CISA Industrial Control Systems (ICS) advisories — vulnerabilities in operational-technology gear (SCADA, PLCs, building automation, energy/manufacturing/transportation systems, and medical devices), from the official CISA advisory RSS feed. Each item is normalized to the canonical advisory id (ICSA-YY-DDD-NN, or ICSMA-YY-DDD-NN for medical), title, link to the full advisory, publication date (ISO), and a plain-text summary. Optionally filter by keyword (e.g. a vendor like "Siemens") and cap the count. Returned newest-first. Free, public-domain (CISA).

Threat-intelligence reputation for an indicator of compromise (IOC) — pass ioc as an IP, domain, URL, or file hash (md5/sha1/sha256) and the type is auto-detected. Returns a malicious boolean plus a per-source breakdown: abuse.ch ThreatFox (IOC→malware/threat mapping), URLhaus (malicious URLs on a host/URL), MalwareBazaar (known malware samples by hash), Feodo Tracker (active botnet C2 IPs), Tor exit-node membership, and Spamhaus DROP (hijacked/criminal netblocks). Each source reports listed + a detail. Sourced from live, hourly-rotating threat feeds an LLM cannot know — a ground-truth liveness check for SOC alert triage, log enrichment, and blocklist decisions. Absence of a match is not proof of safety.

AbuseIPDB abuse report for a single IP — the crowd-sourced abuse-confidence score (0-100) the fail2ban / SSH-scanner / web-attack ecosystem reports into. Pass ip (IPv4 or IPv6). Returns abuseConfidenceScore, totalReports, numDistinctUsers, lastReportedAt, usageType (e.g. Data Center / Residential), ISP, domain, hostnames, isTor, isWhitelisted, and country. Set verbose=true for the individual report records (categories + reporter country). Optional maxAgeInDays (1-365, default 90) bounds the reporting window. Live crowd data an LLM cannot know — SOC alert triage, login-abuse blocking, and firewall decisions.

AbuseIPDB bulk blacklist — the most-reported abusive IPs above a confidence threshold, the canonical fail2ban / firewall block-feed. Returns ipAddress, countryCode, abuseConfidenceScore, and lastReportedAt for each entry, plus the list's generatedAt timestamp. Tune confidenceMinimum (25-100, default 90), limit (1-10000, default 100), ipVersion (4 or 6), and onlyCountries / exceptCountries (comma-separated ISO-2). Live crowd-sourced threat feed for populating drop lists, WAF rules, and edge blocklists.

AbuseIPDB subnet (CIDR) check — which IPs inside a network block have been reported for abuse. Pass network as a CIDR (e.g. 118.25.0.0/24; AbuseIPDB supports up to /16 for IPv4, /112 for IPv6). Returns the block metadata (network/netmask/min-max addresses, possible hosts, address-space description) plus reportedAddress: each flagged IP with numReports, abuseConfidenceScore, mostRecentReport, and country. Optional maxAgeInDays (1-365, default 30) and limit. Use to vet a hosting range, score a customer's netblock, or sweep your own allocation.

Multi-source IP reputation with one combined authority score (0-100). Polls four independent reputation sources in parallel and blends them: AbuseIPDB (crowd-sourced abuse confidence), abuse.ch threat-lists (Feodo botnet C2 + ThreatFox + Spamhaus DROP + Tor exit nodes), blocklist.de (fail2ban attack-report network), and StopForumSpam. Returns combinedScore, a verdict (clean / low / suspicious / malicious), which sources flagged it, per-source opinions (score + weight + detail), and enrichment (ISP, usage type, country, ASN, Tor). An authoritative threat-list hit (botnet/malware/hijacked netblock) hard-floors the verdict at malicious. Per-source isolation: a down feed degrades that opinion only. The one-call answer for 'should I trust this IP?' instead of trusting a single feed.

Security and provenance for an open-source package, composed live from three authoritative sources in one call. Pass ecosystem (npm, pypi, go, maven, cargo, nuget) + name (+ optional version; defaults to latest). Returns: known vulnerabilities from OSV (osv.dev — aggregates GitHub Security Advisories, PyPA, RustSec, Go vuln DB, etc.) each with its id, CVE aliases, summary, severity, and references; the resolved license and deprecation status (deps.dev); and the source repo's OpenSSF Scorecard health score (overall + per-check) plus stars/forks/open-issues. All live — newly-disclosed advisories appear within hours. Distinct from registry.npm-lookup / pypi-lookup (metadata only): this answers "is this dependency safe to add, what license does it carry, and how well-maintained is it."

