# Censys MCP connector

The Censys connector lets Claude, ChatGPT, Cursor and other AI clients look up hosts, certificates, web properties and DNS records in Censys through one governed Elaichi endpoint, with every call logged under the person who made it.

Source: https://elaichi.ai/connectors/censys/

## Facts

| | |
| --- | --- |
| Application | Censys |
| Category | Security |
| AI tools | 47 |
| Authentication | Connects with an API key |
| Needs your own OAuth app | No |
| MCP endpoint | https://api.elaichi.ai/mcp |
| Works with | Claude, ChatGPT, Cursor, any MCP client, and the Elaichi Agent |
| Tools advertised by name | No. 47 tools is past the 30-tool threshold, so clients use `search_tools` and `execute_tool` |

## What you can ask once Censys is connected

- Show new Censys hosts added in the last week.
- Which Censys certificates expire in the next 30 days?
- List web properties on our Censys perimeter by team.

## Connect Censys in Elaichi

This happens once for the organization, before any client is involved.

1. Open Connections, choose Add connection, and pick Censys.
2. Optionally set Share with, then press Connect.
3. Paste a Censys API key. One person generates a token in Censys and pastes it once. Everyone else works through Share with, and never sees it.

Credentials are vaulted and nobody, including the AI, reads them back. The connection becomes a toolbox immediately, so you can curate which Censys tools are exposed, rename them, or freeze arguments before anyone points a client at it.

## Connect Censys to Claude

Endpoint: https://api.elaichi.ai/mcp

1. Open Customize, then Connectors.
2. Press Add.
3. Name it, paste the MCP server URL, then Continue.
4. Sign in and approve.

On Team and Enterprise, an Owner adds it once. Everyone else turns it on for themselves.

## Connect Censys to ChatGPT

Endpoint: https://api.elaichi.ai/mcp

1. Open Plugins, then press the + button.
2. Name it and paste the endpoint into Server URL.
3. Leave Authentication on OAuth, then tick the risk acknowledgement.
4. Press Create, then sign in and approve.

Works on the web today. The plugin directory lives at chatgpt.com/plugins.

## Connect Censys to Cursor

Endpoint: https://api.elaichi.ai/mcp

1. Open `~/.cursor/mcp.json`.
2. Add the endpoint under `mcpServers`.
3. Reload Cursor, then sign in and approve.

Set up per machine, so repeat it on each computer you work from.

## Connect Censys to any MCP client

Endpoint: https://api.elaichi.ai/mcp

1. Add the endpoint as a remote MCP server.
2. Sign in and approve.

The Elaichi Agent already has these tools, with nothing to set up.

## What the consent screen decides

Only Read is granted by default, which is not enough to call a Censys tool. Over MCP there is no trusted place to confirm a write in the moment, so the consent screen is the standing approval rather than a formality. Grant Read and Run tools. Think hard before granting Delete, which reaches into connected apps and cannot be undone.

## What teams do with Censys through Elaichi

### Check what an IP is exposing right now

Security operations. Ask for a Censys host by its address and get back the open services, software and location, then pull its service history to see what changed and when.

### Chase a suspicious certificate across the internet

Threat intelligence. Look up a certificate in Censys by fingerprint, read the raw details, and find every host presenting it so a single indicator turns into a full picture.

### Build a running inventory of external assets

Attack surface management. Run Censys searches for your organization's names and ranges, aggregate the results by service or location, and list the web properties that belong to you.

### Reconstruct a host's timeline during an incident

Incident response. Pull the event history for a Censys host to see when services appeared, disappeared or changed, and enrich the record with everything Censys knows about it.

### Confirm a fix by rescanning the host

Vulnerability management. After a patch or a firewall change, trigger a Censys rescan and check the scan result so the ticket closes on evidence rather than assumption.

### Trace a domain to the addresses behind it

IT and infrastructure. Resolve a name to its IP ranges in Censys, or work backward from an address to the names pointing at it, to untangle what is really serving a site.

## Frequently asked questions

### How do I connect Censys to Claude?

In Elaichi, choose Censys and paste in a Censys API key from your Censys account; there is no OAuth application to register and no client ID or secret to generate. Then open Claude, go to Customize, then Connectors, then Add, and paste the Elaichi endpoint https://api.elaichi.ai/mcp. Sign in to Elaichi when Claude asks, and Censys is available in your conversations.

