですか?

入力が必要なもの:PIPEWORX_API_KEY

パソコンで動きますか、それともクラウドですか?

どちらでも使えます。パソコンにインストールしても、クラウド版につないでもかまいません。

今もメンテナンスされていますか?

GitHubリポジトリの最終更新は–、最新バージョン(0.2.1)がレジストリに届いたのは5 日前です。

どのアプリで使えますか?

Claude Desktop、Claude Code、Cursor、VS CodeなどのMCP対応アプリで使えます。URLでつながるので、リモートMCPサーバーに対応したアプリ(開発者モードのChatGPTなど)でも使えます。

代わりに使えるものは?

同じカテゴリには:Spec Driven Development, Remote Desktop Commander, topo^alpin

代わりの候補

同じカテゴリで、ほかの作者が作ったサーバー。スターの多い順。

カードの見方:★ GitHubスターi3つの柱:レビュー · チェック · 利用状況i更新=最新バージョンをレジストリに公開した日i

Remote Desktop Commander

作者:desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

クラウドで動く★ 211昨日更新
インストール

topo^alpin

作者:topoalpin.app

Avalanche bulletins and mountain weather forecasts for any place in the Alps.

クラウドで動く今日更新
インストール

作者のREADME

READMEを開く

作者のリポジトリから書かれたとおりにコピーしたものです。PopNx MCPは内容を確認・推奨していません。HTML、画像、スクリプトは取り除いています。リンクはこのサイトの外へ移動します。

@pipeworx/hackertarget

HackerTarget MCP — DNS and network-recon utilities. Eleven of the fourteen tools need no credential; three (whois, mtr, traceroute) require the caller's own HackerTarget key.

Part of Pipeworx — an MCP gateway connecting AI agents to 1865+ live data sources. This is an independent, unofficial integration — not affiliated with, endorsed by, or published by the upstream provider.

Responses are line-oriented plain text from upstream; this pack parses them into structured JSON when reasonable (lines[] plus the verbatim raw).

Tools

Keyless — call with just target:

  • dns_lookup(target) — A/AAAA/MX/NS/SOA records for a hostname
  • reverse_dns(target) — reverse DNS (PTR) for an IP
  • nping(target) — ICMP ping from HackerTarget's probe host
  • dns_host_search(target) — passive DNS subdomain search
  • find_shared_dns(target) — domains sharing the same nameserver
  • geoip(target) — IP geolocation (country / region / city / coords)
  • reverse_ip(target) — hostnames resolving to the same IP
  • as_lookup(target) — ASN, announced prefix and network name
  • http_headers(target) — HTTP response headers for a host or URL
  • subnet_lookup(target) — subnet arithmetic for a CIDR block
  • page_links(target) — links extracted from one page (full URL)

Require a caller-supplied key — call with target and _apiKey:

  • whois(target, _apiKey) — WHOIS record for a domain or IP
  • mtr(target, _apiKey) — per-hop loss/latency report
  • traceroute(target, _apiKey) — routers between HackerTarget and the target

Auth

Pipeworx fronts no platform key for HackerTarget. The eleven keyless tools work with no credential at all; whois, mtr and traceroute are gated behind a HackerTarget membership and are bring-your-own-key (Bruce's ruling, fleet #2132, 2026-09-16).

Get a key from the HackerTarget member dashboard (https://hackertarget.com/ip-tools/) and pass it as _apiKey. It is forwarded as the apikey= query parameter HackerTarget documents.

A keyless call to one of the three gated tools is refused before any request leaves the gateway, with error: auth_required and a message saying the tool *requires an API key* and where to get one. It is not an outage and does not count as a tool failure. A key that is supplied and then rejected by HackerTarget gets a different auth_required message — "the key you supplied was refused" — so a caller who already holds a key is not sent to fetch it again.

Passing _apiKey to the eleven keyless tools is allowed and useful: it bills the call against the caller's own member quota instead of the shared free tier.

Rate limits

HackerTarget's free tier is 50 calls/day per source IP at up to 2 requests/s (their FAQ, re-read 2026-09-16 — older copies of this file said 100). That source IP is the gateway's shared egress, so an exhausted quota surfaces as an API count exceeded body rather than an HTTP 429. Pipeworx's own rate limit is the outer envelope. Callers who bring _apiKey draw on their own quota.

Data sources

Quick Start

Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):

{

"mcpServers": { "hackertarget": { "url": "https://gateway.pipeworx.io/hackertarget/mcp" } } }

What this endpoint actually serves

tools/list at https://gateway.pipeworx.io/hackertarget/mcp returns the tools in the table above plus the shared Pipeworx meta-tools — ask_pipeworx, discover_tools, search_within, remember/recall and the rest of the gateway-wide set. So the tool count you see is larger than this table: a single-pack endpoint currently lists roughly 30 shared tools alongside the pack's own. The connection's initialize response states its exact scope, and is the authoritative answer for a given day.

This is deliberate, not multiplexing by accident. The meta-tools are what let a scoped connection answer a question this pack does not cover — via ask_pipeworx, which routes across the whole catalog — without you adding a second MCP server. There is currently no way to mount a pack endpoint without them; if the extra schemas cost you more context than the routing is worth, connect to the full gateway once rather than to several pack endpoints.

Or connect to the full Pipeworx gateway to get every pack's tools listed directly, instead of just this one's:

{

"mcpServers": { "pipeworx": { "url": "https://gateway.pipeworx.io/mcp" } } }

Both URLs reach the same gateway and the same 1865+ data sources. The only difference is which pack's tools are listed directly; ask_pipeworx reaches all of them from either one.

No MCP client? Call it over HTTP

curl -X POST https://gateway.pipeworx.io/v1/tools/hackertarget_dns_lookup \

-H 'Content-Type: application/json' \ -d '{"target":"pipeworx.io"}'

No account needed for the first calls. Inspect any tool: GET https://gateway.pipeworx.io/v1/tools/hackertarget_dns_lookup. Find one: POST https://gateway.pipeworx.io/v1/tools/search_packs with {"query":"..."}.

Run it from npm

@pipeworx/mcp-hackertarget is a local stdio bridge to the Pipeworx gateway: your MCP client starts it with npx, and it forwards every call to the same https://gateway.pipeworx.io/hackertarget/mcp endpoint shown above. It needs network access; there is no offline mode.

{

"mcpServers": { "hackertarget": { "command": "npx", "args": ["-y", "@pipeworx/mcp-hackertarget"] } } }

Without a key it calls anonymously, capped at 50 calls a day. A free account raises that to 200 a day: get a key at https://pipeworx.io/signup and add "env": { "PIPEWORX_API_KEY": " " } to the server entry. The key is sent as a Bearer token, the same way a hosted connection sends it, so calls are metered and billed exactly as they are there.

It lists only this pack's tools by default. Set PIPEWORX_META_TOOLS=1 to also list ask_pipeworx and the other gateway-wide tools.

Behind an HTTPS proxy: Node's built-in fetch does not read HTTPS_PROXY by default. Newer Node releases honour it when NODE_USE_ENV_PROXY=1 is set; check your Node version's documentation.

Using with ask_pipeworx

Instead of calling tools directly, you can ask questions in plain English — this works on the pack endpoint above as well as on the full gateway:

ask_pipeworx({ question: "your question about Hackertarget data" })

The gateway picks the right tool and fills the arguments automatically.

More

License

MIT

PopNxに聞く