USDA Plant Hardiness Zone for a US ZIP code — the standard planting zone (e.g. "9b") plus its average annual minimum-temperature range (°F) and the ZIP centroid. Keyless, public-domain (USDA PHZM). The "what grows where" primitive for gardening, landscaping, nursery, and agronomy agents.

Ground-truth soil profile for any US latitude/longitude from the USDA-NRCS SSURGO survey (Soil Data Access). Returns the soil map unit plus its component soil types ranked by composition percent, each with taxonomic order/class, drainage class, hydrologic group, and representative slope. Keyless, public-domain. Use for agronomy, land assessment, hydrology, septic/foundation suitability, and crop-fit reasoning. Coordinates over water or outside surveyed areas return an empty component list.

Look up any asteroid or comet in NASA JPL's Small-Body Database by designation, number, or name (e.g. "433", "Eros", "433 Eros", "1P/Halley", "2024 YR4"). Returns full name + kind + orbit class (e.g. Amor, Apollo, Jupiter-family comet), NEO and potentially-hazardous-asteroid flags, physical params (absolute magnitude H, diameter, extent, rotation period, albedo, density, spectral type), and orbital elements (eccentricity, semi-major axis, perihelion/aphelion, inclination, period, Earth MOID, observation arc). Astronomy, planetary-defense, and mission-planning research. Public-domain NASA/JPL data; for a body's near-Earth close approaches see /api/space/close-approaches.

List near-Earth asteroid/comet close approaches to Earth within a date window and maximum distance, from NASA JPL's Close-Approach Data API. Filter by dateMin / dateMax (YYYY-MM-DD) and distMaxAu (max approach distance in AU; default 0.05 AU ≈ 19.5 lunar distances). Each approach: object designation, close-approach date (UTC), nominal + minimum distance in AU and lunar distances, relative velocity (km/s), and absolute magnitude H (a size proxy). Sorted nearest-first. Planetary-defense, observation planning, and "what's passing by this month" queries. Public-domain NASA/JPL data; for full physical/orbital params of a listed object see /api/space/body.

Search confirmed exoplanets in the NASA Exoplanet Archive (~6,000, updated weekly — past any LLM training cutoff). Filter by name (planet, partial), hostStar (partial), discoveryYear, or method (e.g. "Transit", "Radial Velocity", "Microlensing"). Each planet: name, host star + how many stars/planets in the system, discovery method/year/facility, orbital period, semi-major axis, radius (Earth radii), mass (Earth masses), equilibrium temperature, insolation; host-star spectral type/temperature/radius/mass; distance in parsecs + light-years; and RA/dec. Astronomy, habitability research, science education. Public-domain NASA data.

Upcoming or recent orbital rocket launches from The Space Devs' Launch Library 2 — the live manifest behind most launch-tracking apps. `when`=upcoming (default) or previous. Optional `search` filters by rocket, provider, or mission text (e.g. "Starship", "SpaceX", "Artemis"). Each launch: name, status (Go/TBD/Success/Failure), NET launch time + window (UTC), launch provider, rocket configuration, pad + location, mission name/type/orbit/description, and whether a webcast is live. Real-time data agents can't get from training. Public CC-BY data (attribute The Space Devs).

Compute where any asteroid or comet is in the sky and whether you can see it. Give a body (designation/number/name, e.g. "433 Eros", "Ceres", "2024 YR4") and optionally your lat/lon and a time (ISO, default now). Returns the body's identity (NEO/PHA flags, orbit class, absolute magnitude H), its geocentric right ascension + declination, the constellation it's in, geocentric + heliocentric distance (AU), solar phase angle, and its apparent visual magnitude (IAU H-G model — how bright it appears now). With lat/lon it adds altitude/azimuth, whether it's above your horizon, a visible-now flag (up AND sky dark), and the best viewing window in the next 24 hours (when it's highest during darkness). Orbital position is computed locally from JPL elements — VALIDATED against JPL Horizons to <0.1 arcminute. Stargazing, astrophotography planning, occultation/observation prep. For the body's static physical + orbital params see /api/space/body.

Compute the current position of any cataloged Earth-orbiting satellite by NORAD catalog number (e.g. 25544 = ISS, 20580 = Hubble), using fresh Celestrak orbital elements propagated with SGP4. Returns sub-point latitude/longitude, altitude (km), and speed (km/s) for the requested instant (default: now; pass `at` as an ISO timestamp for any time within a few days of the elements' epoch). Supply observer `lat`/`lon` (and optional altKm) to also get look angles — azimuth, elevation, slant range, and whether the satellite is above your horizon — for visual/antenna pointing. Satellite tracking, pass prediction, ground-station planning. Public-domain orbital data; physical/mission metadata is not included.