### Does Censys work with ChatGPT and Cursor as well as Claude?

Yes. Once Censys is connected in Elaichi, the same endpoint, https://api.elaichi.ai/mcp, works in Claude, ChatGPT, Cursor, any other MCP client and the Elaichi Agent. You connect Censys once and every client you use picks it up.

### What can an AI agent actually do with my Censys data?

An agent connected to Censys can look up hosts by IP and report their open services, pull a host's event and service history, fetch certificates and their raw details, list your web properties, run and aggregate searches, resolve names to IP ranges and back, and trigger a rescan of a host. Because Censys offers many actions, the agent searches for the right one as you ask, so short concrete requests such as "show the certificate history for this host" work better than long paragraphs.

### Does connecting Censys give the AI access to my whole Censys organization?

The AI sees exactly what the Censys account behind the API key can see, and nothing more; if that account cannot view certain hosts or run certain searches, neither can the agent. Elaichi can narrow that access further, for example by removing the ability to rescan, but it can never widen what Censys itself allows. Every request still runs under the Elaichi user who made it, so the audit log names the person, not just the key.

### Can my team share one Censys connection?

Yes. One person connects Censys in Elaichi with an API key and shares the connection with a team; nobody else ever sees or handles that key. Each teammate still signs in to Elaichi as themselves, so the audit log records exactly who ran which Censys lookup or rescan.

### Can I stop an agent from triggering rescans or changing things in Censys?

Yes. Restrictions in Elaichi work action by action, so you can keep Censys read-only by blocking rescans while leaving host, certificate and search lookups available. A blocked action is never shown to Claude, ChatGPT, Cursor or any other client, so no prompt, accidental or deliberate, can reach it.

### What happens to a Censys connection when someone leaves?

Offboarding a person in Elaichi ends their access to Censys and every other connected application at once, without touching the Censys API key. A Censys connection shared with a team keeps working for everyone still on it. If you want Censys gone entirely, disconnect it once in Elaichi and it disappears from Claude, ChatGPT, Cursor and every other client at the same time.

## All 47 Censys tools

Every tool below is callable through https://api.elaichi.ai/mcp once Censys is connected, subject to the toolbox it is in and the restrictions on the caller.

