Every security tool. One connection.
Checking one indicator shouldn't mean five browser tabs, and your AI agent shouldn't need its own MCP server and API key for every tool. Connect your tools to Cyproxy once and your agent gets them all through one endpoint, with skills that guide the work and collections that keep what you find.
mcp.cyproxy.io/mcp
How it works.
One connection between every security tool you use and the AI agent you already have.
Sign in or add a key once for each tool, including your own OpenCTI or MISP.
No AI client?
Ask Cyproxy.
An AI analyst in your browser. It uses the tools you've connected, shows its evidence and saves what you find. In beta
- Investigates with your integrations. It picks the tools, checks each source and says which one each finding came from.
- Shows its work. The screenshot of the phishing page, the attack path mapped to ATT&CK, the trend as a chart.
- Keeps what you find. Ask it to save results to a collection and they're there next time, on any device and in any agent.
- Looks, doesn't touch. Tools that submit, change or delete anything are switched off for the Agent, and every lookup is in your audit log.
The integrations analysts
reach for first.
Reputation, abuse history, network context and threat intelligence, through the same link.
Liberty91
Threat events, the threat library and finished intelligence.
VirusTotal
File, URL, domain and IP reputation from 70+ engines.
AbuseIPDB
Abuse confidence score and report history for any IP.
Shodan
Open ports, services, vulnerabilities and hosting for any IP or domain.
Skills tell your agent
how to do the job.
Written methods and report templates for security work, kept in Cyproxy so every agent and every person on your team uses the same ones.
- 01
Kept in Cyproxy, not on each laptop
Skills live in your Cyproxy account instead of as files on each person's machine. There's nothing to install or keep up to date, and a new laptop has every skill straight away.
- 02
The same skills in every agent
Claude, ChatGPT, Cursor and the Cyproxy Agent all read skills through your one link. Switch agents, or use several, and the methods come with you.
- 03
One playbook for the whole team
On Teams, skills are switched on for the team, so every analyst follows the same method and reports come back in the same structure.
- 04
Methods for every role
Detection rules, vulnerability assessments, hunt hypotheses, actor profiles, tabletop exercises, executive briefs and more. Over 40 so far, most from Feedly's open CTI skills and prompt library.
- Summary and key judgements
- Aliases and attribution
- Targeting and victims
- TTPs mapped to ATT&CK
- Infrastructure
- Confidence and sources
For each part of
the security team.
Threat intelligence, SOC, vulnerability management, detection, red team and DevSecOps, and businesses without a security team.
Clear the queue faster →
SOC L1/L2: get a verdict on the indicator in an alert before you open a single portal.
Enrich a whole list at once →
CTI and IR: paste the hashes, domains and IPs from a report; get one enriched table back.
Profile an actor and pivot →
CTI and threat hunters: pull recent activity, TTPs and infrastructure, then pivot on what you find.
Work a reported email →
SOC and IR: check the sender infrastructure, links and attachment from a user-reported phish.
Safe to put in front
of your agent.
Your keys stay secure and every lookup is on record.
Encrypted per account, never shown to agents
Your API keys are encrypted to your account and added to each call inside Cyproxy. The agent only ever sees your Cyproxy link.
Official servers where they exist
Most integrations call the tool provider's own MCP server, so you get their data, limits and updates. Where a provider has no MCP server yet, Cyproxy runs an adapter on their API with your key.
Full audit log
Every tool call is logged with the user, the integration and tool, and the outcome. On Teams, what was looked up too. Search it in the console.
You decide what the agent can touch
Switch integrations, single tools and skills on or off, or pause every integration at once without losing your keys. Sign in with the tool provider where it supports OAuth, and protect your account with two-factor.
Start with Community. Upgrade when
it's part of your day.
Community is free, with five active integrations, five active skills, three active collections and 5 Agent credits a month. Pro removes the limits and adds Deep. Teams gives a security team one shared account, run by an admin.
For trying it on real alerts, and for good.
- + 5 active integrations
- + 5 active skills
- + 3 active collections
- + 1,000 tool credits / mo
- + 5 AI Agent credits / mo
- + 7-day audit log
- + Community support
For an analyst using it every day.
- + Unlimited integrations
- + Every skill
- + 10 collections
- + 25,000 tool credits / mo
- + 50 AI Agent credits / mo
- + 90-day audit log
- + Email support
- Only on Pro
- + Deep answers from our most capable AI
- + Unused Agent credits roll over a month
- + Tool credit top-ups
- + Bring your own skills Soon
For security teams sharing one Cyproxy. Minimum 3 users.
- + 3+ people
- + Every integration and skill
- + 10 collections per person, pooled
- + 1,000,000 tool credits / mo, shared
- + 50 AI Agent credits per person / mo, pooled
- + 365-day audit log
- + Shared keys, roles and admin control
- + Priority support
For large SOCs, MSSPs and regulated teams.
- + Unlimited people
- + Every integration and skill
- + Custom collections
- + 5,000,000+ tool credits / mo
- + Custom AI Agent credits
- + 365-day audit log
- + Shared keys, roles and admin control
- + Support with an SLA
- Only on Enterprise
- + DPA and security review
- + SSO and SCIM Planned
- + Audit export to your SIEM Planned
Questions, answered.
01Do you see my data?+
02Who hosts the tools?+
03What counts as a credit?+
04Which agents work?+
05Do I need my own account with each tool?+
06What are skills?+
07Can a skill change, or run code?+
Your whole security stack. One connection.
// connect your first integration in minutes, free