Search the catalog of every cataloged Earth-orbiting object — ~69,000 satellites, rocket bodies, and debris tracked by US Space Force / 18 SDS (via CelesTrak SATCAT). Filter by name (q, e.g. "starlink"), owner/launching country (owner — code like US/PRC/CIS or a name like "china"), object type (type = payload | rocket body | debris | unknown), launch-year range (launchYearFrom/launchYearTo), international/COSPAR designator prefix (intlDesignator, e.g. "2024-"), on-orbit vs decayed (onOrbit), or exact NORAD number (noradId). Each result carries the NORAD id, name, international designator, object type, owner + resolved country, launch date + site, decay date (null = still in orbit), and orbital parameters (period, inclination, apogee, perigee). The envelope total is the full count matching your filter — so onOrbit=true&type=payload answers "how many active satellites are up there", and owner=PRC tells you who launched them. For a satellite's live sub-point position, pass its noradId to /api/space/satellite.

Observer-local sky almanac for any lat/lon and time (default now). Returns the Sun's next rise/set + current altitude/azimuth; the Moon's rise/set, current alt/az, phase angle, phase name (New → Full → Waning Crescent), illuminated fraction, and next moon quarter; and for all seven non-Earth planets (Mercury→Neptune): altitude, azimuth, RA/dec, distance (AU), apparent magnitude, and whether each is currently above the horizon. Computed from first principles (astronomy-engine, sub-arcminute) — no external service, no key. Stargazing, astrophotography planning, 'what's up right now', is-it-dark-yet. `at` accepts any ISO timestamp.

One call → what's notable in YOUR sky right now, for a lat/lon. Synthesizes three sources: (1) the live almanac — sun up/down, moon phase + illumination, and which of the 7 naked-eye planets are currently above your horizon with their altitude/azimuth/magnitude; (2) near-Earth asteroid close approaches over the next 7 days (designation, date, distance in lunar distances); and (3) the ISS — its current sub-point, and whether it is above your horizon right now with look angles. Each section reports found/error independently. The "is it dark, what's up, anything passing" digest for stargazers and astrophotographers. For the raw almanac alone see /api/space/sky-tonight.

Profile a confirmed exoplanetary system by host-star name (e.g. "TRAPPIST-1", "Kepler-90", "TOI-700"). Groups all the star's known planets into one view, summarizes the host star (spectral type, temperature, radius, mass, distance in light-years), and COMPUTES the star's habitable ("Goldilocks") zone — inner and outer boundary in AU, derived from the stellar luminosity (effective temperature + radius vs. the Sun) — then flags which planets orbit within it. Each planet: radius/mass (Earth units), orbital period, semi-major axis, equilibrium temperature, and in-habitable-zone flag. Astronomy, habitability research, education. Built from the NASA Exoplanet Archive (the same data as /api/space/exoplanet) plus the computed HZ. Public-domain NASA data.

MLB games for a date (and optionally one team), via the official MLB Stats API (free/keyless). Each game: gamePk, start time, detailed status (Scheduled/In Progress/Final), away and home team + score, and venue. Defaults to today when no date is given. Live scores + schedule for agents.

MLB regular-season standings for a season (official MLB Stats API, free/keyless). Each team: wins, losses, win %, games back, division + league rank, and current streak. Defaults to the current season.

NBA games from balldontlie — schedule and scores in one feed. Filter by season (start year), a single date, and/or team id. Each game: date, season, status, postseason flag, home/visitor teams and final (or live) scores. Cursor-paginated (pass meta.cursor as cursor to continue).

NBA players from balldontlie — search by name and page through results. Each player: id, name, position, height, weight, jersey number, college, country, draft year, and current team. Cursor-paginated (pass meta.cursor as cursor to continue).

NBA teams from balldontlie — all 30 franchises with id, full name, abbreviation, conference, division, and city. Pass an optional team id to fetch a single team.

NFL games from balldontlie — schedule and scores in one feed. Filter by season, week, and/or team id. Each game: date, season, week, status, postseason flag, venue, recap summary, home/visitor teams and final (or live) scores. Cursor-paginated (pass meta.cursor as cursor to continue).