- **Get single Censys host by ID** (Get). Get a single Censys host by its IP address. Returns: ip, location, autonomous_system, whois, services, service_count, dns. Required: id (the host's IP address).
- **Censys hosts bulk get** (Get). Retrieve up to 100 Censys hosts by their IP addresses in a single POST request. Returns: resource, extensions. Required: host_ids.
- **List all Censys hosts** (List). Retrieve multiple Censys hosts by their IP addresses via the deprecated GET method. Returns: resource, extensions. Required: host_ids. Use the bulk_get POST variant instead.
- **Censys hosts enrichment** (Action). Get enrichment data for a single Censys host by IP address. Returns: ip, location, autonomous_system, whois, services, service_count, dns, reputation, greynoise, network, privacy, labels, third_party. Required: host_ip.
- **Censys hosts event history** (Action). Get event history timeline for a Censys host. Returns: resource, extensions. Required: host_id, start_time, end_time. start_time is the timestamp closest to current time and end_time is furthest; both must be valid RFC3339 strings.
- **Censys hosts service history** (Action). Get historical service observations for a Censys host by IP address. Returns the host resource including ip, location, autonomous_system, whois, services (port, protocol, transport_protocol, scan_time, banner_hash_sha256), service_count, dns, and extensions. Required: host_id, organization_id. Max 100 results per page.
- **Get single Censys certificate by ID** (Get). Get a single Censys certificate by its SHA-256 fingerprint. Returns: fingerprint_sha256, fingerprint_sha1, fingerprint_md5, tbs_fingerprint_sha256, tbs_no_ct_fingerprint_sha256, spki_subject_fingerprint_sha256, parent_spki_subject_fingerprint_sha256, parsed, precert, revoked, names, validation_level, validation, revocation, ct, ever_seen_in_scan, raw, added_at, modified_at, validated_at,…
- **Censys certificates raw** (Action). Get the raw PEM-encoded content of a Censys certificate by its SHA-256 fingerprint. Returns the raw PEM-encoded certificate string. Required: certificate_id.
- **Censys certificates bulk get** (Get). Retrieve multiple Censys certificates by their SHA-256 fingerprints in a single request. Returns: fingerprint_sha256, fingerprint_sha1, fingerprint_md5, tbs_fingerprint_sha256, tbs_no_ct_fingerprint_sha256, spki_subject_fingerprint_sha256, parent_spki_subject_fingerprint_sha256, parsed, precert, revoked, names, validation_level, validation, revocation, ct, ever_seen_in_scan, raw, added_at,…
- **List all Censys certificates** (List). Retrieve multiple Censys certificates by their SHA-256 fingerprints. Deprecated GET variant; use the POST endpoint for new integrations. Returns: fingerprint_sha256, fingerprint_sha1, fingerprint_md5, tbs_fingerprint_sha256, tbs_no_ct_fingerprint_sha256, spki_subject_fingerprint_sha256, parent_spki_subject_fingerprint_sha256, parsed, precert, revoked, names, validation_level, validation,…
- **Censys certificates bulk get raw** (Get). Retrieve up to 1,000 Censys certificates in raw PEM-encoded format by their SHA-256 fingerprints. Returns the PEM certificate content for each requested fingerprint. Required: certificate_ids.
- **Censys certificates list raw** (List). Retrieve multiple Censys certificates in PEM format by their SHA-256 fingerprints. Returns: fingerprint_sha256, raw. Required: certificate_ids. The GET method is deprecated; prefer the POST variant.
- **Get single Censys web property by ID** (Get). Get a single Censys web property by its hostname:port identifier. Returns: ip, location, autonomous_system, whois, services, service_count, dns. Required: id.
- **Censys web properties bulk get** (Get). Retrieve multiple Censys web properties by identifier, up to 100 per call. Returns the result object with resource (ip, location, autonomous_system, whois, services, service_count, dns) and extensions. Required: webproperty_ids.
- **List all Censys web properties** (List). Retrieve multiple Censys web properties by identifier (deprecated GET method; prefer the POST bulk_get variant). Returns the result object with resource (ip, location, autonomous_system, whois, services, service_count, dns) and extensions. Required: webproperty_ids.
- **Censys search aggregate** (Search). Aggregate Censys search results by a specified field, splitting values into term buckets with counts — the API equivalent of the Report Builder. Returns: buckets. Required: field, number_of_buckets, query. number_of_buckets must be between 1 and 2000.
- **Censys search convert** (Search). Convert legacy Censys Search Language (CSL) queries to Platform (CenQL) queries in Censys. Returns the converted Platform query strings. Required: queries, organization_id. Limited to 100 queries per request.
- **List all Censys search** (List). Search Censys global assets using a CenQL query string. Returns: host, matched_services. Required: query. Max 100 results per page.
- **Get single Censys scan by ID** (Get). Retrieve the status and result of a tracked scan in Censys by its scan ID. Returns: resource, extensions. The resource object contains host data including ip, location, autonomous_system, whois, services, service_count, and dns. Required: id, organization_id.
- **Censys scans rescan** (Action). Initiate a live rescan of a known host service at ip:port or hostname:port in Censys. Returns a tracked scan result including scan_id and status, which can be polled via the Get scan status endpoint. Required: target, organization_id.
- **Censys DNS IP resolution bounds** (Action). Get DNS domain names that resolved to a specific IP address in Censys, with results aggregated per domain name. Returns a list of domain names that resolved to the provided IP, with aggregated time bounds per domain. Required: ip.
- **Censys DNS IP resolution ranges** (Action). Get DNS names that resolved to a specific IP in Censys with resolution records broken down by time range. Returns: ip, location, autonomous_system, whois, services, service_count, dns, extensions. Required: ip, organization_id. Max 100 results per page.
- **Censys DNS name resolution bounds** (Action). Get aggregated DNS resolution bounds for a domain name in Censys, showing currently resolving A, AAAA, MX, NS, SOA, and TXT records. Returns: name, record_type, resolve_time. Required: name, organization_id.
