English version: README.md.

A tool provided by Qianxin X-Lab for querying basic cybersecurity data.

Introduction to X-Lab

X-Lab (XLab) is a team at Qianxin dedicated to large-scale network security research, threat analysis and tracing, and the construction of large-scale, multi-dimensional security data platforms. X-Lab was one of the first teams in China to use large-scale data for security research, security applications, and threat intelligence production. It has established China's first PassiveDNS system, as well as several leading foundational data systems for Netflow, Whois, certificates, IPs, and malicious samples.

Tool Categories

fdp-mcp-server provides different types of tools. When using them, you can choose different URLs to load various types of tools based on your needs.

Currently available tools include:

1. Basic Cybersecurity Data Query: https://fdp.qianxin.com/mcp/v1/basic/mcp/. Tools included:
   • flint rrset: Used to query the resource record set (RRset) for a specific domain name and record type.
   • flint rdata: Used to reverse-query the DNS response's RRset records.
   • whois history: Queries the registration history information for a domain or IP.
   • certdb domain: Queries domain certificate information through a domain name.
   • ioc: Queries the X-Lab IOC database.
2. Domain-Related Basic Data Query: https://fdp.qianxin.com/mcp/v1/domain/mcp/. Tools included:
   • codomain: Companion domains of a domain and their tag data.
   • float_fqdn: A ranking of domain popularity calculated from PassiveDNS data.
   • webdb: Queries web content associated with a domain.
   • libra: Queries data from the X-Lab domain analysis system.
3. IP-Related Basic Data Query: https://fdp.qianxin.com/mcp/v1/ip/mcp/. Tools included:
   • ip_geo: Queries IPv4 geographical location, ASN, IP owner, and other information.
4. Sample-Related Basic Data Query: https://fdp.qianxin.com/mcp/v1/sample/mcp/. Tools included:
   • sandbox: Queries summary information about sample network behavior.

Operation Methods

Instructions

1. This application is a proxy program that can convert calls to remote MCP tools into local Stdio operations. Therefore, the operation methods can be divided into local execution and direct access to the remote MCP tool URL.
2. The remote MCP server URL currently only supports Streamable HTTP access.
3. The current toolset is a trial version for basic security data queries. Under high concurrency, the backend will limit the frequency of network access. For high-frequency scenarios, please use the official version.
4. To access the official version, directly use the corresponding tool's URL. You need to provide the fdp-access and fdp-secret HTTP headers.
   • To obtain access credentials, please contact Qianxin X-Lab.
5. The following examples are based on Basic Cybersecurity Data Query.

Trial Version Usage

Local Code Execution

1. Clone the code from the repository.
2. Use uv to run, configure Claude Desktop:
   json
   {
   "mcpServers": {
   "fdp-mcp-server": {
   "command": "uv",
   "args": [
   "run",
   "--project",
   "/PATH/TO/fdp-mcp-server",
   "fdp-mcp-server",
   "--url",
   "https://fdp.qianxin.com/mcp/v1/basic/mcp/"
   ]
   }
   }
   }

Docker Image Execution

1. Clone the code from the repository.
2. Build the Docker image: docker build . -t fdp-mcp-server:vxx.xx.xx
3. Configure Claude Desktop:
   json
   {
   "mcpServers": {
   "fdp-mcp-server": {
   "command": "docker",
   "args": [
   "run",
   "-i",
   "--rm",
   "fdp-mcp-server:vxx.xx.xx"
   ]
   }
   }
   }

Local Execution with PyPI Package

Use uvx, configure Claude Desktop:
json
{
"mcpServers": {
"fdp-mcp-server": {
"command": "uvx",
"args": [
"fdp-mcp-server",
"--url",
"https://fdp.qianxin.com/mcp/v1/basic/mcp/"
]
}
}
}

Official Version UsageIf you want to call the fdp-mcp-server tool in an agent application, you can configure the URL of the remote MCP server on the client and directly invoke the tool. You also need to provide the dp-access and fdp-secret HTTP headers.

1. When writing agent code, add fdp-access and fdp-secret to the HTTP headers when calling the MCP tool. Here is an example using smolagents:

   python
   from smolagents import ToolCollection
   from smolagents.agents import ToolCallingAgent
   from smolagents.models import OpenAIServerModel

   def main():
   with ToolCollection.from_mcp(
   {
   "url": "https://fdp.qianxin.com/mcp/v1/domain/mcp/",
   "transport": "streamable-http",
   "headers": {
   "fdp-access": "xxxx",
   "fdp-secret": "yyyy",
   },
   },
   trust_remote_code=True,
   ) as tools:
   agent = ToolCallingAgent(
   tools=[*tools.tools],
   model=OpenAIServerModel(
   model_id="YOUR-LLM-MODEL-ID",
   api_base="YOUR-LLM-MODEL-API-URL",
   api_key="YOUR-LLM-MODEL-API-KEY",
   ),
   )
   agent.run("查询www.example.com的关联域名，并给根据关联域名的数据对查询的域名可能的业务做一个判断。")

   if name == "main":
   main()

2. If you are using it on Claude Desktop, you can use the mcp-remote library for proxy forwarding. During the forwarding process, configure the HTTP headers as follows:

   json
   {
   "mcpServers": {
   "fdp_domain": {
   "command": "npx",
   "args": [
   "-y",
   "mcp-remote@latest",
   "https://fdp.qianxin.com/mcp/v1/domain/mcp/",
   "--header",
   "fdp-access:xxxx",
   "--header",
   "fdp-secret:yyyy"
   ]
   }
   }
   }