NFL players from balldontlie — search by name and page through results. Each player: id, name, position, height, weight, jersey number, college, experience, age, and current team. Cursor-paginated (pass meta.cursor as cursor to continue).

NFL teams from balldontlie — all 32 franchises with id, full name, abbreviation, conference (AFC/NFC), division, and city. Pass an optional team id to fetch a single team.

Upcoming NHL game schedule for the week anchored on a date (official NHL api-web, free/keyless). Each game: id, date, start time (UTC), game state (FUT/LIVE/OFF), game type (Preseason/Regular Season/Playoffs), away and home team + abbreviation + score, venue, and TV broadcasts. Optionally filter to one team by 3-letter abbreviation (e.g. TOR). Defaults to the week starting today. Forward-looking matchups for scheduling agents — distinct from nhl-scores (single-day results).

NHL scores and games for a date (official NHL api-web, free/keyless). Each game: id, game state (FUT/LIVE/FINAL), start time, away and home team + score. Defaults to today.

Recent news articles about a specific US-listed company. Pass ticker and optionally a from/to date window (YYYY-MM-DD; defaults to the last 14 days); returns headlines with source, summary, URL, image, related symbol, category, and publish time (newest first). Use it to catch up on what is being written about a company. News aggregated by Finnhub.

Historical quarterly earnings surprises for a US-listed company — reported (actual) EPS vs the analyst consensus estimate, the absolute surprise, and the surprise percentage, for the most recent quarters (newest first). Pass ticker (optionally limit). Tells you whether a company has been beating or missing expectations. Data by Finnhub.

As-reported financial statements for a US-listed company, exactly as filed with the SEC — balance sheet, income statement, and cash-flow statement line items, parsed from each 10-K/10-Q. Pass ticker and optionally freq (annual or quarterly) and limit; returns the most recent filings (newest first) with filing metadata (form, period, filed date, accession) and the full report under `report`. Data by Finnhub.

US federal government spending awarded to a public company (sourced from USAspending). Pass ticker and optionally a from/to window (YYYY-MM-DD; defaults to ~2 years); returns each award with the recipient (and parent), awarding agency/sub-agency, obligated/outlayed/potential/total values in USD, action date, and period of performance. Use it to see how much federal money flows to a company. Data by Finnhub.

US work-visa (H-1B and related) applications filed by a public company, sourced from Department of Labor LCA disclosures. Pass ticker and optionally a from/to window (YYYY-MM-DD; defaults to ~2 years); returns each application with job title, SOC code, visa class, case status, wage range, worksite city/state, employment dates, and case number. Use it as a hiring/headcount signal. Data by Finnhub.

Aggregated insider sentiment for a US-listed company, by month. For each month returns the net change in insider share holdings and Finnhub's MSPR (Monthly Share Purchase Ratio, −100 to +100 — higher means more net insider buying). Pass ticker and optionally a from/to window (YYYY-MM-DD; defaults to ~1 year). A distilled signal layered on top of raw insider filings. Data by Finnhub.

US federal lobbying disclosures for a public company (sourced from US Senate LDA filings). Pass ticker and optionally a from/to window (YYYY-MM-DD; defaults to ~3 years); returns each filing with the registrant name, the period (year + quarter), reported lobbying income/expenses in USD, and a link to the official Senate filing. Use it to track a company’s lobbying spend over time. Data by Finnhub.

Key fundamental metrics and 52-week price statistics for a US-listed company. Pass ticker; returns headline valuation, margin, and per-share figures — P/E, P/B, P/S, PEG, EV/EBITDA, gross/operating/net margins, ROE, ROA, current ratio, debt/equity, dividend yield, beta, 52-week high/low, and YTD/52-week price returns — plus the full Finnhub metric map under `metric`. Computed ratios you would otherwise derive yourself from raw filings. Market & fundamental data by Finnhub.

USPTO patent activity associated with a public company. Pass ticker and optionally a from/to window (YYYY-MM-DD; defaults to ~2 years); returns each record with the application number, patent number (when granted), the filing company name(s), description/title, patent type, filing status, filing and publication dates, and a document URL. A company-level innovation/R&D signal (distinct from our keyword patent search). Data by Finnhub.

Peer companies for a US-listed ticker — other companies in the same sector and sub-industry, useful for comparables, relative valuation, and screening. Pass ticker (optionally grouping to control how peers are grouped); returns a ranked list of peer ticker symbols (the input symbol is usually first). Data by Finnhub.