- **Censys DNS name resolution ranges** (Action). Get DNS resolution observations for a domain name in Censys, broken down by time range. Returns: name, record_type, resolve_time. Required: name, organization_id.
- **List all Censys collections** (List). List all Censys collections for an organization, optionally filtered by collection status. Returns: collection_uid, name, description, query, status.
- **Get single Censys collection by ID** (Get). Get a single Censys collection by id. Returns: collection_uid, name, description, query, status. Required: id.
- **Create a Censys collection** (Create). Create a new Censys collection with a name and CenQL query string. Returns: collection_uid, name, description, query, status. Required: name, query.
- **Update a Censys collection by ID** (Update). Update a Censys collection's name, description, and/or query by id. Returns the updated collection including its collection_uid, name, description, and query. Required: id, name, query. Cannot update a collection that is paused or archived.
- **Delete a Censys collection by ID** (Delete). Delete a Censys collection by id. Returns an empty 204 response on success. Required: id.
- **Censys collections list events** (List). List Censys collection events covering asset add/remove and status changes. Returns: asset_id, asset_type, collection_id, collection_name, event_type, evidence, org_id, query, timestamp, url. Required: collection_uid.
- **Censys collections aggregate** (Action). Aggregate search results within a Censys collection by a specified field. Returns: buckets. Required: collection_uid, field, number_of_buckets, query. number_of_buckets must be between 1 and 2000.
- **List all Censys censeye jobs** (List). List CensEye pivot analysis jobs in Censys. Returns: job_id, status, target, created_at. Filter results by host_id, webproperty_id, or certificate_id. Required: organization_id. Max 100 per page.
- **Create a Censys censeye job** (Create). Create an async CensEye pivot analysis job in Censys for a host, web property, or certificate. Returns: job_id, status, target, created_at. Required: organization_id and target. The target must contain exactly one of host_id, webproperty_id, or certificate_id. Poll job status before fetching results.
- **Get single Censys censeye job by ID** (Get). Get the status of a CensEye pivot analysis job in Censys. Poll this endpoint to check job completion before fetching results. Returns: resource, extensions. Required: id.
- **Censys censeye jobs list results** (List). List the results of a completed CensEye pivot analysis job in Censys. Returns: resource, extensions. Required: job_id.
- **Censys censeye value counts** (Action). Retrieve value counts in Censys to discover pivots by counting document matches for specific field-value pair groups filtered by an optional CenQL query. Returns count results under the result key for each requested group of field-value pairs. Required: organization_id, and_count_conditions. Each count-condition group may contain up to 5 field-value pairs.
- **Create a Censys discovery scan** (Create). Initiate a new Live Discovery scan in Censys by providing a target object. Returns the scan result object with discovery scan details. Required: target, organization_id.
- **Get single Censys organization by ID** (Get). Get a Censys organization's details by id, including member counts broken down by role and organization settings such as AI training and MFA requirements. Returns: created_at, member_counts, name, preferences, uid, organization_id, settings. Required: id.
- **Censys organizations list members** (List). List members of a Censys organization with their full user details. Returns a paginated result where each member includes uid, email, first_name, last_name, roles, created_at, first_login_time, and latest_login_time, plus a pagination object containing next_page_token and page_size. Required: organization_id.
- **Censys organizations invite user** (Invite). Invite a user to a Censys organization by email; the invited user receives an email to join. Returns an empty 201 response on success. Required: organization_id, email.
- **Censys organizations remove member** (Delete). Remove a member from a Censys organization. Returns an empty 204 response on success. Required: organization_id, member_id.
- **Censys organizations credits** (Action). Retrieve credit balance and expiration information for a Censys organization. Credits expire 12 months after they are acquired. Returns credit balance and expiration data. Required: organization_id.
- **Censys organizations credits usage** (Action). Get credit usage for a Censys organization over a specific date range. Returns: credits_consumed_by_consumer, credits_consumed_by_source, end_time, granularity, periods, start_time, total_added, total_consumed, total_expired, transaction_count. Required: organization_id, granularity. The date range cannot exceed 365 days and the earliest available date is 2025-01-01.
- **Censys organizations member credits usage** (Action). Get credit consumption for a specific member of a Censys organization over a date range. Returns: credits_consumed_by_consumer, credits_consumed_by_source, end_time, granularity, periods, start_time, total_added, total_consumed, total_expired, transaction_count. Required: organization_id, user_id, granularity. The date range cannot exceed 365 days and the earliest available date is 2025-01-01.
- **Censys users credits** (Action). Get the free user credit balance in Censys. Returns the credit balance result including a resource object with balance details and extensions. No required parameters.
- **Censys users credits usage** (Action). Get Censys user credit usage report broken down by daily or monthly granularity. Returns credit consumption data for the requested date range. Required: granularity. Dates must be on or after 2025-01-01 and the date range (end_date - start_date) cannot exceed 365 days.
- **List all Censys search collections** (List). Search for assets within a Censys collection by running a CenQL query across the collection's assets. Returns: host, matched_services. Required: collection_uid, query, organization_id. Max 100 results per page.