Latest daily stock quote for a US-listed ticker. Returns the most recent completed trading session: open, high, low, close, volume, VWAP, and trade count, plus the change and percent change versus the prior session, and company reference data (name, primary exchange, security type, currency, market cap). NOTE: this plan tier serves end-of-day / delayed data (the response flags delayed=true), suitable for daily snapshots, fundamentals context, and post-close analysis rather than real-time trading. Pass ticker as a US symbol (e.g. AAPL, MSFT, BRK.B). Market data by Massive (formerly Polygon.io).

Analyst recommendation trend for a US-listed company — the number of analysts rating it strong buy, buy, hold, sell, and strong sell, snapshotted per month (newest first). Pass ticker. Use it to see the consensus and how sentiment is shifting over time. Data by Finnhub.

Search or list the tradable equity symbol universe for an exchange. Pass q to substring-match on symbol or company name (case-insensitive), and/or exchange (default US) and limit. Returns matching listings with symbol, display symbol, description (company name), security type (e.g. Common Stock, ETF), currency, MIC, and FIGI. Use it to resolve a name to a ticker or enumerate a market. Data by Finnhub.

Compute sunrise, sunset, solar noon, and civil/nautical/astronomical twilight times for a coordinate + date. Query: lat (-90..90), lon (-180..180), date (YYYY-MM-DD). All times returned as ISO 8601 UTC. At high latitudes near solstices an event may not occur (polar day/night) — those fields return null and a note is included. dayLengthMinutes is the sunrise→sunset interval.

Validate a European Union VAT number against the official VIES (VAT Information Exchange System) register in real time. Confirms whether the VAT identifier is currently registered for intra-EU trade and, when the member state discloses them, returns the registered business name and address. Covers the 27 EU member states (Greece as EL) plus Northern Ireland (XI); Great Britain (GB) is not in VIES. Pass either a full identifier (vat=DE811569869) or country + number. Returns {valid, countryCode, vatNumber, name, address, requestDate, reason}. When a member-state register is temporarily down, returns a retryable 503 rather than a false negative. Data from the European Commission VIES service.

Current EU VAT rates by member state — standard rate plus reduced/super-reduced/parking/zero rates. Pass `country` (ISO 2-letter; Greece is EL) for one state, or omit it for all 27. Each result returns the standard rate, the list of reduced rates in force, every rate category with its percentage, and the date the rates are in force. Source: European Commission TEDB (Taxes in Europe Database), refreshed regularly. Pairs with tax.vat (which validates a specific VAT number against the live VIES register).

Validate an EU VAT identification number against the official VIES service (European Commission, keyless). Returns whether the number is currently valid and, where the member state discloses it, the registered trader name and address. The authoritative EU B2B/KYB check (e.g. for reverse-charge eligibility) — complements tax.vat-rates and the business.* registries.

Search FCC Electronic Comment Filing System (ECFS) filings for a proceeding/docket (e.g. 17-108 net neutrality, 11-42 Lifeline). Optionally filter by filer name. Returns the newest filings with the submission id, filer, type, lead bureau, received/disseminated dates, and document count. Public-domain federal data. Track FCC regulatory dockets, comments, and ex-parte filings an LLM can't recite fresh.

Map a US latitude/longitude to its FCC spectrum-licensing geographies — Cellular Market Area (CMA), Basic Trading Area (BTA), Major Trading Area (MTA), Partial Economic Area (PEA), and the BEA/EAG/MEA/REAG economic areas — plus the 2020 Census block FIPS, county, and block population. Keyless, public-domain (FCC). These market areas define spectrum-license boundaries (which CMA/BTA/PEA a point falls in) — distinct from ordinary geocoding, and not derivable by an LLM.

Next high/low tide predictions near a coordinate. Query: lat (-90..90), lon (-180..180), radius_km (1-500, default 100), hours (1-72, default 24). Returns { query, station:{ id, name, latitude, longitude, state, distanceKm }, predictions[{ time (station local), type: "high"|"low", heightMeters }], source }. Returns 404 NO_STATION if no NOAA tide station is within radius. Heights are referenced to MLLW (Mean Lower-Low Water).

Parse a timestamp or date string into canonical forms — zero-dependency. Accepts unix seconds/millis or any standard date string (ISO-8601, RFC-2822, etc.). Returns UTC ISO, unix seconds + millis, RFC-2822, calendar components (year/month/day/hour/minute/second/weekday), ISO weekday, ISO year+week, and day-of-year. Pass an IANA timezone (tz) to also get the DST-correct local wall-clock time and UTC offset. The reliable time primitive for agents normalizing or converting timestamps.